Slashdot Mirror
Extremely Critical IE6/SP2 Exploit Found
Spad writes "Secunia is reporting on three vulnerabilities in IE6 running on XP SP2. Any of these, in combination with an inappropriate behaviour where the ActiveX Data Object (ADO) model can write arbitrary files, can be exploited to compromise a user's system. Moreover, the vulnerability can be used to delete files from the user's system. Secunia says 'Solution: Use another product.'"
One would assume that any vulerability that could run arbitary code would be able to delete files.
We need a worm/virus that deletes everyones files. That would make keeping your computers patched a high priority for most of the users. At the moment, viruses are just something that affects and annoys "other people"
Get your own free personal location tracker
A fully patched and left wide open XP/SP2 might be in danger.
But one with proper security controls put in place like a good virus scanner/firewall/IE settings/anti spyware and creating a non-admin user for web browsing will not be affected. If you're hit by this one, you have only yourself to blame. All of the above should be installed and working before you go online.
Common sense is the biggest protection, people.
What's scary is that page doesn't even detail what the test will do on your machine! Clicking the link is risky enough even if you did know what it was going to do (ie. how do you know their server hasn't been compromised and the test altered).
All it says is "The test requires that you have Windows installed in 'c:/windows/'." Uh... Why? is it actually doing something in there? Does it just need to access cmd.exe?
Click at your own risk, indeed. I suggest running it on a machine that you plan to reformat or under an emulator like VPC.
Yeah, similar thing here - I use either Mozilla or Firefox at work and at home for pretty much everything, but the company timesheet site and internal website (including things like the phonelist) refuse to work under anything other than IE.
Good work guys, it wouldn't have taken any more than a couple of days to figure out how to get your frigging menubar to work in a way that didn't require the security equivalent of a gigantic Swiss Cheese.
It's amazing how the WinFanboys can live in such denial. It's like people you know who live in a really bad neighbourhood and deny there's anything wrong. "Oh we're OK, we live in a safe area. As long as you put bars on all your windows, don't leave the house when it's dark, put up bullet proof windows, and don't make eye contact with the neighbours like sensible people you're perfectly safe". It's the old "Apart from how it's broken, it works perfectly" line. Used car salesmen use similar techniques. "She blows a bit of smoke and rattles some, but you know this was one of the best models made. They don't make 'em like they used to (watch out for the leaky floorpan too)"
The blame-the-users mentality also serves to protect MS itself. If the general consensus is that users are at fault for succumbing to vulnerabilities then MS has no responsibility to fix it, and is under no pressure to do so.
Keep sucking it up will you. There's a good boy.
As for the internet, let's be serious. Anyone who, since 1995 (when ActiveX was introduced), has used MSIE on the internet, is just plan stupid, and has never had a reasonable expectation of either security or privacy. This has literally been known for nearly a decade now. "Fool me once, shame on you. Fool me 621498 times, shame on me."
OK, you find me a more critical vulnerability. One that allows nuking the bios maybe, but other than that I can't think of such a thing.
I am trolling
What does this information got to do with the bugs he found on Internet Explorer? You know, even if you dig up his mother's name it wouldn't change the fact that he actually found some serious flaws in IE SP2.
That's part of the answer, anyway.
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
It looks like SP2 was just the usual patch-collection and the crackers just needed a little bit time to adapt to it.
If I were a black-hat planning to exploit this vulnerability, I'd put a remote control program like Back Orifice and a HTTP tunnelling program onto the web for BO to use for connectivity. Then the exploit downloads and installs them, and I have full control of your system whenever I want it.
I appear to have a blog. Odd.
I did get a bunch of Ubuntu CDs while their free and give those out to anyone that is interested in Linux. Especially after I answer the question, "How do you deal with it?" with "I don't. I use Linux."
And a car with the wheels nailed to the ground, the doors welded and all the windows painted over is pretty safe from theves. When you saw those precautions advised in the manufacturer's literature, would you buy the car?
_O_
.|< The named which can be named is not the true named
http://www.starnix.com/banks-n-browsers.html VERY comprehensive list of banks who will work with Linux -- which is basically the same thing. If you're browser agnostic, the OS shouldn't be a deal.
"But one with proper security controls put in place like a good virus scanner/firewall/IE settings/anti spyware and creating a non-admin user for web browsing will not be affected"
Right - and Granny isn't supposed to be able to run Linux, but she can do all that security stuff on Windows, right?
Well, I actually believe she can IF someone tells her she needs to...
And she can learn Linux, too, if she decides Windows is a piece of bloated, unreliable, unstable, expensive, insecure CRAP...
How many YEARS past the last "security initiative" from Microsoft are we now?
Why don't they just spend some of that $30 billion they pissed away on their stock prop PR stunt and just BUY the entire computer security INDUSTRY and integrate it?
Does anybody REALLY believe Longhorn is going to be secure?
Gimme a break...
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
What moron modded this flamebait? The parent makes an excellent point. The average person is still worried about viruses and attacks that damage a computer. He worries a virus could delete his Quicken files, but thinks it's safe to send his PIN to his bank's site because the little padlock appears.
Users need to be educated that real damage happens when their data are read by someone else, like phishing, datamining, and whatnot. Simple data loss can easily happen without malice.
creating a non-admin user for web browsing This assumes that there are no local exploits to promote users to superusers. It is a much better idea to use a secure product, rather than hoping that there are no security vulnerabilities in the Windows kernel.
I'll probably be modded down for this...
AVG Antivirus.
I use Firefox or Mozilla and am in the process of weaning myself off of Windows... but am I wrong in noticing that a certain amount of open-source propaganda has found its way into these security advisories?
Ahem...
"Linux is only free if your time is worth nothing."
You're not paying for 'software'. You're paying for the convenience. I don't like Windows much, but for people who have better things to do with their time (alas, not I), it might still be a better option.
Mac OSX seems like a good middle ground between convenience and security, but it comes with some rather nice and rather expensive hardware.
No, What I'm telling you is that this article was written and posted to provide fodder for a flame war.
You are still vulnerable because Microsoft has determined that this vulnerability is:
a) unpatchable without ruining the functionality of the product
and / or
b) not a large enough threat to worry about.
Now I'm _not_ going argue whether either of these points is correct or not. But to present these as "New exploits" is typical Slashdot anti-journalism. they did the same thing when they announced the "New" vulnerabilities for Firefox a few days ago. Those were not new either, but neither the submitters or editors bothered to read the articles that were submitted.
It's either critical or it isn't. "Extremely" is redundant.
That's pretty amusing. A virus scanner that relies on a component that may be a vector for viruses and trojans, and a known vector for spyware.
Embedding IE is simple for the programmer, but the security settings are so confusing for the user that it's possible to inadvertantly tighten security too much for local applications, which causes the errors that you speak of. After the existence of security holes themselves, I think the next worst part about IE is its incredibly confusing set of security settings, especially on the Group Policy side. It's difficult to secure something when you don't understand how its security works.
You really think Firefox is secure. What a moron. The only reason Firefox isn't exploited is nobody uses it.
Hey can someone please tell me how I can find out where my windows is installed? It says here http://secunia.com/internet_explorer_command_execu tion_vulnerability_test that windows needs to be installed in c:\windows\ for their test exploit to work 'properly'
Computer specs: iBook g3 800mhz...
In that case, you're windows installation is probably along an exterior wall of your house or office. Its where you'll notice sunlight coming in during daytime hours, and be careful, it is a huge security vulnerability.
BTW: Thanks! Your comment was the first time I really picked up the irony that Microsoft Windows is named after the weakest point of physical security and the cause of most unnecessary energy loss in most buildings. I'm sort of a Microsoft guy, and I still think that's extremely funny and more than a little prescient.