Slashdot Mirror
Extremely Critical IE6/SP2 Exploit Found
Spad writes "Secunia is reporting on three vulnerabilities in IE6 running on XP SP2. Any of these, in combination with an inappropriate behaviour where the ActiveX Data Object (ADO) model can write arbitrary files, can be exploited to compromise a user's system. Moreover, the vulnerability can be used to delete files from the user's system. Secunia says 'Solution: Use another product.'"
One would assume that any vulerability that could run arbitary code would be able to delete files.
We need a worm/virus that deletes everyones files. That would make keeping your computers patched a high priority for most of the users. At the moment, viruses are just something that affects and annoys "other people"
Get your own free personal location tracker
What's scary is that page doesn't even detail what the test will do on your machine! Clicking the link is risky enough even if you did know what it was going to do (ie. how do you know their server hasn't been compromised and the test altered).
All it says is "The test requires that you have Windows installed in 'c:/windows/'." Uh... Why? is it actually doing something in there? Does it just need to access cmd.exe?
Click at your own risk, indeed. I suggest running it on a machine that you plan to reformat or under an emulator like VPC.
It's amazing how the WinFanboys can live in such denial. It's like people you know who live in a really bad neighbourhood and deny there's anything wrong. "Oh we're OK, we live in a safe area. As long as you put bars on all your windows, don't leave the house when it's dark, put up bullet proof windows, and don't make eye contact with the neighbours like sensible people you're perfectly safe". It's the old "Apart from how it's broken, it works perfectly" line. Used car salesmen use similar techniques. "She blows a bit of smoke and rattles some, but you know this was one of the best models made. They don't make 'em like they used to (watch out for the leaky floorpan too)"
The blame-the-users mentality also serves to protect MS itself. If the general consensus is that users are at fault for succumbing to vulnerabilities then MS has no responsibility to fix it, and is under no pressure to do so.
Keep sucking it up will you. There's a good boy.
As for the internet, let's be serious. Anyone who, since 1995 (when ActiveX was introduced), has used MSIE on the internet, is just plan stupid, and has never had a reasonable expectation of either security or privacy. This has literally been known for nearly a decade now. "Fool me once, shame on you. Fool me 621498 times, shame on me."
That's part of the answer, anyway.
"Encyclopedia" is to "Wikipedia" what "Library" is to "Some people at a bus stop"
If I were a black-hat planning to exploit this vulnerability, I'd put a remote control program like Back Orifice and a HTTP tunnelling program onto the web for BO to use for connectivity. Then the exploit downloads and installs them, and I have full control of your system whenever I want it.
I appear to have a blog. Odd.
And a car with the wheels nailed to the ground, the doors welded and all the windows painted over is pretty safe from theves. When you saw those precautions advised in the manufacturer's literature, would you buy the car?
_O_
.|< The named which can be named is not the true named
creating a non-admin user for web browsing This assumes that there are no local exploits to promote users to superusers. It is a much better idea to use a secure product, rather than hoping that there are no security vulnerabilities in the Windows kernel.
I'll probably be modded down for this...
No, What I'm telling you is that this article was written and posted to provide fodder for a flame war.
You are still vulnerable because Microsoft has determined that this vulnerability is:
a) unpatchable without ruining the functionality of the product
and / or
b) not a large enough threat to worry about.
Now I'm _not_ going argue whether either of these points is correct or not. But to present these as "New exploits" is typical Slashdot anti-journalism. they did the same thing when they announced the "New" vulnerabilities for Firefox a few days ago. Those were not new either, but neither the submitters or editors bothered to read the articles that were submitted.