Slashdot Mirror
IE Flaw Exposes Users To Spoof-Based Attacks
Sotos wrote to mention a C|Net article discussing a new spoof-based attack on Internet Explorer. From the article: " The problem lies in the way Microsoft has implemented a JavaScript component in its Web browser, security researcher Amit Klein wrote in a research document. Internet Explorer does not validate some data fields provided by a PC when the component, called XmlHttpRequest, is used, he wrote. The vulnerability could be exploited with specially crafted code. An attacker could spoof a legitimate Web site, access data from the Web browser's cache or stage a so-called man-in-the-middle attack, which taps into traffic between a user and another Web site, according to Klein's write-up. " Secunia has an alert up on the spoof.
XMLHttpRequest? Never heard of it.
Okay, now we spend time generating another 500+ comments discussing how shitty IE's security is and how Firefox isn't much better. Add the other browser users (Opera, Konqueror) and we get another 300+ comments. Throw in the fact that each cross-platform browser runs better in Linux/OSX/BSD, or is emulated better (hence, more secure) through Wine and we generate another 250+ comments.
Every security announcement is met with the same level of bickering without any resolution in sight. Goggle "Internet Explorer Firefox security comparison" and you get another 1.7 million opinions.
Will it ever end?
"Rocky Rococo, at your cervix!"
Same-source policy? Couldn't this only be used to attack the server that the script came from?
It is the thingy that powers AJAX
Microsoft is unhappy about the way the problem was disclosed. The company urges security researchers to report problems in its products privately so it can provide a fix. "This public disclosure potentially puts computer users at risk," the Microsoft representative said.
Security through obscurity, yeah right. IMHO this just makes Microsoft get on the ball and do something about the problem rather than putting it on the back burner since "nobody would know about it."
If you give a liberal an enema, he'll turn transparent.
Am I wrong or haven't we seen this story before?
So, like, Spaceballs could compromise my boxen?
You are not the customer.
I was being just a tad sarcastic.
"Yea, but it hasn't even been exploited yet! It doesn't count unless it's been exploited, right?"
"I bet there will be a fix out within 24 hours! Exploits don't count if they are fixed quickly, right?"
"I don't care if they find a thousand exploits; I still won't use IE!"
Oh, wait . . . I thought the article was about another Firefox exploit. Nevermind.
Firefox? I'm using Webwhale, which is much better!
If it wouldn't be for MS, most IT web logs would shutdown.
:)
All the secuity articles guarantee readers and advertisers
putting the 'B' in LGBTQ+
I'll start with the securia site.
Internet Explorer: Microsoft Internet Explorer 6.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical...Currently, 20 out of 86 Secunia advisories, is marked as "Unpatched" in the Secunia database.
FireFox: Mozilla Firefox 1.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical...Currently, 3 out of 24 Secunia advisories, is marked as "Unpatched" in the Secunia database.
"In the game of life, someone always has to lose. To me, if life were fair, that someone would always be Oklahoma." -DKR
"When will people get the message?"
In this case, hopefully before their identity is stolen.
Am I open minded towards open source, or closed minded towards closed source?
But if we don't use Microsoft products, how will we be able to access the internet? *confused* :)
The fundemental premise of your post is correct - no one flaw proves a browser is "better" than another browser, and flamewars ensue from these flawed comparisons. Nevertheless, there is an underlying problem with IE: ActiveX. This is yet another example of how Microsoft, wanting to "kill" a more open product (Java), has introduced it's own, flawed, "standard" which causes its own problems. In this case, ActiveX is not secure and cannot be made reasonably secure, and this is the problem many of us have with IE.
Using plain ol' text since 1968
I think that the only reason post like this one garner so much discussion is because the web browser has become (arguably) the most important program on the PC. Not only is it used for certain parts of the operating system, but I'm willing to bet my reputation that almost everyone in those 1000+ comments are using one of the browsers being discussed to discuss.
Until the web browser evolves or is replaced, this kind of conversation is unavoidable.
(I really do wish it was completely a joke)
Free Software: Like love, it grows best when given away.
There's no chance a spoof attack would ever wo.df&^3478adf@$%%
/*User dead*/
Should be another quiet weekend in Redmond while Microsoft fixes this one.
Active Ingredient: Triclosan
Other Ingredients: Water, Magnesium and/or Sodium Dodecylbenzenesulfaonate, ammoniym laureth sulfate, Sodium xylenessulfonate, SD alcohol 3-A, Laurel polyglucose, Laurylamidoproptlamine oxide, Magnesium sulfate, Sodium bisulfate, fragrance, Prntasodium pentetate, DNDN Hydantoine, D&C Orange No 4.
See, see, Triclosan is what powers AJAX!
Unstable Apps: Our Android Apps Don't Suck
I use IE only when a page won't open/display/work correctly in Firefox. So I already know (AFAICT) that the page I'm viewing is "really" the page I think it is. I wish there were a plugin that added an "Open Link in IE" context menu item. And even better to somehow add a "Return to Firefox" option that opens a link or reopens a page from IE to Firefox, to get back to Earth from Purgatory.
--
make install -not war
After recently working with the Mozilla codebase, I'm surprised that flaws aren't found more often. To be honest, it's a very complex beast. Perhaps overly complex. The worst part, however, is the outdated documentation. It displays the sort of attributes that often lead to bugs and security flaws.
Now, what really interests me is in how horrible the quality of the Internet Explorer code must be for it to run into so many problems. Considering how unappealing Mozilla was, I can't even begin to imagine how absolutely terrible the IE codebase is.
Perhaps somebody with experience with both could, assuming NDAs don't get in the way, describe how the quality of the two codebases compare.
Cyric Zndovzny at your service.
You only have to write Javascript to use it, but that doesn't change the fact that the XMLHttpRequest object is provided by ActiveX, and if you switch off ActiveX, XMLHttpRequest stops working.
This will change in Internet Explorer 7, which implements XMLHttpRequest as a native host object in the same way as other browsers. There's some discussion of this on the IE Blog.
Bogtha Bogtha Bogtha
The problem is with the proxy servers, not IE.
Read the paper
Yawn...
XmlHttpRequest is a for client-side script to submit an http request and receive the results as XML or text. It's pretty cool because you can make a web page behave like a little client-server app, eliminating the need for page refreshes and session state maintenance. The name AJAX was made up recently, but the technique has been around for years, ever since IE4. Microsoft implemented it as an ActiveX object, but Mozilla now supports it natively.
IE is flawed?
I don't believe it!!!!
1) Yes, XMLHTTPRequest is that thingy that powers AJAX.
2) AJAX is that thing that's making it possible to write responsive, platform-independant, server-based apps.
3) Responsive, platform-independant, server-based apps are those things that are threatening Microsoft's deathgrip on the desktop.
4) [Apply tinfoil hat if needed] So... perhaps Microsoft inserts a dangerous bug in their XMLHTTPRequest implementation, so that
5) Microsoft must deploy a security fix that CRIPPLES or limits AJAX...? And
6) Profit!!
Hmm.... the mystery unfolds. It's a little wacky, I'll admit, but keep your hats on until you see if anything breaks when the "fix" is deployed. This is fun!
I fail to see why this is even considered an issue. You can EASILY spoof any website with server-side code and the "attack" is cross-browser.
e w ActiveXObject('Microsoft.XMLHTTP');}catch(oc){A=nu ll;}}if (!A && typeof XMLHttpRequest!='undefined'){A=new XMLHttpRequest();}/ /www.google.com', false);
The security bulletin talks about how using a specifically formed URL, you can download content from a remote site. I do the same thing all the time with a simple bridge in php:
httpbridge.php:
---------------
so if you want to get content from google in javascript:
var A=null;try{A=new ActiveXObject('Msxml2.XMLHTTP');}catch(e){try{A=n
A.open('GET', 'http://www.yoursite.com/httpbridge.php?url=http:
A.send()
document.write(A.responseText);
And now you can do any of the listed attacks in any browser. This is nothing new, lots of people already do it for useful reasons. The most recent use I've found is to pull geocodes.
...is that stories like this could be duplicates, and you'd never know it.