Another Serious MSIE Hole

pjrc writes "Infoworld is reporting another new security hole that allows links to executable files to appear to be any other type of file, such as text or pdf. When combined with a previously reported spoofing bug, that Microsoft still hasn't fixed, Infoworld claims the result could be 'devastating'"

Comments

In other words,...

[burgburgburg]

it's Wednesday.

this will show them

[atari2600]

A demonstration of the hole is currently on security company Secunia's website and demonstrates that if you click on a link, and select "Open" it purports to be downloading a pdf file whereas in fact it is an HTML executable file.

Haha this will show them - i am downloading the latest patch from www.mikerowesoft.com - m defen is str..o..noo!!..hel..elp

I wonder

[Anonymous Coward]

I wonder how well I can navigate the internet with out clicking on any hyperlinks.

From the article

[nate1138]

From the article text:

Doom worm currently reeking havoc across the globe.

So it's a smelly worm? Or are they trying to say that Windows stinks?

But, but, but Bill said...

[Space cowboy]

... that Windows is far more secure than Linux or OSX because it gets tested so many more times out there in the wild..

[Editors note: replace 'tested' with 'tested and found wanting']

Simon.

Re:Hmmmm...

[eclectro]

Wasn't good ol' Bill just extolling the virtues of Windows Security in comparison to other 'unnamed' operating systems the other day?

He was busy being "knighted"

Re:But MS is "fixing" other issues...

[poot_rootbeer]

Microsoft is deprecating the use of "@" in URLS.

The popularity of IE is about to drop sharply as the entire XXX-site-password-hacking community finds their reliable tricks no longer work.

Should knock MS's browser marketshare down 10-15% just from that alone.

If I had a dollar

[BoomerSooner]

for every person who constantly bitches about "pop-ups" or something messing up my computer related to IE. I'd retire. All I say is go to mozilla.org and leave me the hell alone.

I guess being a computer professional is like being a doctor. Everyone asks you anything related to your field regardless of the situation (ie, dinner, getting dental work done, ...). I try to explain I'm a $100/hour (yes, outsourcing is my fault) contract software engineer. If you want me to reinstall your OS, Drivers, Applications and backup your data that will be about 6-8 hours (assuming they have any legit install disks) and roughly $600 to $800 total. They usually quit calling after that.

It's like calling a mechanical engineer to change your fucking tire. Figure it out, it isn't that hard.

Re:If I had a dollar

[Luscious868]

I guess being a computer professional is like being a doctor. Everyone asks you anything related to your field regardless of the situation (ie, dinner, getting dental work done, ...). I try to explain I'm a $100/hour (yes, outsourcing is my fault) contract software engineer. If you want me to reinstall your OS, Drivers, Applications and backup your data that will be about 6-8 hours (assuming they have any legit install disks) and roughly $600 to $800 total. They usually quit calling after that.

You hit the nail on the head there brother. I'm so sick and tired of people that I barely know calling me when their computer breaks asking for help. It always turns into a friggin 2 - 6 hour event. You know the routine. Uninstalling all the crap that people have downloaded. "Hey, let's install this cool looking Bonzi Buddy thingy, what can it hurt?". The idiots should be shot. Removing spyware, removing the 80 virues that have found there way onto the system. "Hey look at this funny attachment, it's called 'Dont Open Me I'm a Fucking Virus and I'll Fuck Up Your Computer.exe' why don't I open it and see what happens. Maybe it's a funny joke or something."

I think I'm going to start telling people that I work for the post office and I'm currently taking court ordered anger management classes. That will shut them the fuck up real quick.

Re:If I had a dollar

[cens0r]

Every time I fix a computer I get offered something in return. Be it a 6 pack of beer, a free dinner, a couple of drinks at the bar, etc, it's always something. Maybe I just have a nicer social network than you do?

Re:If I had a dollar

[GMFTatsujin]

I work for Local University (TM) at the medical library, which handles tech support for the campus. With the recent outbreak of the worm of the day, I've taken it upon myself to create a web page for our users on best computing practices. I'm still putting it together, so mostly it's just getting blocked out for structuring the content.

Here's one of the sections that I wrote more out of catharsis than actual informative intent. It certainly won't make the web, but it got my point across.

Don't Put Strange Things in Your Mouth

It doesn't take fancy book-learnin' to catch on when you recieve an emailed attachment that you didn't ask for -- especially when it starts turning up from lots of different addresses in a short period of time. Opening an unrequested email attachment is about as hygenic as chewing on a urinal cake, and you should know better. That means you, Doctor Six-Years-in-Medical-School.

Redundant headline

[DocSnyder]

"Another Serious MSIE Hole" could be shortened a bit:

• Another - unnecessary.
• Serious - less serious holes don't get any attention.

What's left: "MSIE Hole".

• Hole - what else?

Still left: "MSIE"

As most serious security problems affect MSIE, it can be omitted as well. The least redundant informative headline would be:

• ""

Re:Redundant headline

[rokzy]

"" could also stand for "SCO lies" or "RIAA acts like a dick", so I think "IE" would be best.

Re:I don't think MS cares anymore

[eclectro]

I really don't think Microsoft cares any more

It's called pride of 0wn3rship.

Reminds me of the old joke

[mcc]

Q: How many Microsoft engineers does it take to change a light bulb?

A: They don't, they just redefine darkness as the new standard.

New Acronym: "A.S.S. Hole"

[tds67]

Another Silly Software Hole.

Re:No wonder

[jpmkm]

Boxen? Do you also hunt foxen?