Slashdot Mirror
Highly Critical Hole Found in IE
dotpavan writes "Eweek reports on a highly critical MS Internet Explorer hole found by Secunia Research's Andreas Sandblad. The vulnerability is due to the processing of the "createTextRange()" method call applied on a radio button control.
From Secunia, "The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2." The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview (January edition) though it could be avoided by turning off Active Scripting, as suggested by Microsoft Security Response Center blog. How would this put MS in the market, hit by the ever-growing shots of vulnerabilties? And would the divorce of IE7 from Vista's Windows Explorer help?"
here
Please don't post stories like this until a patch or fix has been released! I always get paranoid after reading a story about another IE hole. If you wait until the fix is released, I'll have a blissful few days.
Must be thursday.
...if researchers just identified the bits that *weren't* totally insecure?
It's a brand new hole!
--
Superb hosting 20GB Storage, 1_TB_ bandwidth, ssh, $7.95
Is it shaped like a woman's mouth? I mean, that's a highly critical hole.
TFA: Microsoft plans to release a pre-patch advisory with workarounds for a "highly critical" vulnerability that could put millions of Internet Explorer users at the mercy of malicious hackers
So this article updates us to the fact that they plan to update us with an article prior to the update?
Slashdot Burying Stories About Slashdot Media Owned
It could've been a very cynical hole in IE concerning when Windows Vista will finally be released.
Come again?
Proud member of the American Non Sequitur Society. We might not make much sense, but boy do we love pizza!
IE is the hole, into which are placed 'features' such as this exploit, tied to the feature called 'activex.' Remove these 'features' and all that is left is the nothingness that is a hole.
Moderation in All Things... Especially Moderation - gurutc
createText("install firefox.exe");
createTextRange(-1);
And just let the exploit install firefox. It's just that easy.
Proof by very large bribes. QED.
here.
IE user, your house is on fire. Run for the hills! Go! Go!
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
And would the divorce of IE7 from Vista's Windows Explorer help? ... you perverts!) but not until my power book did one love me back...
maybe, but i still recommend divorcing windows entirely. i've loved computers before (not sexually
i don't care
Dupe!
This is my sig. There are thousands more, but this one is mine.
...Jack's complete lack of surprise.
120 characters for a sig? That's bloody useless.
A DDoS isn't a vulnerability any more than someone throwing a brick at your face.
Here. Guaranteed not to be exploited by any javascript or plugin vulnerability. Or by any site that uses frames.
shall be named "alimony"!
DEAD DEAD DEAD DELETE ME
This just goes to show that if you give MS enough time, they'll eventually be able to reinvent UNIX-like security. That's a relief.
The good news is that at least we know that IE 7 is backward compatible with IE 6 vulnerabilities.
"Every decent man is ashamed of the government he lives under." - H.L. Mencken
This hole will complain endlessly about your banal surfing habits and tell you taht are beginning to look a little fat. It's amazingly critical.
"Your superior intellect is no match for our puny weapons!"
add *.windowsupdate.com and *.microsoft.com to your trusted sites.
You gullible, gullible fool : )
You can't take the sky from me...