IE Flaw Exposes Users To Spoof-Based Attacks

Sotos wrote to mention a C|Net article discussing a new spoof-based attack on Internet Explorer. From the article: " The problem lies in the way Microsoft has implemented a JavaScript component in its Web browser, security researcher Amit Klein wrote in a research document. Internet Explorer does not validate some data fields provided by a PC when the component, called XmlHttpRequest, is used, he wrote. The vulnerability could be exploited with specially crafted code. An attacker could spoof a legitimate Web site, access data from the Web browser's cache or stage a so-called man-in-the-middle attack, which taps into traffic between a user and another Web site, according to Klein's write-up. " Secunia has an alert up on the spoof.

Comments

XMLHttpRequest? What's That?

[turkeywrap]

XMLHttpRequest? Never heard of it.

Dupe?

[P0ldy]

Am I wrong or haven't we seen this story before?

Spoof-based?

[Limburgher]

So, like, Spaceballs could compromise my boxen?

Re:Crank Up The Flamethrowers

[eggoeater]

Than add another 100+ comments on your comments on how many comments we have and we'll have even more comments.....

...and then theres the comments on the comments on the comments....

...no...it will never end....especially after the dup story is posted tomorrow.

Here come the pre-packaged sound bites. . .

[EraserMouseMan]

"Yea, but it hasn't even been exploited yet! It doesn't count unless it's been exploited, right?"

"I bet there will be a fix out within 24 hours! Exploits don't count if they are fixed quickly, right?"

"I don't care if they find a thousand exploits; I still won't use IE!"


Oh, wait . . . I thought the article was about another Firefox exploit. Nevermind.

Re:Oblig

[Anonymous Coward]

Firefox? I'm using Webwhale, which is much better!

Job security

[plopez]

If it wouldn't be for MS, most IT web logs would shutdown.

All the secuity articles guarantee readers and advertisers :)

Re:Misquote

[sedyn]

"When will people get the message?"

In this case, hopefully before their identity is stolen.

But then we can't access the net

[kianu7]

But if we don't use Microsoft products, how will we be able to access the internet? *confused* :)

No big deal...

[Stephen Samuel]

Microsoft doesn't consider spoofed customers to be a problem, so this doesn't classify as a security problem.

:-}

(I really do wish it was completely a joke)

Amateurs...

[tktk]

I just read the page source and render the pages in my head.

There's no chance a spoof attack would ever wo.df&^3478adf@$%%

/*User dead*/

There Goes Someone's Weekend

[usacoder]

Should be another quiet weekend in Redmond while Microsoft fixes this one.

Re:XMLHttpRequest? What's That?

[GweeDo]

Active Ingredient: Triclosan
Other Ingredients: Water, Magnesium and/or Sodium Dodecylbenzenesulfaonate, ammoniym laureth sulfate, Sodium xylenessulfonate, SD alcohol 3-A, Laurel polyglucose, Laurylamidoproptlamine oxide, Magnesium sulfate, Sodium bisulfate, fragrance, Prntasodium pentetate, DNDN Hydantoine, D&C Orange No 4.

See, see, Triclosan is what powers AJAX!

What is IE? Does it run on Linux?

[Anonymous Coward]

What is IE? Does it run on Linux? I hear a lot about it, but I can't find it in any of the debian repositories.

Re:Let the IE/FF comparisons begin

[Metteyya]

As with IE - these are not bugs, these are features. You know, Internet Explorer enables browsing the Internet from user's computer and the other way too.

Re:Crank Up The Flamethrowers

[Anonymous Coward]

Let me finish this discussion right here, right now:

Nazi.

WHAT?!?!?

[artemis67]

IE is flawed?

I don't believe it!!!!

What;'s funny...

[leshert]

...is that stories like this could be duplicates, and you'd never know it.