Slashdot Mirror
New IE 8 Zero Day Discovered
Trailrunner7 (1100399) writes "Researchers have disclosed a new zero day vulnerability in Internet Explorer 8 that could enable an attacker to run arbitrary code on vulnerable machines via drive-by downloads or malicious attachments in email messages. The vulnerability was discovered and disclosed to Microsoft in October, but the company has yet to produce a patch, so HP's Zero Day Initiative, which is handling the bug, published its advisory Wednesday. The ZDI has a policy of disclosing vulnerability details after 180 days if the vendor hasn't produced a patch. The use-after-free flaw lies in the way that IE handles CMarkup objects, and ZDI's advisory says that an attacker can take advantage of it to run arbitrary code."
this IS a critical bug... onehundredandeighty days... 180 zero days. why? MS wants to drive up marketshare of competing browsers incompetence? MS employees acitvely exploiting the bug?
I've had it. Nothing is secure. Nothing works. I'm going back to an abacus and an Etch-a-Sketch.
Can't Balmer spare any developers developers developers?
>80 column hard wrapped e-mail is not a sign of intelligent
>life
Aren't they on like IE 10 by now? I don't use it so I haven't kept up with it.
You are welcome on my lawn.
Internet Explorer 8 was the last Internet Explorer available for Windows XP. Was Microsoft tempted to ignore the security exposure until XP fell out of support? Are there other security vulnerabilities in Windows XP reported before April, 2014, that Microsoft has ignored? Will Microsoft ignore (or at least slow walk) reported security vulnerabilities in their other products as they get nearer (but not actually reach) their end of support dates?
These continuing security defects are really beyond ridiculous. Maybe regulators -- the European Commission? -- ought to be mandating that vendors fix security vulnerabilities in their products within, say, 120 days. That would extend to all products sold (refurbished, new, whatever) within the past, say, 7 years. Otherwise, the vendor will be automatically barred from selling anything unless and until their security messes are cleaned up.
They give NSA all of their backdoors months in advance. Do not use Microsoft products!
It is really a sad state that computer systems are in nowadays. Every year multiple vulnerabilities are published showing how easy it is for someone to find critical vulnerabilities in software used every day by citizens and government officials. I bet the NSA is into Chinese government systems and China already has access to american government systems. The underground hacker/criminal scene certainly already has access to corporate and government systems too if you think about how many vulnerabilities are found every year and the underground market to sell not yet published vulnerabilities. Obviously not only the good guys who publish the vulnerabilities find vulnerabilities. I wonder what the ratio is but I bet the good guys don't have that much of a lead. Maybe we are going about this wrong and instead of making people think they are secure they should assume all governments are not secure. This would bring about a cold war. China won't critically bring down American government systems because they know that America would just do the same to them :).
With articles being published that show that the NSA is putting trojan software in exported systems you can certainly bet that other countries are doing the same. Are you sure that USB drive you ordered from China is only a USB drive?
We need a revolution in computing when it comes to security. While we have seen improvements in security over the years we don't seem any closer to solving security issues than we were 10 years ago when it comes to the apps that every day users use.
American Date Format :DIE Already!!!!!!!!!!! .....[shhh the nsa is listening]
American Imperial Units: DIE Already!!!!!!!!!!
American Imperialism :
46137
What's with all the illiteracy these days? It's not a "zero day"; it's a "zero-day". Zero-day is an adjective and must be hyphenated.
Zero-day attack
It's "640k 0 days should be enough for anybody". I'm not going to tell you again.
According to the timeline it is a -180 day.
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
"Researchers have disclosed a new zero day vulnerability in Internet Explorer 8 ... The ZDI has a policy of disclosing vulnerability details after 180 days if the vendor hasn't produced a patch.
So then wouldn't that make it a minus 180 day vuln instead? </snark>
Oh -- it was found 180d ago so that's be a plus 180. Wrong orientation base there, sorry.
If the universe is someone's simulation -- does that mean the stars are just stuck pixels?
Honestly, I hope they do not release a patch so that all of the sysadmins they turned into liars with the last one can get some of their credibility back.
Doesn't matter even if it is a newer version e.g. IE10, IE11.
If you're in a corporate environment and some legacy in-house apps only play nice with IE, cough out some money and upgrade or port those apps.
It's time to let IE go the way of Realplayer: once annoyingly ubiquitous, now a mere footnote in tech history.
OK, first I was confused because I read IE 8 as Windows 8.
So a bug is discovered in IE 8, which has been deployed for a long time... but...
Somehow the meaning of "Zero Day" has changed over the last few years. It used to mean a vulnerability that was discovered before a version of software even went live.... ouch.
Now the definition on wikipedia seems to pretty much include ANY vulnerability that hasn't been patched. So by definition ALL vulnerabilities are "zero day" until the vendor releases a patch... so therefore to add the "zero day" adjective in this context is meaningless...
"Zero-Day exploit allowing the attacker to run arbitrary code"
I thought these words should be history based on the implemented NX bit, sandboxing, multiple lines of defense and Data Execution Prevention features of MS Windows after XP.
Why do all these features fail, when they are specifically designed for exposed code like IE? Or does this warning assume the worst case, where all these other features are turned off?
NB: The message above might reflect my opinion right now, but not necessarily tomorrow or next year.
> Or does this warning assume the worst case, where all these other features are turned off?
It seems not. But remember that Internet Explorer was written to be inseparable from the operating system itself, with effectively bare metal access to provide Microsft-only speed, power, and enforced reliance on Microsoft's system libraries. It was designed _not_ to be lmodular, and designed _not_ to be clealy segregated from the underlying operating system so that it would be impossible to remove or replace on a Windows system.
In IE8, Internet explores YOU.
Now the definition on wikipedia seems to pretty much include ANY vulnerability that hasn't been patched. So by definition ALL vulnerabilities are "zero day" until the vendor releases a patch... so therefore to add the "zero day" adjective in this context is meaningless...
And a "new" zero day at that. That's a relief, it could have been an old one.
"Zero-Day exploit allowing the attacker to run arbitrary code"
I thought these words should be history based on the implemented NX bit, sandboxing, multiple lines of defense and Data Execution Prevention features of MS Windows after XP.
Why do all these features fail, when they are specifically designed for exposed code like IE? Or does this warning assume the worst case, where all these other features are turned off?
The NX bit, and DEP forced us to develop Return Oriented Programming https://en.wikipedia.org/wiki/... Basically because function arguments and return pointers are on the stack you can make the code that's already there do the work for you. It's not as easy as just writing a little shell code and tends to be more specific as far as the version of the software the victim is running, but it's really quite neat and hard to stop.
So lets pretend that we've just completed writing this code, as opposed to having just completed sabotaging it -Altera
IE8 no longer needs to exist. The only technical reason for it is Windows Updates for XP which are no longer available.
Windows XP supports the NX bit, which came in with a service pack. Maybe you're thinking of Windows 2000? Though by default I believe Windows XP won't use it unless you specifically turn it on. And of course, you need to have a processor that has the NX bit in the first place. Windows Vista defaulted it to on (though only for the 64-bit versions), and Windows 8 requires it to the point where it won't boot on a processor that lacks the NX bit.
It also boasts a worst in class standards support. When building advanced web services, Chrome's lack of support is a big enough pain. IE 11 is still about 3x as bad, but it is getting better. IE 10, in particular, was a huge improvement, but I often wonder why they still bother trying to build a browser from scratch.