Slashdot Mirror
Another Zero-Day IE Scripting Exploit
billstewart writes "A Computerworld Article reports a pair of vulnerabilities to Internet Explorer that allow Windows machines to be 0wned by a single click on a malicious web page. It was discovered by Dutch researcher Jelmer. As usual, the primary workaround is to disable Active Scripting for any sites that aren't Trusted, but you should have turned off that and Javascript years ago for safety anyway. At least one of the holes is fixed in XP Service Pack 2, but that doesn't fix previous versions of Windows and it's still only beta."
You can download a fix for this here.
Things you think are in the Constitution, but are not.
Workaround for this bug has been posted. "Don't click links!"
I am beginning to feel if I am going to be screwed by microsoft they should buy me dinner and a movie first...
Off to check for updates.
IE is a great OS but it lacks a decent browser...
Maybe I'm stupid, but what is IE?
If you mod me down, I *will* introduce you to my sister!
A web browser should NOT be tied into the OS core as IE is with Windows. A tiny speed gain (or any other reasons for that matter) is not worth all these security issues.
You know when you buy new italian salid dressing, and the oil and the spices are all separated in different layers? That is what good software architecture is supposed to look like.
Now, shake up the bottle. That is what Microsoft software looks like.
See, this is why I stay away from malicious web pages in the first place. You just can't trust those things!
Hey freaks: now you're ju
This isn't the only occurance of such an exploit. Windows machines can also be easily owned by a single click on Dell.com. I believe it is the "Buy it now" button.
AC comments get piped to
Maybe s/he was trying to be funny. I don't use IE either. :-)
I'm sorry... javascript is a requirement on the modern web. If you are afraid to leave it on, you might want to look into switching browsers. Next you'll tell us cookies are "tracking you" and you should turn that off as well.
Fortunately my optimism filter translated your statement
I'm sorry... java is a requirement on the modern web. If you are afraid to drink it, you might want to look into switching liquid diets. Next you'll tell us cookies are "yummy" and you should visit the vending machine as well.
Unfortunately, it's playing heck with my diet.
-Adam
Oh my god. Someone's employed Snoop Dogg as a military contractor...
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
User: User
Boy, that's useful information there ...
We're talking MS here.
RC1 = Alpha
Release = Beta
Release + many patches later = Release
I clicked on the link, what's the big deal? It didn't do anything but pop up a hollow box in the window.
Nothing installed, my system didn't crash. There were no apparent ill effects to clicking on that.
So why is everyone so worked up? I use Windows XP every day for some of my work, and haven't had a problem with malicious web pages in over a year.
I've been using FireFox for over a year, but that's probably just a cooincidence.
then the terrorists have already won.
go! click on the link! for liberty and freedom!
I don't have any problems with Windows XP at all...zero, zip, none. None with IE either. Never done any updates either. Perfectly safe in fact...
My PowerBooks are the only thing that go online.
Sometimes the obvious takes longer.
It's an Internet browser that people used back in the olden days. Just after the Internet was invented.
It is a virus used by terrorists. It stands for "Internet Exploder".
WWJD? JWRTFA!
its Infection Explorer - the tool to download the latest worm/virus/spyware :)
The Wielder of Windows has spoken, fear is not permissable, only awe. That is all.
An Education is the Font of All Liberty
...and not use IE. JavaScript, while often abused, is still useful for proper end-user UI feedback. Using a good browser (Moz/Firefox/Opera/!MSIE) will clean up most of the annoyances with JS problems.
IE == Infinitly Exploitable
IE is the open RPC facility of MS Windows, similar to sun.RPC. In the early days it was shipped as a separate application. Starting with Windows XP/2000 MS decided to integrate it directly into the kernel. For the sake of convenience and performance Microsoft didn't bloat it with authentication or security features so when active basically anyone can remotely execute code on your machine in a comfortable drill&drop-fashion.
Since IE requires the local user to be actively browsing the web in order to provide RPC service MS is working on an extension of the RPC concept to allow for asynchrone/sheduled remote code execution. Early beta-versions of the latter software (Project name Outlook) are included for evaluation with MS Office 2000/XP which can be purchased for a modest fee at your local MS retailer.
MS Outlook supports the robust SMTP protocol for remote access so it may be considered the most reliable RPC-interface available for MS windows to date.
Sorry, I think you're wrong. It's not a virus. It's a virus and general malware delivery toolkit.
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
Maybe I'm stupid, but what is IE?
Nah if you were stupid you'd be using it
In Soviet Russia Slashdot cliches use you
That's a great idea. When Dell sees their product sales sagging, I'm sure they'll say "Crap Bob, 0.001% of 5% of web surfers aren't buying Dells because our web page don't render properly in their browser - we need to fix that right away!"
What are you doing? The world would be a better place if you just linked the computer illiterate to Mozilla and told them that Internet Explorer is nothing more than a myth; a sort of Holy Grail for virus-writers.
True story.
as opposed to the OSS method of naming:
RC1 = pre-alpha with new name
RC2 = alpha
Release = RC2 with new name.
Totally renamed product rewritten from the ground up = Release
-]Phreak Out[-
Na... the best firewall is a physical wall that blocks the computer from every physical contact (including the network cable)