Slashdot Mirror
IE Flaw Exposes Users To Spoof-Based Attacks
Sotos wrote to mention a C|Net article discussing a new spoof-based attack on Internet Explorer. From the article: " The problem lies in the way Microsoft has implemented a JavaScript component in its Web browser, security researcher Amit Klein wrote in a research document. Internet Explorer does not validate some data fields provided by a PC when the component, called XmlHttpRequest, is used, he wrote. The vulnerability could be exploited with specially crafted code. An attacker could spoof a legitimate Web site, access data from the Web browser's cache or stage a so-called man-in-the-middle attack, which taps into traffic between a user and another Web site, according to Klein's write-up. " Secunia has an alert up on the spoof.
XMLHttpRequest? Never heard of it.
Okay, now we spend time generating another 500+ comments discussing how shitty IE's security is and how Firefox isn't much better. Add the other browser users (Opera, Konqueror) and we get another 300+ comments. Throw in the fact that each cross-platform browser runs better in Linux/OSX/BSD, or is emulated better (hence, more secure) through Wine and we generate another 250+ comments.
Every security announcement is met with the same level of bickering without any resolution in sight. Goggle "Internet Explorer Firefox security comparison" and you get another 1.7 million opinions.
Will it ever end?
"Rocky Rococo, at your cervix!"
Same-source policy? Couldn't this only be used to attack the server that the script came from?
It is the thingy that powers AJAX
Microsoft is unhappy about the way the problem was disclosed. The company urges security researchers to report problems in its products privately so it can provide a fix. "This public disclosure potentially puts computer users at risk," the Microsoft representative said.
Security through obscurity, yeah right. IMHO this just makes Microsoft get on the ball and do something about the problem rather than putting it on the back burner since "nobody would know about it."
If you give a liberal an enema, he'll turn transparent.
Am I wrong or haven't we seen this story before?
So, like, Spaceballs could compromise my boxen?
You are not the customer.
"Yea, but it hasn't even been exploited yet! It doesn't count unless it's been exploited, right?"
"I bet there will be a fix out within 24 hours! Exploits don't count if they are fixed quickly, right?"
"I don't care if they find a thousand exploits; I still won't use IE!"
Oh, wait . . . I thought the article was about another Firefox exploit. Nevermind.
Firefox? I'm using Webwhale, which is much better!
I'll start with the securia site.
Internet Explorer: Microsoft Internet Explorer 6.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Highly critical...Currently, 20 out of 86 Secunia advisories, is marked as "Unpatched" in the Secunia database.
FireFox: Mozilla Firefox 1.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical...Currently, 3 out of 24 Secunia advisories, is marked as "Unpatched" in the Secunia database.
"In the game of life, someone always has to lose. To me, if life were fair, that someone would always be Oklahoma." -DKR
But if we don't use Microsoft products, how will we be able to access the internet? *confused* :)
The fundemental premise of your post is correct - no one flaw proves a browser is "better" than another browser, and flamewars ensue from these flawed comparisons. Nevertheless, there is an underlying problem with IE: ActiveX. This is yet another example of how Microsoft, wanting to "kill" a more open product (Java), has introduced it's own, flawed, "standard" which causes its own problems. In this case, ActiveX is not secure and cannot be made reasonably secure, and this is the problem many of us have with IE.
Using plain ol' text since 1968
(I really do wish it was completely a joke)
Free Software: Like love, it grows best when given away.
There's no chance a spoof attack would ever wo.df&^3478adf@$%%
/*User dead*/
Should be another quiet weekend in Redmond while Microsoft fixes this one.
Active Ingredient: Triclosan
Other Ingredients: Water, Magnesium and/or Sodium Dodecylbenzenesulfaonate, ammoniym laureth sulfate, Sodium xylenessulfonate, SD alcohol 3-A, Laurel polyglucose, Laurylamidoproptlamine oxide, Magnesium sulfate, Sodium bisulfate, fragrance, Prntasodium pentetate, DNDN Hydantoine, D&C Orange No 4.
See, see, Triclosan is what powers AJAX!
Unstable Apps: Our Android Apps Don't Suck
After recently working with the Mozilla codebase, I'm surprised that flaws aren't found more often. To be honest, it's a very complex beast. Perhaps overly complex. The worst part, however, is the outdated documentation. It displays the sort of attributes that often lead to bugs and security flaws.
Now, what really interests me is in how horrible the quality of the Internet Explorer code must be for it to run into so many problems. Considering how unappealing Mozilla was, I can't even begin to imagine how absolutely terrible the IE codebase is.
Perhaps somebody with experience with both could, assuming NDAs don't get in the way, describe how the quality of the two codebases compare.
Cyric Zndovzny at your service.
You only have to write Javascript to use it, but that doesn't change the fact that the XMLHttpRequest object is provided by ActiveX, and if you switch off ActiveX, XMLHttpRequest stops working.
This will change in Internet Explorer 7, which implements XMLHttpRequest as a native host object in the same way as other browsers. There's some discussion of this on the IE Blog.
Bogtha Bogtha Bogtha
The problem is with the proxy servers, not IE.
Read the paper
Yawn...
Try the IE View Plugin Here: http://ieview.mozdev.org/