Slashdot Mirror

← Back to Stories (view on slashdot.org)

New Spoofing Vulnerability in IE

Posted by CowboyNeal on from the url-b-gone dept.

Jimmy M. writes "A new vulnerability has been announced in Internet Explorer, also affecting XP SP2, which can very easily be exploited by a malicious web site to completely spoof the address bar. The vulnerability is very similar to another vulnerability disclosed just about a year ago called the '%00' vulnerability, which also was widely exploited by phishers. A demonstration is also available."

12 of 372 comments (clear)

  1. Surprisingly, a patch is already out by Anonymous Coward · · Score: 5, Funny

    Get it here

  2. Vulnerability Confirmed on Avant Browser by Eyah....TIMMY · · Score: 5, Informative

    Using the latest version of Avant Browser, on a fully patched XP SP2 system. It seems obvious since Avant is based on IE but I thought it would be useful to know.

    --

    It is not enough to have a good mind. The main thing is to use it well. - Rene Descartes (1637)
    1. Re:Vulnerability Confirmed on Avant Browser by zarniwoop102939 · · Score: 5, Informative

      As suggested in the article, you can block the vulnerability in Avant by disabling ActiveX (Tools | Disable ActiveX). This is how I browse with Avant by default, along with:

      - Block Flash
      - Block Popups
      - Block Ads
      - Disable Sounds
      - Disable Videos
      - Disable Java Applets

      Makes pages load very fast, and if I need one of those functions for the page I'm on, I just toggle it on for the session.

      Between these security features and still having the compatibility of IE, that's why I love Avant so much. Yes I used Firefox for 2 weeks, and went back to Avant.

  3. Microsoft is so sweet by Anonymous Coward · · Score: 5, Interesting

    Everytime there's a major Firefox event, a release or New York Times ad, they chip it by having another IE vulnerability to raise awareness of Firefox. Thanks Microsoft!

    1. Re:Microsoft is so sweet by Anonymous Coward · · Score: 5, Insightful

      What OSS has to do is release ads to TELL people how bad IE is

      never mention your competitor in advertising
      no such thing as bad publicity, people tend to forget the details but "brand reinforcement" still applies, if you have to mention your competitor then it implies your product wont/cant stand up on its own merits = you have LOST

      just an anon advertising exec

    2. Re:Microsoft is so sweet by ticklemeozmo · · Score: 5, Funny

      What OSS has to do is release ads to TELL people how bad IE is, not how good Mozilla is alongside. SCARE people into realizing that their entire way of life is AT RISK if they continue to use IE.

      Or maybe a simple 5 color-coded chart!

      RED - Browsing with IE
      ORANGE - something witty
      YELLOW - something wittier
      GREEN - Browsing with Firefox
      BLUE - Unplugging your network cable

      Firefox(tm). The next safest thing to unplugging your network connection.

      --
      When modding "Informative", please make sure it both has a source and IS actually informative.
    3. Re:Microsoft is so sweet by SoSueMe · · Score: 5, Interesting

      There's a philosophy in politics that goes like this: "It doesn't matter what they're saying about you, as long as they're talking about you. When they stop talking about you, you are dead".

    4. Re:Microsoft is so sweet by OldManAndTheC++ · · Score: 5, Funny

      RED - Browsing with IE
      ORANGE - Giving your cat a bath
      YELLOW - Cooking bacon in the nude
      GREEN - Browsing with Firefox
      BLUE - Unplugging your network cable

      --
      Soylent Green is peoplicious!
  4. How long until... by dew4au · · Score: 5, Insightful

    ...people start banging on Firefox hard enough to expose vulnerabilities?

    Or, is Mozilla just that good at plugging leaks before they happen?

  5. Disable ActiveX by OverlordQ · · Score: 5, Insightful

    Disable ActiveX and this wont work. This exploit depends on ActiveX to run.

    --
    Your hair look like poop, Bob! - Wanker.
  6. Re:Yet another reason... by azuroff · · Score: 5, Funny

    So, to check a Hotmail message, I just need to manually type

    http://by2fd.bay2.hotmail.msn.com/cgi-bin/getmsg ?m sg=MSG1103631600.24&start=3248752&len=4735&imgsafe =n&curmbox=F000000001&a=b2cbfd3baddabfc913aacc3f36 f8590f

    in my address bar....

    Thanks, Microsoft! I needed to brush up on my typing skills.

  7. MSIE's clock. by rice_burners_suck · · Score: 5, Funny
    Let's put one of these chain emails to good use:

    Bill Gates died and went to heaven. As he stood in front of St.Peter at the Pearly Gates, he saw a huge wall of clocks behind him. He asked, "What are all those clocks?"

    St. Peter answered, "Those are Software Vulnerability Clocks. Every computer program on Earth has a Software Vulnerability Clock. Every time a program is compromised due to a bug in the code, the hands on that program's clock will move.

    "Oh," said Bill, "which clock is that?"

    "That's the UNICOS clock. The hands have never moved, indicating that it was never compromised by an attacker."

    "Incredible," said Bill. "And which clock is that one?"

    St. Peter responded, "That's the OpenBSD clock. The hands have moved twice, telling us that the "Only one remote hole in the default install, in more than 8 years!" was compromised only two times in this operating system's life."

    "Where's Internet Explorer's clock?" asked Bill.

    "That's in Jesus' office. He's using it to drive the generators, which provide power for our celestial copy of Las Vegas."