Slashdot Mirror
Unpatched IE Flaw Extremely Critical
Durinthal writes "The biggest blip on the security radar over the Thanksgiving holiday was the realization by the security community that an Internet Explorer problem first identified six months ago was a lot worse than it appeared, as what appeared to be only a DoS vulnerability also allows for execution of arbitrary code. The realization caused Secunia to issue a rare 'Extremely Critical' advisory."
The biggest blip on the slashdot radar over the Thanksgiving holiday was the realization by the editorial community that a slow news problem first identified six months ago was a lot worse than it appeared, as what appeared to be only a short blip of news vulnerability now also allows for execution of arbitrary stories as portraid by Beatles Beatles. The realization caused CmdrTaco to issue a rare 'Extremely Dupical' advisory.
It takes a man to suffer ignorance and smile
Be yourself no matter what they say
Does anyone think that a very handy Firefox add-on would be a button attached to this kind of dialogue that would instantly kill all Javascript scripts stone dead for the page? Once an OK/Cancel dialogue is up, you can't interact with Firefox's UI until you've responded to the dialogue and let the Javascript do something, which I think is poor design.
is "IE" the shortented version of the screaming sound that I make when I realize my machine has been compromized?
"iiiieeeeEEEEEEEEE!"
This makes Slashdot exactly on the day Firefox v1.5 is supposed to be released. Apparently, Mozilla want to create a huge marketing campaign, better and larger than the one for v1.0. This is a perfect time to capitalize on this horrible security hole to promote Firefox.
Here is a link to the Proof of Concept page, which will launch an instance of calc.exe if you're vulnerable. AVG Free caught the exploit in the cached page, but calc.exe ran anyway, even after I deleted the file.
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
Turn on "Data Execution Protection" for all programs and services. Instead of allowing full execution it will limit it to a DOS (crack IE).
Control Panel -> System -> Advanced [Tab] -> Performance Settings -> Data Execution Protection [Tab] -> Turn on DEP for all programs and services except those I select -> Ok -> OK.
Although it's not as severe.
3 4
https://bugzilla.mozilla.org/show_bug.cgi?id=3173
The roots of education are bitter, but the fruit is sweet.
--Aristotle
The SANS Internet Storm Center has a counter on their home page showing how many visitors to their site are vulnerable to this particular problem. At this time, looks like it is 43%! (and I assume that people checking the site are more security concious then the average). Also see MSIE 0day exploit.
---- join dshield.org Distributed Intrusion Detec
On my W2K box, McAfee warns me of a threat, then as soon as I close the window, the code executes anyway.
"Made up/misattributed quote that makes me look smart. I am on
I read the article, and there was a link to a page that demonstrates the exploit. Now, am I the only one who is afraid to click such a link? There is something about seeing a link that basically says "click here to see how we can take over your machine" that sends chills down my spine. I don't know about you, but I never click those demonstration links on *MY* machine.
The more you regulate a company, the worse its products become.
They just copied half the story from this site:
http://www.security.ithub.com
The Proof of Concept didn't load calc.exe for me. Instead, it crashed my IE windows on WindowsXP SP1.
I run Ad Muncher, so that might have caught and foiled the malicious javascript.
[Fuck Beta]
o0t!
Sarcasm aside, yes they should be responsible for what they wrote, even though it's a lot of code, and there are going to be bugs (human nature). It is shoddy software.
-Jesse
Nothing says "unprofessional job" like wrinkles in your duct tape.
Funny how so many of the responses in this thread mirror the response of someone who's just been exposed to Snow Crash: "weird - the screen just went all static-y. But I'm fine... aren't I???"
The URL is http://www.ocremix.org/
...or maybe /.'ers need to stop being so effing hyper sensitive about certain things.
And here's the submitter's user page http://slashdot.org/~Durinthal
I think you mistook the submitter for **Beatles-Beatles
This Beatles guy is really getting out of hand.
He manages to taint stories he isn't even submitting.
[Fuck Beta]
o0t!
Although it can be "accepted" that code be released with unknown bugs (because we all make mistakes), the problem here is that the bug report is over 5 months old. It is one thing to ship buggy code, it is another thing to ignore bug reports and not fix your product once the bugs have been found. It is no longer unknown, Secunia has a release date of 2005-05-31 for that bug.
After 3 days without programming, life becomes meaningless
- The Tao of Programming
"Currently, the only work-around is to temporarily discontinue the use of Microsoft Internet Explorer and use another browser, such as FireFox, (this can be downloaded for free at www.mozilla.com) until Microsoft can issue a patch."
Anyone else's bank send out a warning like this bluntly stating that if you use IE, there is nothing the bank can do to protect you?
Rename calc.exe. Job done!