Slashdot Mirror
Critical Internet Explorer 11 Vulnerability Identified After Hacking Team Breach
An anonymous reader writes: After analyzing the leaked data from last week's attack on Hacking Team, Vectra researchers discovered a previously unknown high severity vulnerability in Internet Explorer 11, which impacts the browser on both Windows 7 and Windows 8.1. The vulnerability is an exploitable use-after-free (UAF) vulnerability that occurs within a custom heap in JSCRIPT9. Since it exists within a custom heap, it can allow an attacker to bypass protections found in standard memory. Microsoft has published a patch for this vulnerability, and also patched another one pulled from the Hacking Team files by different security researchers.
The more things change, the more they stay the same.
It's intensely annoying that programmers continue to re-invent the wheel and poorly whenever they need something which they're certain that nobody but their clever selves has ever thought of before. Would it kill them to use a data structure from the standard library of the language they're using? But no, they're too cool and smart for that. They have to code it up custom and then introduce dozens of silly bugs because they're too lazy to write tests and their code is perfect anyway, or so they think, and this is what we get. The best programmers that I have met and worked with are the ones with some humility rather than the arrogant asses who call themselves "10X" developers and other such crap. Yeah right, 10 times the bugs maybe.
Do not look at the laser with the remaining eye
Thank you to whoever hacked Hacking Team. Because of your work leaking the big data dump, a number of fairly nasty security holes in commonly used computer software such as Flash and Internet Explorer have now been patched by their manufacturers.
Companies (or government agencies) who discover/collect/buy/obtain unpatched vulnerabilities in software and sit on them so they can use them for spying purposes are no better than criminal gangs who discover/collect/buy/obtain unpatched vulnerabilities and sit on them so they can use them for building malware.
IMO There is NEVER a valid reason for ANY entity to hold onto an unpatched vulnerability and exploit it, not even the arguments of "National Security" and "we need this to stop terrorists" that have been used by the NSA and other agencies to justify this practice.
Thank you for the feedback.
This issue is no longer reproducible in the latest build of Microsoft Edge on the Windows 10 Insider Preview <build-number>.
Best regards,
The Microsoft Edge team
From personal experience i'd expect that is the current likely response to any IE11 bug where you give irrefutable evidence, clear and concise explanations and isolated test cases.
Selectively naming things obsolete when it suits.
Before Edge it would have been "does not affect enough users, will not fix"... Microsoft do not understand the concept of an evergreen browser, if Edge doesn't forcefully replace IE11 then they just fucked everyone again.
I'm a security professional who works for facebook.
clearly we need Windows to block IE11, and in turn block Facebook.
in fact we need a drop dead date for all of those things.
just because I say so.
Modern IE has actually been pretty good about vulnerabilities. In theory more secure than firefox and chrome due to stuff like sandboxing.
IE 6 was a cluster fuck, but most of the security problems nowadays are Flash and Java. And it's not like FF and Chrome never have security holes.
I don't personally use IE, but it's certainly come a long way. MS does so much shitty stuff like Windows 8 UI, there is no need to attack them for stuff they are actually trying to get right.
This sounds awfully familiar...OpenSSL had a critical vulnerability because they had decided to write a custom allocator instead of using the one provided by the OS. You would think IE developers, with their product being WIndows-only and strongly tied to Windows would never dream of reinventing the allocation wheel, especially as Windows memory management in general has had a huge amount of work done on it in the last few years to make it harder to exploit memory allocation bugs.
Oolite: Elite-like game. For Mac, Linux and Windows
There was a bug and now there is a patch?
Sig?
Warn users and make them click to run IE every time.
A gift that keeps on giving...
I might deserve -1
But can the one who voted me -a troll actually say why I'm wrong?
occurs within a custom heap in JSCRIPT9
It seems that virtually 100% of browser exploits involve javascript. It was a bad idea for all KINDS of reasons. Keep it disabled, and you are much safer, not to mention the web gets less annoying without sites trying to disable cut and paste, or pop random things up over what you are trying to read.
Letting untrusted sites run code on your computer needs to die as a thing.
Yep I can do a .msi, push gpos, use .pac files, etc.
And for several years it is just as secure as chrome and is w3c compliant and can render pages properly
http://saveie6.com/
How is IE conceputually more secure than Chrome. They have sandboxing for each window too,
Please elaborate or I will call your post Redmond Propaganda.
They also claimed "the new Windows 7 kernel has been totally rewritten". Then a few months later we learn about exploits "which affect all Windows versions from Win3.1 to Windows 8".
The Redmonders are habitual liars and when they talk about the weather you better don't believe what they say.
...this sort of thing could never happen in the CSS parser/renderer and the html parser and rendering code.
But yeah, JS and its necessarily bloated base of C and C++ code (it needs ridiculous amounts of optimizer code to run just sufficiently fast) certainly made the day of more than one TLA.
If we had used some memory-safe Pascal variant, we could do this with probably 1/100 lines of C and C++ code. And it would be as fast as the JS crapola and their JIT compiler.
But hey, WE NEED EXPLOITS AGAINST THE TERROZERS ! And not to control the general populace, we really swear !
The entire software engineering community has been suckered into "C and Unix are the way to go" meme. IT folks also believe they are massively more smart than anybody else. Especially, they love to gloat about "military intelligence is an oxymoron".
Assessing the REAL WORLD, it seems though that military intelligence is running rings around the software engineering suckers, including the neckbeard suckers. Instead of memory safe Pascal we use the portable assembler C and then hand-wring about all the nasty-follow ons. Every time again. And again. And one more time.
Never do we act like MEN and kick the C dreck out. We never ask Niklaus Wirth and CAR Hoare for their advice. Instead we applaud when those Bell Labs idiots get a medal from the head of CIC of the military intelligence folks.
We are actually DUMB FUCKS who don't realize for which "achievement" the Bell Labs idiots got their medal.
See subject: Keyword = identified. Worst ones aren't. For those of you "naysayers" out there? It's fairly obvious you've NEVER written a piece of software (or you're just bitching to bitch, OR you're fans of some other OS etc. - et al).
Why do I say that??
Well (since I've been writing software since 1982 here for MANY platforms from mainframes & midranges down to PC's) - It's HOW SOFTWARE EVOLVES & IMPROVES... it's not static + perfect "out of the gate" (especially if/when it's a larger/complex program) - worse when it's a largely used piece of software (like IE is since it's the default browser in the largest used OS there is) that has TONS of 'bad guys' (& in SOME cases 'good guys' too) targetting it for the express purpose of FINDING BUGS that are exploitable (remotely especially).
APK
P.S.=> Again, see subject - these issues are not the problem. It's the ones we DON'T KNOW ABOUT that are - this, then (that all "said & aside") is a GOOD thing, & MS will patch for it shortly enough since it HAS been id'd... apk