Several Critical MSIE Flaws Uncovered

An anonymous reader writes "Several flaws have been uncovered by security firm eEye in Microsoft's Internet Explorer. The flaws allow remote compromise of computers running Windows Operating Systems and affect IE, Outlook and possibly other MS software. With the next MS Windows security bulletin release scheduled for June 14, 2005 news sources are reporting that in comparison with the Mozilla Foundation's prompt fix for the recently reported Mozilla 1.0.3 vulnerabilities MS appear to be leaving a large window for the possible malicious exploitation of these flaws."

Comments

Great..

[Marble68]

I'm stuck with an internal deveopment team making web apps (in .Net) that require IE.. And a bunch of users who will click on anything. Although exploits were found in Firefox, they were patched rapidly. It's not standard on all our desktops. I wish there was a "corporate" browser with minimal features to reduce exposure. Sort of like IE lite.

Re:Poor choice of slogan

[dark-br]

Marge: [on radio] Husband on murderous rampage. Send help. Over.
Chief Wiggum: Whew, thank God that's over. I was worried for a little bit.

Ok, now where is mar karma? ;)

Other Winggum quotes here.

Not just one!

[vmp17]

Although eEyes' reports look a bit confusing (look at the "Vulerability is over" image at the bottom), I think according to this page http://www.eeye.com/html/research/upcoming/index.h tml there are 3 security vulnerabilities affecting IE and Outlook that allow remote code execution.
The oldest one is 60 days old now and still not fixed.

Re:Thanks Microsoft!

[bunratty]

No, Mozilla uses an applications platform so that the developers can easily write cross-platform code. It's just that they also developed that platform, and it's also called Mozilla. Mozilla-the-browser (and also Firefox and Thunderbird) run on top of Mozilla-the-platform.

OOOOLLLLDDD News

[Urgo]

Sorry but I need to say this..

'Mozilla 1.0.3 vulnerabilities'

That would be Firefox 1.0.3.... Mozilla Suite aka just mozilla and FireFox are two separate programs and have very different versions. Saying Mozilla 1.0.3 is very misleading. Please use the correct name or it makes your news story look very silly. Who cares if a version of mozilla from 2002 has security holes.

</rant>

The scheduling is meant for enterprises

[n0-0p]

Organizations want to schedule their downtime and the "Black Teusday" policy makes it easier for them to do that and keep good looking metrics. All the places I've worked at have a scheduled outage the second Friday of every month. This gives a few days to do test deployments of the patches before rolling them out to the enterprise. Metrics still look great because IT can say they deployed all critical patches in under three days.

Re:IE7

[Aadain2001]

Just FYI: IE only starts faster because MS preloads it into memory at startup. To compare FF to IE on (more)equal footing, start FF and then try to open a new window. This is closer to how IE works on Windows.

Re:IE7

[SQLz]

You don't have to run the application to pre-load parts it it into memory. In fact, does't the whole windows shell share a lot of components with IE?

MS does the same thing with office to make it start faster.

Re:admin privilege req'd

[man_of_mr_e]

I've never had a problem with Publisher 2003 needing systemroot access. If you're running older versions, you don't need to give them root access. All you need to do is give them write permission to the directory without replacing the permissions on the files within, that way nothing alter existing files. There's nothing special about systemroot other than it's a place many system files are stored.. let the user create new files there isn't going to comprimise security any more than letting them create new files somewhere else.