Slashdot Mirror
Microsoft Patches Remote Code Execution Hole for Internet Explorer
mask.of.sanity writes: Microsoft has released an out-of-band patch for Internet Explorer versions seven to 11 that closes a dangerous remote code execution flaw allowing attackers to commandeer machines. From their advisory: "An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Systems where Internet Explorer is used frequently, such as workstations or terminal servers, are at the most risk from this vulnerability." The attack could assist in watering hole and malvertising campaigns. The Windows 10 Edge browser is not impacted.
Wait, so IE6 isn't affected???
This bug has been around since IE 7? Wow, this just confirms that MS will only patch bugs once others find them and then they have to work on fixing them.
Most IEs, even the recent ones, suffer from this bug. MS revealing these long standing issues affecting IE... isn't it a good way to promote Edge, the new MS browser not affected by this bug?
Slashdot, fix the reply notifications... You won't get away with it...
isn't it a good way to promote Edge, the new MS browser not affected by this bug?
It certainly is. The update also probably goes ahead and downloads Edge for you, since they know you obviously need it. And since Edge only runs on Win10, the update probably downloads that for you, too. All part of the new Microsoft: patting you on the head and tucking you in at night.
Some companies simply can't migrate away from old software because of the nature of their business. I worked for a place that used a copy of JD Edwards (a godawful inventory management system from the 90s that was nearly sued into oblivion because of how buggy it was) that had last been patched in 1998, simply because they would have had to get authorization from the government to upgrade and that would have cost the company a bunch of money.
You shouldn't be running XP, It and IE6 are no longer supported, haven't been for well over a year now.
Ow. I think I hurt myself trying to make it through that post with a straight face.
I'm trying to teach myself to set people on fire with my mind... Is it hot in here?
I suspect this is how CryptoWall 3.0 is getting machines infected.
Life is not for the lazy.
And that matters how? Who cares if it isn't supported by MS anymore? It wasn't supported by MS when it was out there really. They only have ever done the bare minimum so it doesn't cut into their profits.
Like the first program I remove is IE.
As an early adopter of Firefox I hate to admit this, but modern versions of IE are now better than Firefox is.
Earlier today we learned all about vulnerabilities in Pocket, which as you may recall is part of the unwanted functionality that Mozilla forced on Firefox users earlier this summer.
At the end of last week we learned all about how Firefox makes unexpected HTTP requests when hovering over a link.
Earlier this month there was a very serious bug that allowed web sites to access the files of Firefox users.
Earlier this year we learned about ads built into Firefox.
The worst part about all of those stories is that they're just from this summer, and they're just the ones that Slashdot has bothered to report on!
XP is fine, but why use IE on XP anyways???
...all that is unholy.
" If the current user is logged on with administrative user rights , an attacker who successfully exploited this vulnerability could take complete control of an affected system."
When is MicroSoft going to get off their butts and fix their operating systems so that the first user is not defaulted to administrator rights or at least have the first user forced to make a 'normal' user account for normal usage? Even 'ancient' Linuxs only add the first user to sudoers so that they have to explicitly invoke rootly powers.
Windows will never be a reasonable operating system while MicroSoft panders to n00bs who don't know any better (and probably couldn't function) than to run with administrator access 24/7. How many of these problems could be mitigated if this were not MicroSoft's default approach?
A vast majority of their userbase can't handle the 'administrator account is only to do administration and normal account is for everything else' paradigm. I was impressed that normal users had a sudo-like function of asking a normal user for the admin password if they try to do admin-like things, but hate that the default first user is still an administrator and leaves most n00b users open to these kinds of exploits.
It doesn't seem all that hard to have the first user set an admin password but create a normal day-to-day account for general use.
@benjymouse: "When you invoke a program that has a manifest which states that it requires some form of administrative rights, Windows will prompt you for "elevated" privileges. Only when you accept to use your administrative privileges will the process be started with a token with higher than standard user rights. It really is a much more elegant solution than the stupid effective user in Linux."
..
$su -c command
Of course it is, in the same way that discovering that all the models of a car made by a certain company to date explode on impact makes me want to run right out and buy their slightly different newest model designed and manufactured by the same company.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
FTFY
Luckily, using buggy antiquated software that is unsupported and no longer receives security updates doesn't incur any cost / overhead at all!
It always baffles me to see incompetents who can't figure out that the most costly business move a company can make is to stagnate and refuse change with the times.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
Wouldn't the sandbox mechanism protect the user in more recent versions of IE?
The bare minimum is still support.
This bug has been around since IE 7? Wow, this just confirms that MS will only patch bugs once others find them and then they have to work on fixing them.
So, what's your point? IE 7 through to 11 use the same Trident layout engine so it stands to reason one security flaw could affect IE 7 through to 11. Heartbleed was in OpenSSL's source for 3.5 years & Shellshock was in BASH since 1989 before anyone found them. Bugs can exist in software for years whether they are open or closed source.
Patch not for Windows XP...
Because: fuck you, you are not paying us money.
No one supports a particular version of a thing they made until the end of time, not even GNU/Linux distros. It's not some sort of M$ is teh evil situation.
Better boot up my XP box and let it update, then!
Free Windows 10 at last! Woo-hoo!
It's IE6 and WinXP, neither which ever could be seen as not broke.
Yeah, but that doesn't matter. What matters is that this is Slashdot, and therefore whatever Microsoft does they're automatically Satan and must be derided.