Slashdot Mirror
Another Zero-Day IE Scripting Exploit
billstewart writes "A Computerworld Article reports a pair of vulnerabilities to Internet Explorer that allow Windows machines to be 0wned by a single click on a malicious web page. It was discovered by Dutch researcher Jelmer. As usual, the primary workaround is to disable Active Scripting for any sites that aren't Trusted, but you should have turned off that and Javascript years ago for safety anyway. At least one of the holes is fixed in XP Service Pack 2, but that doesn't fix previous versions of Windows and it's still only beta."
Here is the BugTraq Archive link.. WARNING.. The link to this site contains OTHER links to the ACTUAL exploit as well as the source code and a non-harmless display. Use at your OWN risk. Just thought I would put out the disclaimer.
Hmmm.
Unfortuneately, some businesses restrict what software the employees can install on their computer. I've written about such an experience here.
de jure: of right, by right, according to law.
du jour: That is chosen or allocated for a particular day: 'of the day', 'for today'; sometimes with connotations of impermanence, interchangeability, or repetitiveness.
Questions, comments?
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
Even more disappointing is that this hole in IE is then used to put a file on your computer, and then the file takes advantage of a local exploit that Microsoft has known about since August of 2003. Yet they have failed to patch it.
If my answers frighten you, stop asking scary questions.
It was kind of an ugly story. Apple released a patch for that hole, but then it was discovered that the entire concept of their registering URL system could allow pretty much any URL to launch arbitrary code.. Or something like that. I didn't follow it too closely myself. Apple just barely released a master fix just two days ago.
Moof.
Exploits like these, on the other hand, are akin to a passive attack from the inside (like an infected laptop connected from inside the firewall) but are even more serious, because very little action is required on part of the user to affect the attack and *very* difficult to monitor and contain.
An Indian-American Hindu committed to non-violent thought/speech/action alarmed by the global explosion of radical Islam
I tried the demonstration, and Norton popped up and prevented the thing from running. Apparently someone's on the ball somewhere.
Let's not stir that bag of worms...
Symantec catches this vulnerability as the following:
a tion: Quarantine
Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: Downloader.Trojan
File: C:\Documents and Settings\User\Local Settings\Temporary Internet Files\Content.IE5\67HK1KWV\installer[1].html
Loc
Computer: Computer
User: User
Action taken: Quarantine succeeded : Access denied
Date found: Wednesday, June 09, 2004 11:56:26 AM
Most corporations should have little to worry about.
-Tolerate my intolerance
Reference to Microsoft advice (he was trying to be funny, you insensive clod.)
.Doesn't zero-day mean that the bug came out the same time as IE? Didn't IE come out several years ago? And if one of these is already fixed in SP 2, that doesn't sound exactly zero-day either.
Given some of the CS students I've seen leaving both the BS and MS portions of UIUC's CS program for microsoft, not very good.
Slashdot Patriotism: We Support our Dupes!
Another IE security problem, are you suprised by this? Lets make an insecure piece of software that intergrates into our operating system with portions of it running at Ring Zero. This allowing whatever malicious code/hacker to gain access to your system.
Now most people recommnd just switching to Linux. Yeah that works. But what about those hacked Windows PCs that happen to be remotely controlled? Some are sending SPAM others are used for DDoS attacks and others just scan all the IP space they can get ahold of.
It is a vicious cycle which has been growing more pronounced over the past 4 years. The only real solution to this problem is to inform people. Don't just tell people to use something else.
Explain the advantages of using a different program. In this case explain how Mozilla or Opera being seperate programs with different internal works and security systems are not going to be compromised as easily.
Push harder towards Open Media/Content
Typically, JavaScript is not a requirement for anything except to compensate for poor website design.
I have it turned off by default, and I rarely miss it. On the occasion when I land on a site which misbehaves without it, I take a moment to read the page source, and invariably find that nothing is going on there that couldn't be expressed better with stylesheets or computed on the server. And I find in about half of those cases that the pages remain broken even with JavaScript turned on.
In principle, there are cases when you genuinely need to do client-side computation, or where it makes sense architecturally in designing an in-house application because the organization owns the clients as well as the servers.
For general use, however, XHTML is sufficient.
You only THINK you are joking:
The most effective step that you can take to help protect yourself from malicious hyperlinks is not to click them. Rather, type the URL of your intended destination in the address bar yourself.
linky
This was for a previous IE link related exploit. When MS is telling not to use their product in the most basic manner expected of the product then it should be painfully obvious that the product is broken.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
However, not all browsers support CSS in this manner. While you could do it, if it is a key method of navigability, you will ostracize many many users. It is my experience that more modern browsers' javascript implementation is close and feature-complete than is their CSS implementation.
As an added bonus, I find that JavaScript is very handy as a prototyping language...
Several people have mentioned that JavaScript is used only for roll-overs and such. You can do some truly wonderful UI stuff with JavaScript, such as leveraging the client's processor cycles to handle mundance but expensive tasks like sorting and layout. Sending a set of data to the client, javascript objects, CSS and laying it out at runtime is much more bandwidth-efficient than sending the formatted results of a query. PLUS, you can use javascript to pop-up a new window and get a new dataset, which can be displayed with the same code used for the original. There are SO MANY nice things you can do with JavaScript. JavaScript is a technology that nicely enhances the user experience, but certainly can be misused.
It is RC1 and it is available here
As always, are from the start design problems the ones exploited here, artificial solutions like separating internet in "zones" (local, trusted, etc) are just patches that don't resolve the core problem so it still have more holes that a swiss cheese.
Right... so it's time to turn to Struts and JSPs for validation every form on our site.
Yes, because you can't trust the client! You can't trust that the client has javascript turned on. You can't even trust that he is running a web browser. He may be running some cool scripts an POSTing whatever malicious data he thinks would be fun to try.
Really, if it is important to validate your data you need to do it on the server!
)9TSS
Uh, you're forgetting about the third extremely prevelant form use of Javascript: Navigation. Many sites use javascript apps for the regular links (especially if the link is supposed to pop up a small window with a little additional information). These sites are completely unusable if you disable Javascript. The worst part is that entities like banks and businesses are the most likely to use this form of navigation (because they hired "professional" web designers).
I used to enable and disable Javascript a lot to deal with this problem, but then I swiched to Mozilla and just left it on. It hasn't been a problem for me yet.
I read the internet for the articles.
The previous poster pointed out the wrong way. The better way is <a href= "yourlink" onclick= "popupFunctionOrWhatever('yourlink'); return false;">click here</a> . This activates your JS function for those that have it and provides a normal link for those that don't. The return false prevents the normal link from being activated if the onclick is performed by JS-aware browsers.
Constitutionally Correct
Right, server-side validation is absolutely essential.
But if you can implement client-side JS validation properly, there's nothing wrong with doing so. The user gets immediate feedback, without an extra round-trip just to be told to fix something. The user experience is greatly improved, and your server's burden is reduced since it only has to validate once thanks to already being validated on the client.
Constitutionally Correct
Dutch researcher Jelmer [...] embarked on a detailed analysis of the link, which demonstrates an extremely sophisticated use of encrypted code.
Hmm... I hardly consider using the (unfortunatly) existing Script encoding feature in IE to be 'sophisticated'. Besides, for those who are not DMCA-encumbered, here is a program to Decode the Javascript contained in the "JScript.Encode" areas. (The author of the script has an interesting and informative article on what a piece of crap the JScript.Encode function is, and can be found here)
You forgot to tell the reader one thing - all those bugs in Mozilla are already fixed.
None of the ones in the IE list are.
Either you don't read carefully or you are purposefully trying to mislead, I can't decide which.
HBI's Law: Frequency of calling others Nazis is directly correlated with the likelihood of the accuser being Communist.
As usual, the primary workaround is to disable Active Scripting for any sites that aren't Trusted, but you should have turned off that and Javascript years ago for safety anyway
:
There aren't exploits I'm aware of for JavaScript. JavaScript was originally written by Netscape, and to all intents and purposes, runs in a sandbox.
Microsoft's implementation of JavaScript is called Jscript.
From when I can tell of the exploit, it has to do with Microsoft's insecure DHTML model.
From the MS documentation of the execScript method
execScript
Executes the specified script in the provided language.
Standards Information :
There is no public standard that applies to this method.
Shame that so many fucking "experts" can't get their terminology right.
Sigh.
Remove Internet Explorer from Windows 2000. (Free)
Remove Internet Explorer from Windows XP.(Free)
FDV
Not a bad start.
We don't let them even see their C: drive, either (amongst other restrictions). Draconian? Yes, but it's the only sane approach for a corporate network. With what we give them, they can accomplish everything they need to get their job done.
Sane? I have my doubts When free OS exist that require far less effort on your part? What exactly do your users need to get their job done? How do you know? Do you realize that by doing all of that you have eliminated almost all of the reasons to run windoze in the first place? Why pay for something you don't want to use? I'd rather have a KDE desktop that I can plug my camera and PDA into. You must have some nasty DOS thing holding you back.
Friends don't help friends install M$ junk.
However, there are still websites that only render correctly within Internet Explorer. The Dell website is a great example.
I've not used IE in at lear a year, and I regularly buy things from Dell.com at work. Once, they did a boneheaded thing that was IE-specific and interfered with navigation of their site. I emailed their webmaster, and called Dell. I also told their sales staff that I was unable to complete my purchases online because their site was broken. And you know what? They fixed it!
If a vendor's website doesn't work for you, call them and make them sell to you over the phone. They'll get the picture.
Napster-to-go says "Fill and refill your compatible MP3 player", which is a lie. It's not MP3. It's WMA with DRM.
Damn right, Jim. Watch the process in win2K for example, when you switch from a local page of some kind to something on the net. explorer.exe grabs a bit more memory and continues running with the same PID. I don't know much about the internals of Win2K, but IMO IE and windows explorer are one and the same. I don't think we should infer too much from the different applications.
Because of the built-in nature of IE, it is in fact impossible to fully remove it from Windows 2K IME without breaking the OS. I suspect it is similar in XP also.
Real stupidity beats artificial intelligence every time.
-- Terry Pratchett, Hogfather