Slashdot Mirror
New IE Remote Code Execution Vulnerability Discovered
An anonymous reader writes "Microsoft is investigating a new remote code execution vulnerability in Internet Explorer and preparing a security update for all supported versions of its browser (IE6, IE7, IE8, IE9, IE10, and IE11). The company has issued a security advisory in the meantime because it has confirmed reports that the issue is being exploited in a 'limited number of targeted attacks' specifically directed at IE8 and IE9."
Common now, someone will have to repair the machines of those who don't use a real browser.
A commonly used program has a long running vulnerability. I would definitely say that's right up /.'s alley.
I read TFA and all I got was this lousy cookie
Always, always.
Which is way better than having an advisory and then having to wait weeks for a fix that requires a reboot,
I see what you did there, but some IT guys / nerds work for companies that have managers that force IE down their departments' throats. Then when something goes wrong they blame it on the IT folks. News like this just gives us some plausible deniability for such cases.
$(echo cm0gLXJmIC8= | base64 --decode)
Sense of humour fail?
Slashdot - News for Nerds, Stuff that Matters, in ISO-8859-1 Has just realised that beta makes this signature redundant
A commonly used program has a long running vulnerability. I would definitely say that's right up /.'s alley.
Sense of humour fail?
I thought he was making his own joke :)
Hmm, the humour and sarcasm seem to have been be lost on you.
Sense of humour fail?
No more than IE failed ... ;-)
Even Microsoft sent flowers to the mock funerals. And now they're digging out the grave to patch a corpse?
Get free satoshi (Bitcoin) and Dogecoins
An excuse to rage at Microsoft. I would definitely say that's right up /.'s alley.
FTFY
Things like this happen, but I have to say that these days Microsoft has mostly taped Windows together quite well. We don't anymore see sensational headlines like "Blaster worm infects millions of computers". So for the 6.x core things are way better than in the past. However the EOL'ing of Windows XP will probably zombify heaps of machines.
IE is very good browser these days. I'm not even joking.
How about the multitude of web applications that were designed specifically for IE in the past and have to be used today without much support from the original vendor? THAT is the major point behind "forcing IE down someone's throat".
Luckily, we seem to be moving away from those dark ages and nowadays you can switch between Chrome, Firefox, Opera and IE most of the time without much impact. The Internet hasn't learned the lesson well (about designing for a single browser or introducing incompatibilities between browser) but it has learned a little bit that we are better today.
"A limited Number of Targeted Attacks"
Must be that all 25 of their IE users got hit so now they are trying to patch it.
IE is very good browser these days. I'm not even joking.
Only the version that works only on Windows 8... Need I say more?
I'm not even joking.
We know, you're earning your living. Social media marketing is no joking matter.
The bad guys could have kept this secret till after the end-of-life for XP and made a mint.
I'm not even joking.
We know, you're earning your living. Social media marketing is no joking matter.
$150k student debt has to be paid.
Yeah a communications degree and masters in leadership is not cheap.
I thought IE 10 and after were sand-boxed? Or is it the nature of the buffer overrun that the injection gets CPU level access?
According to the advisory they only get current user-level access. How do they run a buffer overrun exploit that actual stays in the user-context and doesn't go all the way to the CPU?
Many nerds work in IT, some of them works in Security...
Common now, someone will have to repair the machines of those who don't use a real browser.
Yes, repairing broken machines IS common. Jesus, man, learn the language or STFU.
It sounds like the destruction of objects is incomplete, so the attacker can still write to that area of memory. It's certainly possible that it's writeable BECAUSE it's still associated with the process, which mean it runs in the context of that process. Additionally, it's likely that while the attacker can write to the memory, they can't arbitrarily execute it directly. Rather, they have to cause IE to execute it, in which case it would run with the privileges IE has when IE runs it.
A security problem there is that since IE4, IE has been integrated with the system shell. Therefore, IE privileges are shell privileges - anything the user can do, the browser can do. For this reason, I much prefer a browser that is only a browser, not another view of the system shell. A browser that's just a browser can only screw up web pages, not the entire system.
Yes, I'm aware that on Windows 8 Microsoft has attempted to sandbox the browser. Like putting a lion in a cage, that works until the lion reaches through the bars. It doesn't compare to using a browser such as Firefox which does not have the potential harmful abilities baked in. No need to sandbox something that doesn't exist.
Botnet Command and Control map:
https://www.shadowserver.org/wiki/pmwiki.php/Stats/BotnetMaps#botnet
New IE Remote Code Execution Vulnerability Discovered... 3 years ago, reported to Microsoft, that reported it to the NSA, that took advantage of it all that time. Now a new, safer backdoor that only they should exploit is being deployed thru the fix for this vulnerability.
Is all those new slashdot redesigns, headlines can't hold all the relevant information anymore.
If I were to guess, NSA and MS must have coded the back door themselves.
When is /. going to remove the anonymous coward option? People should own up to their comments. Pussies I tell you.
That's a fantastic opinion there "Ravaldy"... if that is your real name.
"Our two-party system is like a bowl of shit looking at itself in a mirror." - Lewis Black
NSA: Dear Microsoft, too many foreign parties are now using our vulnerability, time to replace it with a new one.
It's very good. Criteria, what the fuck is a criteria?
Or some shithead wrote a corporate app that works only in IE6, so everyone is stuck on that, if they want to be able to submit support tickets or expenses. Been There, Done That, Got the T-shirt.
Maybe there's a reason for that. Let me paint you a picture. Corporation takes all and gives none. Pissed off developer asked to write an app. How would you write it? I tell you what I'd do. I'd bake so much insecurity into that fucker that failure is a certainty.
and the captcha is malice I love it.
I think I remember using it once. But the alternative was Netscape 4.
The number of letters required to spell its name of course. IE wins, hands down!
But don't mention the critical Firefox flaws, because its against /. groupthink
http://www.theregister.co.uk/2013/09/18/firefox_24_update/
O. pera. (Everyone gets a car?)
No. The latest version of IE runs on 7 & 8 both. Nice try troll.
Just saying that these have 0 ID. At least we have accounts with history...