| ActiveMac | Anonymous | Create a User | Reviews | News | Forums | Advertise |
|
|
|
User Controls |
|
New User |
|
Login |
|
Edit/View My Profile |
|
|
|
|
|
|
|
ActiveMac |
|
Articles |
|
Forums |
|
Links |
|
News |
|
News Search |
|
Reviews |
|
|
|
|
|
|
|
News Centers |
|
Windows/Microsoft |
|
DVD |
|
ActiveHardware |
|
Xbox |
|
MaINTosh |
|
News Search |
|
|
|
|
|
|
|
ANet Chats |
|
The Lobby |
|
Special Events Room |
|
Developer's Lounge |
|
XBox Chat |
|
|
|
|
|
|
|
FAQ's |
|
Windows 98/98 SE |
|
Windows 2000 |
|
Windows Me |
|
Windows "Whistler" XP |
|
Windows CE |
|
Internet Explorer 6 |
|
Internet Explorer 5 |
|
Xbox |
|
DirectX |
|
DVD's |
|
|
|
|
|
|
|
TopTechTips |
|
Registry Tips |
|
Windows 95/98 |
|
Windows 2000 |
|
Internet Explorer 4 |
|
Internet Explorer 5 |
|
Windows NT Tips |
|
Program Tips |
|
Easter Eggs |
|
Hardware |
|
DVD |
|
|
|
|
|
|
|
Latest Reviews |
|
Applications |
|
Microsoft Windows XP Professional |
|
Norton SystemWorks 2002 |
|
|
|
Hardware |
|
Intel Personal Audio Player 3000 |
|
Microsoft Wireless IntelliMouse Explorer |
|
|
|
|
|
|
|
Site News/Info |
|
About This Site |
|
Affiliates |
|
ANet Forums |
|
Contact Us |
|
Default Home Page |
|
Link To Us |
|
Links |
|
Member Pages |
|
Site Search |
|
Awards |
|
|
|
|
|
|
|
Credits |
 |
Microsoft Rocked by New IE Zero-Day Flaw Warning | |
|
||
| Time: 00:00 EST/05:00 GMT | News Source: eWeek | Posted By: Michael Dragone | ||
|
Barely two weeks after shipping an Internet Explorer security makeover to cover a wave of drive-by malware downloads, Microsoft is scrambling to address the public disclosure of a new zero-day vulnerability that could be used in code execution attacks.
The Redmond, Wash. software maker confirmed it was investigating a warning posted on the Full-disclosure mailing list that the latest versions of IE causes various types of crashes when visiting Web pages with nested OBJECT tags.
| ||
|
Write Comment
Return to News |
Displaying 1 through 25 of 217 Last | Next |
The time now is
7:29:58 PM
ET.
Any comment problems? E-mail us |
| #1 By 15406 (216.191.227.68) at 4/26/2006 9:36:28 AM |
|
If there's a rumour you can count on, it's a rumour about a major security flaw in IE.
|
| #2 By 3653 (68.52.143.149) at 4/26/2006 10:15:55 AM |
| latch, you are far more reliable, but for different, sadder reasons. |
| #3 By 32132 (64.180.219.241) at 4/26/2006 11:29:38 AM |
|
The Firefox zero day exploit has more potential for exploitation ... its nice to see Firefox try to keep up with IE (and in the case of the 21 hole day, surpass IE in volume of critical holes)
http://www.informationweek.com/security/showArticle.jhtml?articleID=186700930&subSection=Viruses+and+Patches "A zero-day vulnerability in a fully-patched and most-current version of Mozilla Corp.'s Firefox could be exploited to crash the browser at the least, and at the worst, possibly introduce malicious code, a security company warned Tuesday." |
| #4 By 32132 (64.180.219.241) at 4/26/2006 11:33:49 AM |
|
I know eWeek hates Microsoft these days, but aren't they doing a disservice by claiming "Microsoft Rocked ... " and then totally ignoring a more serious zero day exploit for Firefox on their "Security" page?
|
| #5 By 15406 (216.191.227.68) at 4/26/2006 11:45:10 AM |
| #5: Secunia rated it a low-risk bug. How is that more serious than the usual IE "own your box" hole? |
| #6 By 32132 (64.180.219.241) at 4/26/2006 11:50:15 AM |
|
#6 From the link I posted:
"Although Danish vulnerability tracker Secunia ranked the threat as "low," its weakest warning, U.S.-based security vendor Symantec said the danger may be more dire. "It does appear that triggering the vulnerability using the proof of concept results in the execution of data somewhere in anonymous memory, possibly in a portion of the heap," Symantec told customers of its DeepSight threat alert system Tuesday. "If this memory were somehow populated by an attacker with a malicious payload, this condition could likely be exploited to execute arbitrary code." " This post was edited by NotParker on Wednesday, April 26, 2006 at 11:50. |
| #7 By 32132 (64.180.219.241) at 4/26/2006 11:54:28 AM |
|
I see Firefox has made the big time:
http://www.itnews.com.au/newsstory.aspx?CIaNID=31952&src=site-marq "A dirt-cheap, do-it-yourself hacking kit sold by a Russian website is being used by more than 1,000 malicious websites, a security company said on Monday. Those sites have confiscated hundreds of thousands of computers using the "smartbomb" kit, which sniffs for seven unpatched vulnerabilities in Internet Explorer and Firefox, then attacks the easiest-to-exploit weakness. For US$15 to US$20, hackers can buy the "Web Attacker Toolkit," said San Diego-based Websense in an online alert. The tool, which uses a point-and-click interface, can be planted on malicious sites - or on previously-compromised computers - to ambush unsuspecting users. "It puts a bunch of code on a site that not only detects what browser the victim is running, but then selects one of seven different vulnerabilities to exploit, depending on how well patched the browser is," said Dan Hubbard, senior director of security and research at Websense. Both Firefox and Internet Explorer vulnerabilities are among the seven." May I suggest to anyone running a browser, use the Sysinternals psexec safety feature: http://www.sysinternals.com/blog/2006/03/running-as-limited-user-easy-way.html |
| #8 By 20505 (216.102.144.11) at 4/26/2006 3:40:19 PM |
|
gents,
maybe i'm missing something but isnt the bar for security much higher for ie than firefox for the simple reason that ie is so closely linked to the underlying os? |
| #9 By 32132 (64.180.219.241) at 4/26/2006 4:22:16 PM |
|
#9 Can you give me an example of how a compromised IE is worse than a compromised Firefox?
The one obvious one I can think of is, because the IE engine can be run by multiple applications, there are more attack vectors (such as Outlook) is somewhat true ... except for the fact that almost all Firefox vulnerabilities are in Thunderbird as well. What seems to be true now, is that Firefox is a way of compromising Linux and OS X as well as Windows since many of the Firefox vulnerabilities are cross platform. Of course, the argument that Firefox fixes its flaws quicker is kind of moot since they are still keeping most of the secret on bugzilla. Go ahead and look some of them up and you'll find: Exploit code and details embargoed during the active update period ZDI does have more info on some: 2 months: http://www.zerodayinitiative.com/advisories/ZDI-06-011.html 2.5 months: http://www.zerodayinitiative.com/advisories/ZDI-06-010.html 5 months: http://www.zerodayinitiative.com/advisories/ZDI-06-009.html What I find fascinating is this statement on the last one: "TippingPoint IPS customers have been protected against this vulnerability since December 13, 2005 by Digital Vaccine protection filter ID 3977. For further product information on the TippingPoint IPS: " So hackers who subscribe to this "service" had 5 months to exploit it in the wild before Firefox fixed it? Scary! This post was edited by NotParker on Wednesday, April 26, 2006 at 16:27. |
| #10 By 3653 (68.52.143.149) at 4/26/2006 7:40:27 PM |
|
> hackers who subscribe to this "service" had 5
> months to exploit it in the wild before Firefox > fixed it? firefox was too busy creating marketing campaigns to be troubled with fixing long-standing security holes. |
|
Write Comment
Return to News |
Displaying 1 through 25 of 217 Last | Next |
The time now is
7:29:58 PM
ET.
Any comment problems? E-mail us |
