Slashdot Mirror
Major IE8 Flaw Makes "Safe" Sites Unsafe
After this weekend's report of a dangerous flaw in IE (which Microsoft confirmed today), intrudere points out an exclusive report in The Register on a new hole in IE8 that could allow an attacker to pull off cross-site scripting attacks on Web sites that ought, by rights, to be safe from XSS. This is according to two anonymous sources, who told El Reg that Microsoft had been notified of the vulnerability a few months ago.
IE8 is compatible with sites designed for IE6. You won't see other browsers going the extra mile like this.
Oh my gosh! Internet explorer is not safe to use? This is incredible hot, breaking news to me.
Rain is wet....
Despite MS best efforts, IE just won't shake it's 'insecure' tag, will it?
Part of me wonders if perhaps these vulnerabilities aren't being made a big deal of because of the reputation of IE6. The rest of me which started using Firefox a long time ago just feels smug and superior.
So there I was, scribbling down some notes off the PC screen by hand, when I reached for the keyboard and Ctrl-S'd.
Whodathunkit?
Oh, wait. IE8 has a bunch of other security flaws that make it insecure anyway, and nobody would think to use IE 5.x on anything worth protecting.
Um, the article says IE8 is not affected. Do the editors not scan the article at all? I must be new here.
"IE8 Flaw" is, in and of itself, a redundancy.
This ain't rocket surgery.
It's a feature.
"The average reporter we talk to is 27 years old......They literally know nothing." - Ben Rhodes
The exploit currently doing the rounds is not particularly stable and often just causes the browser to crash.
I doesn't sound like much of a threat and if anything, folks may think it's a bug and move to IE 8 or to another browser all together - solving the problem without installing any fixes.
It's NOT me! It's the meds! I'm on 1000mg of Fukitol.
... run injected code.
Damn! Code injection! Is that like Fuel Injection? So, I'll get better performance and speed from it?
It's NOT me! It's the meds! I'm on 1000mg of Fukitol.
According to the Microsoft Security Advisor 977981 IE5 and IE8 are *not* vulnerables:
http://www.microsoft.com/technet/security/advisory/977981.mspx
First they make emails dangerous, now they do the same with 'safe' websites.
I'm going to be watching my back for Santa and the Tooth Fairy.
It seems to me that if the IE team is capable of telling that a combination of features is potentially dangerous, then why would they edit the source of the page to avoid triggering the vulnerability, rather than actually eliminating the vulnerability being attacked?
Again, that's "Interfect Exploder". Remember to ask for it by name!
Cheers,
"What in the name of Fats Waller is that?"
"A four-foot prune."
A New IE8 security feature... bug.... feature.... bug..... feature.... bug...... feature....bug.
When asked why they are disabling the XSS protection in IE8, Google responds that IE8 has a undiclosed vulnerability. Anyone here think Google is just mud-slinging to disparrage the main competitor to Chrome?
What is "Internet Explorer"? You are talking about the ancient browser ? It is still alive?
No
If anybody dares click on the link in the post above, and orders something from that site, then please hand your geek card in and hang your head in shame.
Sorry, I had to say something. Remember, no more purchases = no more spam.
Maybe Taco & co. aren't adding 'coolforsale' to the lameness filters thinking they'll start some kind of escalating spam war?
Otherwise I don't know why the hell they don't just do it already.
It reminds me of those sub-literate bots you see on Warcraft trade channel. My finger itches to right-click report spam it.
"Friends don't let friends use Microsoft products without the services of a lawyer"
or was it, "in Soviet Redmond, browser uses you"?
Apparently Giorgio Maone (the guy who maintains NoScript) was one of the people who discovered this hole and told Microsoft about it many months ago. After the Register article, he gave away a few tidbits of information on how this works.
Doesn't surprise me M$ would have another failure on top of their Vista being a failure. M$ treats their fanbois just as any other drug dealer treats their addicts. SO M$ keep designing your non-free crapware so the rational people will flee to free software such as GUN/Linux, Lynx, and LaTeX; while the M$ addicts will continue to use bug filled, non-free crapware such as M$ Windoze, M$ Office, M$ Internet Exploder or its knockoffs Opera and the supposedly free Firefux and Openoffice, and anything from a M$ follower such as Adobe, Nero, Corel, Goldwave, etc. It will be too late once the M$ addicts realize they are being duped by M$ as their personal information will be stolen by crackers who utilize fatal M$ security flaws.
--
Friends don't help friends install M$ junk.
Friends do assist M$ addicted friends in committing suicide.
MS thought they were being safe, like replacing single quotes with double before making an INSERT statement for a database, or removing less-than or greater than characters to prevent someone embedding <script> tags everywhere.
Someone is pre-formatting the data so that when it is re-written, it becomes dangerous. In other words, this is like EVERY OTHER VULNERABILITY EVER. Someone makes a feature, doesn't think it through completely, and either leaves a hole, bypass, or unintended consequence.
When the hell did "cool" become a noun anyway? That bothers the hell out of me.
Ride the skies
MS thought they were being safe, like replacing single quotes with double before making an INSERT statement for a database, or removing less-than or greater than characters to prevent someone embedding tags everywhere.
I understand what they were trying to do. It's like every idiot web designer who manages to make it impossible for people named "d'Agostino" (or for that matter "da Silva") to register at their web site. This whole approach has been known to be made of 100% undiluted organic FAIL for a decade. There is no lolcat facepalm epic enough for this.
Even without the security problem, I would disable XSS protection on my sites. If I've made a mistake and let an HTML-injection flaw in my app, chances are it'll still be vulnerable (since IE8's XSS protection is a pathetic string-hack on the HTML source which is insufficient to protect against anything but the most basic of attacks), so IE8 is offering only to obfuscate and not fix my problems.
Meanwhile if I allow XSS “protection”, I have a problem when someone legitimately uses a term in the query string that appears in the page and looks to IE like it might be dangerous. This is easy to do: just searching for ‘<style>’ will often break the CSS of the search results page.
Not only that, but I'm also open to deliberate sabotage when an attacker looks at my source, finds some script they don't like, and puts it in the query string so that IE8 doesn't execute it. Certainly this can be used to deliberately disable things like frame-buster scripts, to get around redress attack protections. It is presumably a form of this deliberate attack crafting that leads to whatever the undisclosed vulnerability is.
So no, I don't think Google are wrong. IE8's XSS protection is utterly, utterly bogus. It adds only more complication and more problems to webmasters' lot and no real effective security.