Highly Critical Hole Found in IE

dotpavan writes "Eweek reports on a highly critical MS Internet Explorer hole found by Secunia Research's Andreas Sandblad. The vulnerability is due to the processing of the "createTextRange()" method call applied on a radio button control. From Secunia, "The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2." The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview (January edition) though it could be avoided by turning off Active Scripting, as suggested by Microsoft Security Response Center blog. How would this put MS in the market, hit by the ever-growing shots of vulnerabilties? And would the divorce of IE7 from Vista's Windows Explorer help?"

Comments

Patch available

[thrillseeker]

here

Re:Patch available

[Stellian]

Mozilla has bugs to. Lots of them. The difference, however is the time it takes to patch them.
Folks like Secunia can profit only when the patch takes a long time to develop. As long as it is a secret vulnerability, it has value. This vulnerability is the perfect example: MS was notified about this on 13/02/2006, 40 days ago. They had all the opportunity to fix it in this month's security patch, but thy did not. So the patch will come no earlier than 2 months after discovery - that's a huge window of exposure.
It was only when I have rediscovered the bug, and posted an inquiry about it on the Full Disclosure mailing list, that Secunia rushed to finally publish the advisory. I must note that I did not develop the exploit independently, I simply piked it up on underground forums.
I say this is not "responsible disclosure", and that it is *irresponsible* to keep a bug of this magnitude unpatched for 2 months. Because there is a high risk that it will be found by the bad guys in the meantime - just like it happened with this bug.

--
Stelian ENE

Re:Patch available

[weisen]

I think that it's a matter of attitude, also. The referenced security blog says:

      We're going to continue to look into this but remind you also that safe browsing practices can
      help here, like only visiting trusted websites, etc.

The idea that the user should be careful about which sites they browse to is insane. It's hard to imagine a corporate culture that thinks this way, if it's a pervasive attitude, ever producing a reasonably secure product.

It's one thing to expect the user not to download an executable and then run it as Administrator. It's quite another to expect people to be "careful" which Google hits they click on.

Highly Critical Hole Found in IE?

[Anonymous Coward]

Must be thursday.

Re:Highly Critical Hole Found in IE?

[lowe0]

I could never quite get the hang of Thursdays.

Perhaps it would save time...

[Threni]

...if researchers just identified the bits that *weren't* totally insecure?

It is not a dupe!

[Life700MB]

It's a brand new hole!


--
Superb hosting 20GB Storage, 1_TB_ bandwidth, ssh, $7.95

Re:GAH

[dotpavan]

the cure to a problem is not hiding it.

Do what now?

[Rob T Firefly]

TFA: Microsoft plans to release a pre-patch advisory with workarounds for a "highly critical" vulnerability that could put millions of Internet Explorer users at the mercy of malicious hackers

So this article updates us to the fact that they plan to update us with an article prior to the update?

because

[dotpavan]

.. MS will eventually make a patch for it..

its the time period that sometimes makes it more panicky.

Could be worst...

[__aaclcg7560]

It could've been a very cynical hole in IE concerning when Windows Vista will finally be released.

Proof of concept

[Anonymous Coward]

Not possible.

[babbling]

Can't... it's required for Windows Update! If you don't update, you're screwed!

Can't be secure with ActiveX, can't be secure without ActiveX... but what would happen if ActiveX didn't exist?

Re:Not possible.

[bedroll]

Disable ActiveX in the Internet Zone and add *.windowsupdate.com and *.microsoft.com to your trusted sites.

ActiveX really should only run from trusted sites anyway.

Re:How does this fare with previous statements?

[CagedBear]

Development problems aren't caused by hardcore developers. They are caused by hardcore management.

mirror

[eclectro]

here.

IE user, your house is on fire. Run for the hills! Go! Go!

Re:How does this fare with previous statements?

[MindStalker]

Well it is a beta IE7 after all. Either way Vista will have IE seperated from the OS. The version of IE7 for XP will still be incorperated with the OS. So realistically IE7 for XP and IE7 for Vista will be very different browsers as far as security goes, and one can not assume a security hole for XP with exist (or matter) in the Vista version.

Re:It's funny

[mizhi]

That in the very previous /. story about a Sun product vulnerability, the hackers get ripped, but when it's Microsoft, the software company gets ripped.

Here's the difference: In Sun's case, the hackers didn't alert Sun to the vulnerability. They just DOS'd a free service that Sun provided the world, causing headaches for people attempting to use the service. Their actions accomplished absolutely nothing (the grid was not affected), and resulted in Sun pulling a previously free product behind a security wall for which people are required to subscribe. Good going!

In this case, a researcher discovered a flaw in the browser, and instead of being an a$%hat by writing yet another worm or malicious program, alerted Microsoft to the bug. Which is now in the process of being patched.

DDOS is a vulnerability?

[SanityInAnarchy]

I wish I had mod points, because you'd be -10 moron.

If DDOS is a vulnerability, it's one that all systems share, and thus, we'd have to be extremely jaded and cynical for blaming Sun for getting hit with one.

It doesn't help that the existance of vulnerabilities in Microsoft's products is probably the reason it was so easy to attack Sun.

IE 7 in Vista would have been safe

[ThinkFr33ly]

IE 7, when run on Windows Vista, would not have fallen victim to this or any other exploit of this nature. The reason for this is the fact that IE 7 on Vista runs as a user with virtually no privileges, regardless of privileges of the user using IE 7.

Essentially all actions that require higher privileges, such as writing to non-temp locations on the file system, executing applications, installing plugins, changing settings, etc, will be done through the use of a broker.

The broker is very small, perhaps only a few thousand lines of code. This makes auditing the broker far easier than auditing the hundreds of thousands of lines in IE 7.

When IE 7 wants to save a file to the user's desktop, for instance, it must first "ask" the broker if it can do this. The broker is written in such a way that all actions require the user to confirm this is OK via a dialog box. If the user says it's OK the broker completes the action on behalf of IE 7.

If IE 7 has a buffer overflow or exploit of some kind and tries to do something nasty it will always fail because it is running as a user with basically no privileges on the system.

There is a video that describes this in detail on Microsoft's Channel 9 web site.

Safest browser ever available

[Otis2222222]

Here. Guaranteed not to be exploited by any javascript or plugin vulnerability. Or by any site that uses frames.

Re:Safest browser ever available

[phantomfive]

Lynx only seems safe because it has such a small marketshare. As soon as more people use it, hackers will target it more. You will see.

Re:Safest browser ever available

[Beryllium Sphere(tm)]

The only thing funnier than jokes about Lynx vulnerabilities is that there have been real ones. Remote shell access in Lynx, Lynx command injection, Lynx NNTP buffer overflow.

Maybe the thing to do is to telnet to port 80 and parse the HTML in your head, but then someone will probably find an HTML trick that will drive everyone who reads it insane.

The 1st IE7 worm after the 'divorce' from windows

[rubberbando]

shall be named "alimony"!