Slashdot Mirror
Microsoft Issues Advisory For Internet Explorer Vulnerability
jones_supa (887896) writes "Neowin reports how Microsoft made a rare weekend post on its Security Response Center blog to announce an advisory that affects all currently supported versions of Internet Explorer (versions 6 to 11). The issue is based on a newly discovered exploit that could be used against the web browser. The vulnerability exists in the way that IE accesses an object in memory that has been deleted or has not been properly allocated. Memory may be corrupted in a way that could allow an attacker to execute arbitrary code in the context of the current user. Microsoft is aware of 'limited, targeted attacks' that have used the exploit. IE 10 and 11 are protected against attacks using this exploit if they have their Enhanced Protected Mode turned on. Also, PCs that have either the Enhanced Mitigation Experience Toolkit 4.1 or the EMET 5.0 Technical Preview installed are also secured against this security hole. Microsoft will take the appropriate action to protect its customers by delivering a security update."
I wonder if this is going to be one of the first big exploits that will affect Windows XP and leave the masses of users still using it vulnerable.
http://www.pressthered.com/atm...
Be glad it's solid commercial software developers were paid for.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
To paraphrase Ballmer...
"Linux, Linux, Linux!"
I do not fail; I succeed at finding out what does not work.
How else are you supposed to download Chrome or Firefox on Windows?
Wait...IE6 is still supported? WTF?!
>How else are you supposed to download Chrome or Firefox on Windows?
wget.
Oh no. That's Linux.
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Maybe
/pub/mozilla.org/firefox/releases/latest/ ... ...
ftp.exe -A ftp.mozilla.org
cd
ls
binary
get
Browsers other than IE are not affected and/or can pe patched. Can someone remind me how to uninstall IE from Windows?
you cannot, as per testimony by the company in the antitrust investigation. I do wonder how to translate "schmucks" in legalese.
"If a boss demands loyalty, give him integrity. But if he demands integrity, give him loyalty." (John Boyd, 1927-1997)
You can't, without replacing the entire shell.
You can delete the shortcuts, but the rendering engine must stay as it's used by many other things including countless 3rd party products.
I did a re-image of a computer and saw this
Since corporations like my own use IE 8 with low rights mode with sandboxing and protected mode turned off so they can run compromised certificates for ancient java I wonder if we will get patched?
This is much scarier as we handle HIPPA and credit card information and can be hacked.
http://saveie6.com/
Of course you can. You uninstall IE6 by uninstalling Windows. Then you install Ubuntu, and you have a choice of Firefox or Chrome.
no, I don't have a sig
Can someone remind me how to uninstall IE from Windows?
fdisk /dev/sda
Another vulnerability due to C's poor handling of pointers.
That would work for someone dead-set on avoiding loading IE at all costs. But in practice, I imagine that most people aren't going to discover the hostname "ftp.mozilla.org" or the path string "/pub/mozilla.org/firefox/releases/latest/" very easily, especially without using either IE or another computer.
How is the median user (not an outlier technophile like much of the Slashdot population) expected to parse out a download URL from the result of wget http://getfirefox.com/ or wget http://mozilla.org/ without using IE?
What prevents you from refinancing? Does refinancing cost substantially more than a copy of Windows 8.1 to run in a virtual machine?
To avoid a "no true Scotsman" fallacy, I'd like to know what definition of "real distro" you plan on using.
Also very interesting is WHY it can't removed. According to Microsoft's testimony, IE is "deeply integrated with the OS" and removing it would make the OS not longer work. If it's deeply integrated into the OS and it's full of huge security holes ...
Quite apart from the number of bugs, I'm very glad that Firefox is just a web browser. All it does is display web pages. So Firefox bugs basically just affect web pages. Any problems with Firefox are not problems that go deep into the OS.
You can always use FTP, though its pretty miserable.
I suspect this exploit has existed for many years now, probably used by NSA too.
You are being MICROattacked, from various angles, in a SOFT manner.
Powershell can download via http. So can vbscripts.
Why do you support people who do that?
You can't always choose who your mortgage gets sold to.
Automatic deduct?
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.
A) Konqueror is not the system shell. Explorer is.
Still, as I said "I'm glad Firefox is just a web browser ...". Do you see the words Konqueror or KDE in that sentence? I'm comparing IE and Firefox. The fact that Konqueror does something else silly isn't really directly relevant.
B) As I said, Microsoft execs testified that IE is deeply intertwined with the Windows OS. I guess you're not aware that an OS is more than just a kernel, so you think Microsoft was committing perjury when they testified to those facts.
It's amazing how far delusional fanbois will go to defend Microsoft, "they didn't make a big security blunder, they all just systematically perjured themselves for several months". Even if you believe that, is perjury somehow better than screwing up?
> it's easily detected + removed by processexplorer
IE is easily removed? I guess Microsoft was lying.
What you don't seem to get is that IE is the exploitable process, and it's essential to the system. It's a readily exploitable process that can't be removed mainly because if you do remove it, the system stops working.
Because it's a local privilege escalation vulnerability and not a remote visit-this-website-and-get-fucked vulnerability? Fuckwit.
Can someone remind me how to uninstall IE from Windows?
Care to provide a simple/one-liner as an example?
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
Actually Windows does come with a command line FTP client that can be used to download Firefox/Chrome. You just need a Linux user to execute it for the clueless Windows user...
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Invoke-WebRequest http://www.google.com/ -OutFile c:\google.html
From a PowerShell:
Am I doing something wrong?
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
Powershell defeats the point. Powershell doesn't come with WinXP, so it must be downloaded, which probably shouldn't be happening until after Chrome or Firefox are downloaded.
WSH (JScript or VBScript) can be used as an option to get a file using HTTP, without needing to download another program. However, needing to type lines of code doesn't really count as a workable method that relies exclusively on code that comes with WinXP.
http://technet.microsoft.com/e... Using an old version of powershell?
Care to provide a simple/one-liner as an example of how to read that link?
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
Ha! I'd give you mod points for that if I could. That's the first time I have ever tried to post using the new Beta interface on a mobile and it munted the link badly.
http://technet.microsoft.com/en-us/library/hh849901.aspx is the link.
That requires powershell 3. Prior to that you could use: System.Net.WebClient but the Invoke-WebRequest is far easier.
I was trying it on an old XP virtual machine and it looks to be version 2 of PowerShell.
Isn't there an easy one-line that would work on XP and above? (i.e. an analog of wget for windows).
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
$client = new-object System.Net.WebClient
.NET framework installed. Powershell wasn't that good until later versions. I have to say, current versions are actually extraordinarily powerful, when working with other Microsoft technologies, like Hyper-V or Exchange but the early versions were no reason to leave VBScript.
$client.DownloadFile( $url, $path )
Probably works on Powershell 2 however I think it requires the
C:\>wget
'wget' is not recognized as an internal or external command,
operable program or batch file.
C:\>
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Be sure to go Program Features to enable FTP, because it's not available in Windows by default.
XP comes with a perfectly good command line ftp client, ported from BSD.
Thanks, that works.
You're a temporary arrangement of matter sliding towards oblivion in a cold, uncaring universe
WGET is available for Windows and it runs fine.
http://gnuwin32.sourceforge.ne...
And how are you supposed to get it if you don't have a browser?
wget?
I should use this sig to advertise my book ISBN-13 : 978-1501515132.
Has been on every version of Windoze which I've tried it on for ... I don't know how long. Going back into the 1990s at least. I honestly can't remember if it was in Win 3.11, which I was using until about 2000.
Birds are not dinosaur descendants;birds are dinosaurs, for all useful meanings of "birds", "are" and "dinosaurs"