Slashdot Mirror
Microsoft Issues Workaround For IE 0-Day
Orome1 writes "Microsoft has issued a security advisory with advice on how to patch a Internet Explorer zero-day vulnerability recently spotted being exploited in the wild by attackers that might be the same ones that are behind the Nitro attacks. News that there is a previously unknown Internet Explorer vulnerability that is actively being misused in the wild by attackers that are believed to be the same ones that are behind the Nitro attacks has reverberated all over the Internet yesterday."
Click
It may be that the same thing is mentioned twice in a very short summary of the story, but that the same thing is mentioned twice in a very short summary of the story does obfuscate the lack of content. That is why the same thing is mentioned twice in a very short summary of the story. Why else would it be that the same thing is mentioned twice in a very short summary of the story?
Slashdot social media options: AIM, ICQ, Yahoo, Jabber and Mobile Text. Why no MySpace?
The work around is load firefox or chrome.
What does this even mean? Is it the same 0-day? Is it a different 0-day? Can we get some editing up in this bitch or what?
There's so many it doesn't really matter. They'll be another next month, and the month after that, and the month after that.... You can safely assume that at any given instant there exists at least one active zero-day infecting IE users.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
Disable ActiveX and then demand it runs to "Prompt" in both Internet AND Intranet????? This is NOT a "work-around." A work-around would be how to allow our users to continue running without being prompted to run or not run things they don't understand and don't want to.
Or install an alternate browser.
Sheesh, is the Internet really worth this crap? Really?
Seriously, I don't use IE at home but until Chrome, Firefox, or Opera have tight integration and customization that can be centralled managed (GPO) IE will be the defacto standard browser for a lot of businesses. As an IT Manager I have tried repeatedly to move to a different browser and the tools to manage them just aren't there.
"Hahaha those losers use IE, they suck they should just switch to chrome" are not helpful comments and show just how little you know about the many current business environments. Your beloved Chrome and Firefox, by their actions, don't want to be the default browsers in business. They just don't. That leaves us with IE which, despite these 0 days and standards issues, is superios in every way in a Windows comprate environment. Until that changes IE will be what many businesses use because browser management is just so easy it's automagic.
And those Linux folks, switching to Linux isn't helpful either until some sort of same tier GPO management alternative that has simple interpoability is available. We could actually drop Windows and go full linux if I could gain the control I get from a Windows environment.
Disclaimer: I use Firefox, Opera, Ubuntu, and Mint at home.
What does this even mean? Is it the same 0-day? Is it a different 0-day? Can we get some editing up in this bitch or what?
With Microsoft you can make every day a 0 day!
http://technet.microsoft.com/en-us/security/advisory/2757760
Linking from "Microsoft issued an advisory" to submitter's site is kinda lowbrow.
It may be that the same thing is mentioned twice in a very short summary of the story, but that the same thing is mentioned twice in a very short summary of the story does obfuscate the lack of content. That is why the same thing is mentioned twice in a very short summary of the story. Why else would it be that the same thing is mentioned twice in a very short summary of the story?
Can I quote you on that?
Simply put, it means you have to deploy the Microsoft Enhanced Mitigation Experience Toolkit.
No sig today...
I remember that when Microsoft bound IE to the OS back in Win95, IE is now everywhere. That Windows Explorer window? Now subject to IE attacks. That HTML pane in Outlook? Now subject to IE attacks. That help window in SomeGame 2.0? Now subject to IE attacks.
I'm not sure how true this is now, but a guess is that it's still much this way.
You are doing it wrong. You are creating a tightly integrated application with IE/browser. Bad idea from the start. Then you are locked in forever till someone funds another tight integration. Your benefiting from IE infrastructure, but the world is messed up b/c you are stuck in 1990s.
So pls stop doing it or stop calling whatever you created a browser and make sure you exclude them from external network usage so we do not have to fell the pain caused by you decisions.
BY THE WAY. If you have to control your employees so much find ones that you can trust.
Last time I had looked into it, IE9 was more secure in several ways than Firefox. It also had comparable number of security holes.
Have things changed substantially in the last year?
It's not the browser but the underlying Operating System that is at fault.
distrowatch
AccountKiller
Workaround != patch.
"A plan fiendishly clever in its intricacies"- Homer Simpson
It never ceases to amuse me, the glazed look on peoples faces when they ask me how I deal with Windows viruses and I explain I don't use Windows ..
Distrowatch
AccountKiller
You speak with authority but do not understand the principles and abstractions.
It's called COM. Windows is based on COM. It allows components to be reused, which is good design and good practice.
This is the same concept as WebKit being a shared library on Linux and gnome help, gnome file manager and Epiphany importing it.
I they discovered a WebKit hole: waah waah whinge whinge there is a hole in Gnome Help - save us all from the 0-day
That complaining never happens but if Microsoft fall to the same thing, they get slated. Hardly fair is it?
Unless things have changed in the last ~2 years, Outlook rolls its own HTML/CSS/JavaScript engine to avoid IE issues like this.
Unfortunately, it opens Outlook up to their own HTML/CSS/JavaScript related bugs, and their implementation is half-assed like old versions of IE (that is, you can't expect HTML and CSS to work normally, even for features that Outlook implements).
Sorry, PTSD moment from having to "fix" HTML newsletters for Outlook once upon a time...
- chrish
No, they have not changed and your analysis is correct. However, be prepared to be modded down and called a shill. Your sane post is like trying to tell religious zealots that they might have some facts wrong. The folks here are pretty well biased against IE even when it does do something right.
Internet Explorer users don't check for updates let alone understand what zero-day means.
Oh, right. Fail IT departments who have kludged apps that require IE because the management was incompetent.
FTFY
No colour or religion ever stopped the bullet from a gun
Firefox Issues Workaround for IE 0-Day
http://getfirefox.com/
Chrome Issues Workaround for IE 0-Day
https://www.google.com/intl/en/chrome/browser/
I think I'll take my chances using browsers native to Linux. Of all the things that alienates me from m-$ is their pompous grinning while showing off; it creates no life.
I think enhancing what I've already experienced with Microsoft IE would be like using steal wool to cure hemorrhoids.
Ya think too small
http://www.ubuntu.com/download
Jack of all trades,master of none
It allows components to be reused, which is good design and good practice
It's only good design practice if the shared components dont royally suck.
IE9 was more secure in several ways than Firefox. It also had comparable number of security holes.
Oh really? You might want to check what Secunia has to say on the matter.
For IE 9
For Firefox 15
The two aren't even close in terms of vulnerabilities. Too soon for Fx 15? Let's go with the 14 version:
Less than half the problems.
And one more for good measure; Firefox 13. Again, less than half the vulnerabilities of IE 9. Even the unpatched vulnerabilities for Firefox are less critical than the ones for IE 9.
So yes, things have changed substantially in one year. Either IE 9 has gotten worse or Firefox has gotten better. Take your pick.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
Submitter is a idiot.
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
All but one supported edition of IE is affected: 2001s IE6, 2006s IE7, 2009s IE8 and last year’s IE9. Together, those browsers accounted for 53% of all browsers used worldwide. The only exception is IE10, the browser bundled with the new Windows 8, which does not contain the bug.
http://www.thetechnologygeek.org
No... Sadly that /. back when it was a cool place to live.
Nowadays everytime there's some pathetic headline making people happy to be using Linux / OS X / any other browser than IE you can expect a lot of six and seven digit /. ID numbers to pre-emptively whine about how pro-MS comments are going to be called out as shills.
Now, according to you, what exactly would a MS shill post here?
Something saying how remote admin holes by simply opening a website happen all the time for Un*x users out there?
Last I checked btw the one browser giving IE a run for its money was Chrome... So the comparison with Firefox, to try to downplay the seriousness of yet-another-remote-admin-IE exploit is kinda rubbish.
Yes Java applets were the number one source of security exploits in 2011. Yes Flash was second.
Yes a new 0-day affecting IE6,7,8 and 9 and giving remote admin rights by simply visiting a webpage is very, very bad.
And, yes, people are safer browsing under Chrome / Linux, Chrome OS X or Chrome Windows than IE.
Now how's that for you?
Which is interesting because they DO want Intranet and Internet zones to be set to high. This is absurd.
To be honest they have shipped more boxes than anyone in history.
WebKit has had its fair share of exploits over the years. I first worked with it when it was known as KHTML and have followed it over the years.
I work for a corporation that has source access for IE (MS shared source) and it's a remarkably well put together product which equals WebKit.
Obviously my post was not referring to "on linux". But even there, my understanding is that, security-wise, Firefox is in second or third place (not really sure where Opera stands...).
The problem is that IE9 doesnt do a rapid-release cycle like Firefox does, so all of its 9 point releases since 9.0 in May 2011 are considered the same product. That total of 60 vulns you see spans a year and a half. Firefox 14s spans about 8 weeks (July 17)-- which makes that "32" a LOT scarier. To boil it down, Firefox 14 had ~4 vulns per week since release, while IE9 has had less than 1 per week.
To do a more fair comparison you would need to total up the number of unique vulnerabilities for Firefox 5.0-15, and compare it to IE9.0 - 9.09 (which we already know is 60). For the record, Firefox 10 alone (released less than a year ago) had 60 vulnerabilities, all of which were patched-- and then Firefox 14 had another 32.
So no, things havent gotten better for firefox, and its still a ton easier to hack than IE or chrome (no sandboxing, no process-per-tab, no privilege dropping, no plugin filtering, etc etc etc). Firefox is a fine browser, but recommending it for security reasons is boneheaded as technically IE and chrome are superior. And up until version 14 of firefox (with silent auto update), you were FAR more likely to be stuck with an old firefox than you were with an old IE.
You get numerous prompts before you can run an ActiveX control. By default, "activeX filtering" is turned on which basically prevents any controls from running till you allow it-- kind of like flashblock or Chrome's java controls.
And really, theres not much difference between an NPAPI plugin and an ActiveX control that Im aware of; when antivirus products use NPAPI for filtering and antivirus (WebRep), it tells me that theres not much a firefox plugin DOESNT have access to.
All of this really misses the forest for the trees tho, ActiveX is not the gigantic, glaring security hole to be worried about. Java and any of the Adobe products are-- something like 80% of exploits target those.
MS suggests to use EMET (a tool that enfonrces ASLR and DEP), but Brian Krebs reports that this does not really plug the hole
Rather than Chrome, which has a nasty tendency to phone home, mention Chromium which one can now easily install (used to be kind of a bitch) for Windows. I find I need this because for some time now Firefox and flash have not played well together. It's sort of hit or miss. Sometimes flash works; sometimes it stutters or worse, freezes. Newish update; we'll see what that does, but it looks very incremental. And yes, I realize that Firefox has that problem with the address bar. But, basically I've never really gotten to like Chromium/Chrome. Nice to have a backup however since I really do dislike IE. I gather it works fairly well now, but I just hate how it looks. It just uses up FAR too much real estate which is idiotically dumb and should have been fixed ages ago.