Unpatched IE Flaw Extremely Critical

Durinthal writes "The biggest blip on the security radar over the Thanksgiving holiday was the realization by the security community that an Internet Explorer problem first identified six months ago was a lot worse than it appeared, as what appeared to be only a DoS vulnerability also allows for execution of arbitrary code. The realization caused Secunia to issue a rare 'Extremely Critical' advisory."

Comments

Proof of Concept

[Motherfucking Shit]

Here is a link to the Proof of Concept page, which will launch an instance of calc.exe if you're vulnerable. AVG Free caught the exploit in the cached page, but calc.exe ran anyway, even after I deleted the file.

Re:Proof of Concept

[TheSpoom]

Slightly offtopic, but if you're wondering, NAV calls anything it considers suspicious enough to stop but doesn't have a name for yet "Bloodhound" because that's the component that detects buffer overflows and the like. Just something rather interesting I found when I was doing tech support.

Temp Fix

[Manip]

Turn on "Data Execution Protection" for all programs and services. Instead of allowing full execution it will limit it to a DOS (crack IE).

Control Panel -> System -> Advanced [Tab] -> Performance Settings -> Data Execution Protection [Tab] -> Turn on DEP for all programs and services except those I select -> Ok -> OK.

It affects Firefox, too.

[Mitchell Mebane]

Although it's not as severe.

https://bugzilla.mozilla.org/show_bug.cgi?id=31733 4

Re:Scummy eweek popup alert

[BattleRat]

The extention you are looking for is called NoScript. It works awesome.

McAfee Fails It

[Orrin Bloquy]

On my W2K box, McAfee warns me of a threat, then as soon as I close the window, the code executes anyway.