Another Zero-Day IE Scripting Exploit

billstewart writes "A Computerworld Article reports a pair of vulnerabilities to Internet Explorer that allow Windows machines to be 0wned by a single click on a malicious web page. It was discovered by Dutch researcher Jelmer. As usual, the primary workaround is to disable Active Scripting for any sites that aren't Trusted, but you should have turned off that and Javascript years ago for safety anyway. At least one of the holes is fixed in XP Service Pack 2, but that doesn't fix previous versions of Windows and it's still only beta."

Comments

no problem.

[twitter]

I doubt the site was booby trapped for lynx or wget. Here's the text: /* start */

Why Some Sites Only Work With IE

If you surf the web with a browser like Firefox, Netscape, or Opera, you've probably run into sites that either require Internet Explorer or look very poor in non-IE browsers.

I previously thought this was due to laziness on the part of web developers. Events of the past days have made me think something else may be at play.

I'm a software developer at a very large company. Recently, the company underwent a reorganization. I now work for a different business unit. To make a long story short, this business unit does not give employees permission to install software on their desktop computers. They don't just prohibit it, they flat out prevent it via Windows administrator settings.

This means I have to use the corporation's approved; web browser: Internet Explorer. And, it means I can't even install Firefox or Opera to test my web designs.

Luckily, the team I work with is pushing the corporate bureaucracy to give us more rights to our machines. But I wonder how many people go through that effort, or how many of them succeed? Can policies like this - where the web developer can't even test their site in a non-IE browser - explain why some sites don't work in other browsers?

/* end */

Not much too it. Note that no examination of the page was made for booby traps of any kind. Also a number of "#8271" were removed. The text claims it was generated by word press. spacerook uses apache on linux and is a lunarpages site.