Slashdot Mirror
Extremely Critical IE6/SP2 Exploit Found
Spad writes "Secunia is reporting on three vulnerabilities in IE6 running on XP SP2. Any of these, in combination with an inappropriate behaviour where the ActiveX Data Object (ADO) model can write arbitrary files, can be exploited to compromise a user's system. Moreover, the vulnerability can be used to delete files from the user's system. Secunia says 'Solution: Use another product.'"
They've also posted a test site.
No, you click it first.
delete IE?
or maybe install Firefox?
If tyranny and oppression come to this land, it will be in the guise of fighting a foreign enemy. - James Madison
It was mandatory for us to switch to Mozilla. Problem is all our financial vendors make use of Active-X.
Result: Now we use Mozilla for casual browsing and use insecure products only when conducting important business!
"We need a worm/virus that deletes everyones files. That would make keeping your computers patched a high priority for most of the users. At the moment, viruses are just something that affects and annoys "other people""
Similarly, we need a firebug to go around lighting people's houses on fire to show how having smoke detectors should be a high priority.
I realize you're not being 100% serious, but this reasoning is stupid.
Pardon the technical terminology
With Safari 1.2.4 (v125.12), I get a "Safari cannot find the Internet plug-in." error dialog and then the beachball of death. Joy. Well, at least it's not opening the terminal.
That would make keeping your computers patched a high priority for most of the users.
What has that to do anything with this story? RTFA and please stop blaming the user for everything.
Running WinXP SP2 and fully patched system. I run Norton anti-virus, spybot, Ad-aware and now MS Antispyware and enabled autoupdate.
Checked out Secunia, ran their test and my system was found vulnerable.
What more should I patch?
I have made my own little extreme sport out of it. I fill my old box with all of my financial information, and surf around using IE. I think Microsoft is pretty impressed, because they keep sending me boxes of Viagra and dog crap.
What's scary is that page doesn't even detail what the test will do on your machine! Clicking the link is risky enough even if you did know what it was going to do (ie. how do you know their server hasn't been compromised and the test altered).
All it says is "The test requires that you have Windows installed in 'c:/windows/'." Uh... Why? is it actually doing something in there? Does it just need to access cmd.exe?
Click at your own risk, indeed. I suggest running it on a machine that you plan to reformat or under an emulator like VPC.
I think this exploit deserves a bit more attention than "serves clueless n00bs right". Although to be fair my default browser (FireFox) was unaffected ;)
Yeah, if your grandma hasn't spent at least $50 on third-party security software plus a yearly antivirus subscription fee, plus made sure to configure her firewall correctly and run virus and spyware scans weekly, plus made sure to create a restricted user account that she runs IE under, why then she has only herself to blame. Obviously Microsoft is doing everything in its power to protect her.
Actually, I would have said it was more like "Today terrorists have announced that they have armed an atomic bomb in the middle of Los Angeles. If it goes off, it may burn you!"
"Fool me once, shame on you. Fool me 621498 times, shame on me."
GWB said that, right?
I'm running XPSP1 with all critical updates installed. To get the exploit to run with IE on my computer I have to manually change the security level to low, allow an unsigned ActiveX control to run when it warns me I shouldn't, and confirm the overwriting of files. What the hell did Microsoft do in SP2 to make it vunerable?
Hey can someone please tell me how I can find out where my windows is installed? It says here http://secunia.com/internet_explorer_command_execu tion_vulnerability_test
that windows needs to be installed in c:\windows\ for their test exploit to work 'properly'
Computer specs: iBook g3 800mhz...
I hope that helps a little
I have McAfee virusscan 9.0 installed.
Clicking the test link with IE proved that my system is vulnerable (if using IE, which I'm not, ofcourse). I had expected McAfee to block this web page, but it didn't. So I went to the internet security options panel in IE, and disabled all ActiveX controls.
But lo and behold, McAfee virusscan stopped working!
All their dialogs and panels seem te be using IE's HTML engine for display, and all I get now is first an error "your current security settings prohibit running ActiveX controls on this page. As a result, the page may not display correctly" and then an empty window when trying to access any of McAfee's information or settings dialogs!!
What a load of crap. I will send them a complaint, and remove their product from my computer right now, to replace it with a good, free virusscanner. Any recommendations? Thanks.
Launches the new IE window using cmd /c iexplore.
Pain lasts, kid. Its how you know you're alive. Sometimes I think this growing up thing is just pain management-TheMaxx
That's right, Microsoft "we take security very seriously" Corporation has known about this vulnerability for almost two months, yet they leaved it unpatched? Why?