Slashdot Mirror
Highly Critical Hole Found in IE
dotpavan writes "Eweek reports on a highly critical MS Internet Explorer hole found by Secunia Research's Andreas Sandblad. The vulnerability is due to the processing of the "createTextRange()" method call applied on a radio button control.
From Secunia, "The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2." The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview (January edition) though it could be avoided by turning off Active Scripting, as suggested by Microsoft Security Response Center blog. How would this put MS in the market, hit by the ever-growing shots of vulnerabilties? And would the divorce of IE7 from Vista's Windows Explorer help?"
here
Must be thursday.
...if researchers just identified the bits that *weren't* totally insecure?
It's a brand new hole!
--
Superb hosting 20GB Storage, 1_TB_ bandwidth, ssh, $7.95
Is it shaped like a woman's mouth? I mean, that's a highly critical hole.
Can't we just take it for granted that IE is just choc-full-o-holes, and these holes will always get discovered by some third party, and MS will eventually make a patch for it. Then lather, rinse, and repeat? Why do stories like this even make it to Slashdot anymore?
the cure to a problem is not hiding it.
TFA: Microsoft plans to release a pre-patch advisory with workarounds for a "highly critical" vulnerability that could put millions of Internet Explorer users at the mercy of malicious hackers
So this article updates us to the fact that they plan to update us with an article prior to the update?
Slashdot Burying Stories About Slashdot Media Owned
its the time period that sometimes makes it more panicky.
It could've been a very cynical hole in IE concerning when Windows Vista will finally be released.
With security being #1 in IE7, and numerous IE7 articles published by both microsoft and non-microsoft advocates praising the security and reliability of the new MS Browser, can we conclude that even with their upcoming browser media hype is still the best feature?
Personally, I understand if people don't want to use Firefox, it isn't the best browser either, no browser is the best across the board. I don't, however, understand why people want to continue to use Internet Explorer. It has been proven time and time again to be buggy, and patches take weeks longer than in most other browsers.
Not being a hardcore developer myself, I don't know what causes this, but might this have been avoided if Microsoft adhered to the Javascript standards rather than "tweaking it" for IE?
"Now the trouble about trying to make yourself stupider than you really are is that you very often succeed." -C.S. Lewis
Come again?
Proud member of the American Non Sequitur Society. We might not make much sense, but boy do we love pizza!
Can't... it's required for Windows Update! If you don't update, you're screwed!
Can't be secure with ActiveX, can't be secure without ActiveX... but what would happen if ActiveX didn't exist?
IE is the hole, into which are placed 'features' such as this exploit, tied to the feature called 'activex.' Remove these 'features' and all that is left is the nothingness that is a hole.
Moderation in All Things... Especially Moderation - gurutc
createText("install firefox.exe");
createTextRange(-1);
And just let the exploit install firefox. It's just that easy.
Proof by very large bribes. QED.
here.
IE user, your house is on fire. Run for the hills! Go! Go!
Take the cheese to sickbay, the doctor should see it as soon as possible - B'Elanna Torres, "Learning Curve"
And would the divorce of IE7 from Vista's Windows Explorer help? ... you perverts!) but not until my power book did one love me back...
maybe, but i still recommend divorcing windows entirely. i've loved computers before (not sexually
i don't care
Dupe!
This is my sig. There are thousands more, but this one is mine.
Well, of course it can, that's the point of an HTML Application. The problem is that they can be executed without the users permission.
Not quite true. Mostly because of the sheer amount of lazy bastards reading Slashdot while they should be working, a high proportion of this site's visits are through Internet Explorer. Even if they will use some newfangled firebird or netcraft when they get home, this hole matters to them *now*.
No, according to InfoWorld, there are two bugs, so it's not a dupe, it's a second bug.
But, good catch!
-- Tigger warning: This post may contain tiggers! --
...Jack's complete lack of surprise.
120 characters for a sig? That's bloody useless.
Also, I note that there is no mention as yet (there is another story on the way) of the highly critical security flaw found in Sendmail which also had a proven potential for remote and local exploitation and arbitrary command execution. Actually this is potentially quite interesting; with remotely exploitable problems with both IE and Sendmail announced at almost the same time, I wonder which one we are going to see exploited by the blackhats first? Admittedly there are already updated packages for most Linux distros and commerical UNIX versions, plus a new release of the software (no offical Sun patch for Solaris yet though) which is going to tip the results a little, but still...
UNIX? They're not even circumcised! Savages!
The Grandparent Post never said hiding the problem was a cure. Hiding the problem *until there is a cure* would lower the number of exploits, that's all. Might delay a cure too.
A simple math analogy will demonstrate the formula for /. sentiment. A negative multiplied by a negative equals a positive. Hackers hacking Microsoft == good news. Hackers hacking Firefox == bad news. Any good tech company can easily turn evil simply by an association with Microsoft.
GoDaddy == Good.
GoDaddy * Microsoft == Evil
In the same vein (but totally against any mathematical logic), any company (including evil ones) that are associated with Open Source and/or Linux automatically become good.
Oracle == Evil
Oracle * Linux == Good
China == Evil
China * OSS == Good
Here's the difference: In Sun's case, the hackers didn't alert Sun to the vulnerability. They just DOS'd a free service that Sun provided the world, causing headaches for people attempting to use the service. Their actions accomplished absolutely nothing (the grid was not affected), and resulted in Sun pulling a previously free product behind a security wall for which people are required to subscribe. Good going!
In this case, a researcher discovered a flaw in the browser, and instead of being an a$%hat by writing yet another worm or malicious program, alerted Microsoft to the bug. Which is now in the process of being patched.
Humorless sig goes here.
So collectivist nerds can sit and giggle self-contentedly to themselves when MS looks bad.
I wish I had mod points, because you'd be -10 moron.
If DDOS is a vulnerability, it's one that all systems share, and thus, we'd have to be extremely jaded and cynical for blaming Sun for getting hit with one.
It doesn't help that the existance of vulnerabilities in Microsoft's products is probably the reason it was so easy to attack Sun.
Don't thank God, thank a doctor!
A DDoS isn't a vulnerability any more than someone throwing a brick at your face.
IE 7, when run on Windows Vista, would not have fallen victim to this or any other exploit of this nature. The reason for this is the fact that IE 7 on Vista runs as a user with virtually no privileges, regardless of privileges of the user using IE 7.
Essentially all actions that require higher privileges, such as writing to non-temp locations on the file system, executing applications, installing plugins, changing settings, etc, will be done through the use of a broker.
The broker is very small, perhaps only a few thousand lines of code. This makes auditing the broker far easier than auditing the hundreds of thousands of lines in IE 7.
When IE 7 wants to save a file to the user's desktop, for instance, it must first "ask" the broker if it can do this. The broker is written in such a way that all actions require the user to confirm this is OK via a dialog box. If the user says it's OK the broker completes the action on behalf of IE 7.
If IE 7 has a buffer overflow or exploit of some kind and tries to do something nasty it will always fail because it is running as a user with basically no privileges on the system.
There is a video that describes this in detail on Microsoft's Channel 9 web site.
The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview (January edition) though it could be avoided by turning off Active Scripting, as suggested by Microsoft Security Response Center blog.
Per the same blog, the 20 March release of IE7 Beta is not vulnerable.
Caveat emptor... I haven't tested it.
Here. Guaranteed not to be exploited by any javascript or plugin vulnerability. Or by any site that uses frames.
shall be named "alimony"!
DEAD DEAD DEAD DELETE ME
Didn't we just have an article about MS wanting to go after Big Blue's business in the serious computer market? That they had spend 20 billion dollars on getting Windows ready to compete with the big boys and that IBM better look out?
Some MS fan boys of course swallowed that line hook, line and sinker. The same line MS has spun since it began business. "The next version will be lots better then what our competitor offers so please buy our [inferior] product now, we promise to ship the next version on time and as promised. Honestly. Have we ever lied to you before, or failed to meet a deadline, or failed to live up to our own hype?".
So the question by the poster of how this will affect MS in the market.
Not at all.
Simple as that. MS can keep producing crap and the public will continue to lap it up. I don't even care for the reasons and excuses anymore. They start to sound more and more like what you get at an Alcoholic Anonymous meeting or a session for battered wives.
As a LAMP developer I was recently offered a position with the opportunity to grow into .NET development. Gee thanks. What is the bonus package like? Kick in the nuts?
For those wondering what IE 7 and Vista will be really be like. More of the same old crap just a lot more useless crap that nobody really uses but that adds a lot of bloat that makes it impossible to debug. IF IE 1 - 6 have been buggy security holes and IE 7 has so far had the exact same bugs and security holes as 6 then it is obvious that MS hasn't really done anything with that supposed security audit of theirs.
First WMF now this. Vista is just another re-release of the same crap code that MS has been logging around since Billy boy first stole his basic interpreter.
Business as usuall. No doubt they will make a fat profit on it.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
The good news is that at least we know that IE 7 is backward compatible with IE 6 vulnerabilities.
"Every decent man is ashamed of the government he lives under." - H.L. Mencken
This hole will complain endlessly about your banal surfing habits and tell you taht are beginning to look a little fat. It's amazingly critical.
"Your superior intellect is no match for our puny weapons!"
for sure, I don't mean to be defending IE, but according to the original bug report (copied from Full Disclosure ML):
*******
I can't find any info on this delicious IE bug, but it seems to be publicly known:
r=document.getElementById("c");
a=r.createTextRange();
It will badly access a (virtual?) pointer table, making EIP to jump at a random address. This has various effects on the system I've tested with, including crashing. It works on these versions of mshtml.dll:
XP SP2: 6.0.2900.2802 - latest
WS2003: 6.0.3790.0
*******
So EIP goes to a random address, big deal. This is not exploitable unless you can allocate a huge chunk of memory and place lots of NOPs followed by the payload, then you've got to hope the random jump lands in that region. Not likely to work.
This is bad (crash) but not remotely exploitable (no worm on the horizon)
TODO: 753) write sig.
*sigh*
This is most likely the latest instance of the deep design flaw that the Microsoft HTML control has had since 1997, a flaw that no other browser (open source or commercial) suffers from, a flaw that Microsoft is going to have to break every application that uses the HTML control for anything but simple HTML display to fix... but which they absolutely have to do.
Compared to sendmail... this would be like Allman "fixing" the backdoor that the Internet Worm used by changing the password from "WIZARD" to "DEMON", then making patch after patch to keep the backdoor open... instead of simply taking it out as he did. Genuinely fixing a design flaw, rather than patching over instances of it, THAT is what "concentrating on security" means.
add *.windowsupdate.com and *.microsoft.com to your trusted sites.
You gullible, gullible fool : )
You can't take the sky from me...
I can't remember the last time I used Windows Update. Automatic Updates does most of what I used WU for, even more easily. If I want other updates, Windiz Update is very similar, but works in non-IE browsers.
When IE 7 wants to save a file to the user's desktop, for instance, it must first "ask" the broker if it can do this. The broker is written in such a way that all actions require the user to confirm this is OK via a dialog box. If the user says it's OK the broker completes the action on behalf of IE 7.
Wait, so I right click an image, choose "save to desktop", and then a dialog will come up asking me if I "really want to" do that?
You know, my usual response to dialog boxes like that is something along the lines of: "No, I was just clicking that button for the hell of it. I didn't want to actually do anything." (with a nice sarcastic tone)....
If that's really what using IE (and Vista) is going to be like, well, damn, I'm just that much more glad I bought an iBook last month instead of a Windows-based laptop.
Disabling ActiveX doesn't help. The workaround is to disable active scripting. That will also disable everything in , , and tags. That means everything from Java applets and Flash to JavaScript (and therefore stuff like AJAX and most DHTML events).
In other words, the "fix" is to use your browser in 1995 mode.
The road to tyranny has always been paved with claims of necessity.