Slashdot Mirror
IE 6 & 7 Unpatched Exploit Goes Wild
Kolargol00 writes "Heise online reports the availability of an exploit (Google translation) for the yet-unpatched MSA-981374 affecting Internet Explorer 6 and 7. It has already been spotted in the wild by McAfee and integrated into the Metasploit Framework."
That's why we in the know sticks to IE5.
Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
there will always be unpatched exploits for OLD and OBSOLETE software.
From the Google Translation: "For the new security hole in Internet Explorer 6 p.m. to 7 p.m..." I do most of my porn browsing much later in the day, I'll be fine.
Time for some to upgrade, then.
It's sad that the 'bad guys' are so quick to react to these opportunities and MS can't beat them to the punch. I'm not knocking MS (well, maybe a little) because they're facing a lot more work to fix it than the asshats who exploit it.
When non-security geeks nag about metasploit lowering the threshold for malicious behavior, it's like watching someone complain about gun laws in a warlord-ruled third world hellhole. It doesn't matter, and you're being silly. Besides, metasploit is geared a lot more towards rapid exploit prototyping, and is clearly designed with this in mind; only the already skilled can use it in this manner because you already need to be able to do it "manually" to take advantage of the framework. Hell, it's even harder to use the (ruby) framework than to code perl exploits; but you can do it faster and the shellcode part of the framework allows you to make complicated shellcode in a reliable fashion. It's not like one of those make-your-own-malware kits.
Emotions! In your brain!
Not patching your software for years on end can leave you open to security exploits? Shocking! I actually wish there were more ie6 security holes at this point. Maybe it would go away faster.
It's great to know not to use IE if you're supporting yourself and your parents. It's a completely different world when you're supporting an entire organization.
to force stubborn IT departments into upgrading their enterprises' PCs. There's lots of them that keep a vast array of zombies with IE6 installed just because they fear anything else will be incompatible with their intranet software.
It's great to know not to use IE if you're supporting yourself and your parents. It's a completely different world when you're supporting an entire organization.
In that case, it's not like you can do anything about it anyways. If you had the power to change that, hopefully you would have done it by now.
Linux boot CD. Just take out the entire hard disk, then there's nothing to mess up.
Um, I would say, if you're supporting an organization, you should definitely know that it should have switched away from all version of IE years ago.
And if you have internal software that requires the use any version of IE, what steps have you taken to make it work with other browsers that at least aren't the main focus of widespread internet attacks. And the same goes for Adobe's push I remember reading about a couple years ago for trying to get enterprises to build their internal apps in Flash instead of web pages to make them more interactive...
Sleep your way to a whiter smile...date a dentist!
For those of us who have a web site, does anybody have a code snippet to put on our pages? Like changing IE's homepage to goatse, or somesuch...
And I missed including the obvious extension to this, namely, you would be transitioning your company off Windows software, which is the most attacked software in the world.
Other OS's may be equally or more vulnerable, but no other is more exploited than Windows.
Sleep your way to a whiter smile...date a dentist!
The problem is not that the "helpdesk" people are stupid, it's that in a lot of cases, the companies they do business with have "extremely important programs" that are used constantly that REQUIRE IE6 or IE7. I don't do helpdesk work, but I do help out from time to time in my small company. Everyone here just about uses FF for everything they can, and use IE when they absolutely have to.
User education is important. It's simple, just tell them "to be safe, do any non-work related surfing (let's be honest, there are times even the most dedicated employees will be going to a non-work related site) in FF and ONLY do work-related stuff in IE.
For the most part, they get it.
Sent from your iPad.
Why can opensource developers fix issues so quickly when a billion dollar company can't? Why is this code that the developers were paid very good salaries to develop, on which the company made billion of dollars of profit, so insecure that it keeps turning up vulnerability after vulnerability?
Maybe when you car door keeps popping open and therefor people steel your car, it is time to stop blaming the thiefs and start to talk to the car maker.
IE is a joke, so punch the clowns that made it.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
If you are still using IE, then a mere goatse is not going to change your mind.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
What organization do you support? What apps are your users using? When was the last time an IE exploit caused problems for your organization?
It's really easy to throw around the word "should". What's the reality of your day to day situation?
The OS is rarely exploited, and in fact Windows is fairly secure.
ADOBE is the fucking issue, as noted by the consistent hack-a-mac contest winner. Always Adobe which gets compromised. Always some THIRD PARTY NON-STANDARD that fucks everything up.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
Wasn't IE 6 pronounced dead and services held for it? Why are we still reporting bugs on it? IE7 on the other hand, it needs to be fixed or even better, killed completely
Should tell them about IEtab, its a great FF extension that allows you to open certain sites using IE, I use it for stuff at work that requires IE, and it works for everything except iMap.
This was reported yesterday but modded down. Today it's important enough? Feh. Slashdot's moderation system is still as broken as ever, I see.
We are talking IE6 here, it is a decade old by now. Do you still use 10 year old PC's? Do you use 10 year old cars?
Oh, you yourself might not be the problem, the real issue is IT management who keeps trying to cut costs by going for the lowest support contract and guess what costs the least to support? NO.
That is it, the word NO is simplest.
"Can I get an open port to SSH to our external servers?" "NO" Time spend: 0.5 seconds.
"Can I install software X that I do actually need?" "NO" Time spend: 0.5 seconds.
"Can I get a license for virtual window machines so I can test software in a safe environment?" "NO" Time spend: 0.5 seconds.
"Can we upgrade our software at least with in say half a decade of release so we are not completely behind the times?" "NO" Time spend: 0.5 seconds.
The problem is very simple, it is a constant cost factor to keep up-to-date. New versions are released so often after all, nearly every 2-3 years. Who can keep up? And it is oh so tempting to skip an upgrade. Why do all the compatibility testing during the beta and release candidates of a new product when you can let everyone else test it for you? Because sherlock, that doesn't test it for you. And that is the testing you need. So you save some money now, but are building up the future migration costs, till those costs become so high that you can no longer afford them no matter what.
It is all about budgets and promotions, you get promoted for keeping you budget low this year, and by then it is the next guys problem if he inherits the hidden costs.
And all because people have become more interested in management then actually doing their job. Because those incompatibilities between IE versions? Those are your fucking JOB. That is why you are paid system monkey, to sort these things out. What next? A car mechanic explaining why he hasn't replaced the brakes on a vehicle that crashed because it was such a hassle and they were covered in dirt and he just didn't want to get his hands dirty? That is exactly what you are saying. Oh my job is so hard, I can't be blamed for not doing it.
Sadly, big companies seem to attract your kind, who is more interested in their performance rating then actually just doing their fucking job. If I let my servers get so out of date they are hacked, well my customers kick me very very hard. I make sure to keep up with the alpha and beta's so that I know the issues with a new release, know the developers know them and can fix them and then am ready to implement them, so that at least then when a problem hits, I don't first have to upgrade several releases in order to not find every issue with a "solved in version X". And you know what, by staying on the edge, you often beat the bad guys. They after all are aiming for the largest mass, and the largest mass is guys like you who can straight faced give an excuse for running a decade old browser.
Really, how can you standup and claim your earned your keep when you still haven't managed to retire IE6. Do you still have a punch card reader for that essential piece of accounting software? Still use floppies because you might need one? Have word perfect installed for an old word file? No? You upgrade stuff like that? Then why does the browser, a piece of software that by its nature faces the whole nasty outside world, not get updated?
Yeah yeah, legacy system needs it. No it doesn't because such systems should be upgraded as times change. You aren't still running windows NT 3.5 are you?
Frankly, I see this problem far to often. You get asked to work on a problem and then find the software is several releases out of date and then have to find a way to bill a client for essentially doing what their own admins should have done. Admins are to afraid of having to say to their boss "why yes sir, the system is running perfectly but I still need resources to make sure it keeps doing that in the future" and developers are more interested in chasing glory then keep their past projects maintained.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
"The OS is rarely exploited"
Should be: The OS is rarely exploited anymore.
And only because it's no longer the low-water mark for exploits. Flash and IE 8 are the current low-water marks for exploits, with pdf on the rise.
"Always some THIRD PARTY NON-STANDARD that fucks everything up."
This has maybe become more prevalent in the last couple of years, but before that, it was largely Microsoft software that was attacked. It was everywhere, and it was super-vulnerable. Now that Microsoft has put more effort into both turning off more services by default, as well as making them less vulnerable to attacks [and as a bonus, may also crash less due to nil pointer errors, etc], attackers have moved on to other software commonly installed on a large number of computers, whose creator hasn't put as much effort into security [namely, Adobe Flash and Reader]. I'm sure in the future, they'll move to other software to attack.
Sleep your way to a whiter smile...date a dentist!
Mmmh, wondering, how many bugs have been exploited for a long time, before they became common knowledge as an exploit and how many bugs are currently exploited that maybe never get recognized by the public and fixed.
Considering how many exploits get found in old software even after years, things don't look good in my eyes.
If someone has money and bad intentions, they could just hire some people looking for those exploits and then exclusively use those exploits like for industry espionage etc. The chance that they can use such an exploit for a long time, when it is only used on a few selected targets, seems I'm quite high.
I'm sure it is done.
If the vendor tries hard enough, they can crash Firefox through IETab. It is far from bulletproof.
^^ Truest statement you'll see.
Not to mention 90% of people who touch a computer (which includes most IT staff) don't know wtf they are doing and should be running as the guest account to protect them from themselves.
That's why we in the know sticks to IE5.
I wish I could but I only has 'lynx', you insensitive clod!
http://www.ncwise.org/
http://www.ncwise.org/documents/eSIS_wrkst_req/Workstation_Requirements.pdf
This program and the people that made it suck fetid goat balls. However their incessant fuckery keep me in a job so I suppose that counts for something.
There are other programs (from the state) that require different versions of java loaded and will not work with anything else. In one case we have three different versions of java loaded and all kinds of scripting necromancy to make it work.
Maybe someone can contact someone and ask them to step into at least 2007? I think the people that made this are in Canada.
Shouldn't the "patch" just upgrade everything to IE8 with its slightly smaller amounts of massively exploited flaws?
I am so glad I use FF and not IE, I owe a buddy of mine big time for showing me the way ....to FF