Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

IE7 Vulnerability Discovered

Posted by CmdrTaco on Thu Oct 19, 2006 10:00 AM
from the that-didn't-take-long dept.
Internet Explorer The Internet
slidersv writes "Not 24 hours after the release of IE7, Secunia reports Internet Explorer Arbitrary Content Disclosure Vulnerability. So much for the "you wanted it easier and more secure" slogan found on Microsoft's IE Website."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

IE7 Vulnerability Discovered 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • two words (Score:5, Funny)

    by doti (966971) on Thursday October 19 2006, @10:01AM (#16501617) Homepage
    ha ha

  • IE7 Vulnerability Discovered (Score:5, Funny)

    by Rik Sweeney (471717) on Thursday October 19 2006, @10:04AM (#16501669) Homepage
    In a very motherly voice:

    Oh Microsoft, what are we going to do with you, eh?

  • Browsers are just too complex (Score:5, Insightful)

    by cliffski (65094) on Thursday October 19 2006, @10:05AM (#16501675) Homepage
    Thats the root of the problem. I'd wager 90% of the functioanlity for browsers is only used by 5% of end users. Granted a lot of stuff is demanded by web develoeprs who want fancy this, animated that, and sliding and fading the other, but to be honest, most of us dont need any of that junk.
    As end users, how much of browser bloat do we really need?
    I think there was a slashdot story asking for feature requests for firefox recently. my main request is this please:

    less of everything

    Its already at the case where im starting to notice how long it takes firefox to start. Sometimes more features does not mean better. Its like anything, cars, mobile phones, TVs, they all have major feature bloat.
    I found it actually impossible to buy a new mobile *without* internet access. Its insane. i remember when you didnt have an animated 'startup' screen for your phone, because the damned things just switched on.

    Feature bloat -> just say no :D

    • Re:Browsers are just too complex (Score:5, Funny)

      by Goaway (82658) on Thursday October 19 2006, @10:08AM (#16501743) Homepage
      Here's your porch, here's your chair, and here's your lawn. Now repeat after me, "DAMN KIDS! GET OFFA MY LAWN!"

    • Re: (Score:3, Interesting)

      by truthsearch (249536)

      The vulnerability is caused due to an error in the handling of redirections for URLs with the "mhtml:" URI handler. This can be exploited to access documents served from another web site.

      The only reference I could find to an mhtml URI through google (which isn't a vulnerability report) is for HTML email. I've generated multi-part MIME email content and never once came across this type of URI. So if someone could elaborate on why this feature even exists it would be helpful.

    • Re:Browsers are just too complex (Score:5, Interesting)

      by hey! (33014) on Thursday October 19 2006, @10:15AM (#16501867) Homepage Journal
      Thats the root of the problem. I'd wager 90% of the functioanlity for browsers is only used by 5% of end users.

      I don't think this is the case, because for the most part users don't choose which broswer features they use; web sites do that for them.

      However, I think the web development model is far too complex, which both causes site developers to create security holes in their applications, and creates many places for security holes to exist in the browser itself.

    • Re:Browsers are just too complex (Score:5, Insightful)

      by acvh (120205) <geek AT mscigars DOT com> on Thursday October 19 2006, @10:16AM (#16501903) Homepage

      While I agree with your No Bloat argument, you neglected an oft overlooked reason that IE contains all these "features", and it's not web developers. It's application developers. There are a slew of vertical market applications that many small to midsize companies are using, where the developer has dropped, or maybe never had, its own user interface, in favor of using IE and ActiveX controls. Insurance brokerages, medical practices, law firms and more, all of them have large, commercial, expensive applications available to them for running their businesses, and many of them are IE based. IE in these cases is just the front end to data stores running on everything from SQL Server on Intel to AIX on Power to whatever. Many times with no Internet connectivity at all.

      MSFT can't just disable, drop or change these features, because doing so could break an enter business. So they just pile up more and more code into an already chaotic program.

    • Helllloo? (Score:5, Insightful)

      by thepotoo (829391) <thepotoospam@y3.1415926ahoo.com minus pi> on Thursday October 19 2006, @10:22AM (#16501981)
      Last time I checked, Firefox was open source. You are more than welcome to fork the project and make a "lite" version. I would probably give it a try.

      But, don't forget that if you strip away too much, you'll end up with Lynx. Some people like at least images and css, you know?

    • Thats the root of the problem. I'd wager 90% of the functioanlity for browsers is only used by 5% of end users.

      You would lose that wager. 80%+ of the technology that makes web browsers tick is required just to show you a blasted web page. The standardized APIs allow a good way for JavaScript to then make those pages interactive. Not too many sites are JavaScript-free these days.

      What I think you're trying to say, is that features above and beyond the W3C standards are:

      1. Not useful
      2. Poor attempts at lockin
      3. Dangerous

      If Microsoft would just stick to the bloody standards, we'd all be better off. Unfortunately, they're still in 1995 mode, trying to beat Netscape at their own propertization game. It wouldn't surprise me if the requests for DOM 2 Events support were STILL ignored in this "final" release of IE7. *grumble* And Microsoft thinks developers will like them because of this?

      • Re:Browsers are just too complex (Score:4, Insightful)

        by cliffski (65094) on Thursday October 19 2006, @11:14AM (#16502941) Homepage
        hang on, my dad has a Razor phone, thats exactly the kind of thing I didnt want. thats bloatware extreme. I dont want web acecss, or even the option for it, or the buttons for it, or anything. Not a camera, not a microphone, nada. zip.
        I just want a phone. to make and recieve calls. I dont even text.

        I know I know, Im old.

  • Old exploit (Score:5, Informative)

    by Iphtashu Fitz (263795) on Thursday October 19 2006, @10:06AM (#16501695)
    This exploit exists in IE6. It just means MS didn't fix it in IE7. It's not like it's a new exploit that was quickly discovered within the few hours after IE7 was released.

    • Re: (Score:3, Funny)

      by kfg (145172)
      So, what you're saying is that Bill's dog ate the patch?

      KFG

    • Re:Old exploit (Score:5, Interesting)

      by abaddononion (1004472) on Thursday October 19 2006, @10:15AM (#16501887)
      This exploit exists in IE6. It just means MS didn't fix it in IE7. It's not like it's a new exploit that was quickly discovered within the few hours after IE7 was released.

      To me, at least, that's kind of the point. I mean, this is an old old IE6 bug, that M$ has known about for a certainly reasonable amount of time. Yet, they still haven't fixed it. And not to say it's a big deal that they haven't fixed it in IE6 yet. It's not like it's a Critical Priority bug (no pirates can steal Windows or MP3s because of it). But they point is, they did their whole "We heard you" campaign, and claimed IE7 was going to be this great new secure landscape... and they didn't even clean up the old IE6 bugs they KNEW about? I mean, seriously, at this point are we supposed to believe that they're even trying?

    • Re:Old exploit (Score:5, Insightful)

      by Overly Critical Guy (663429) on Thursday October 19 2006, @11:01AM (#16502709)
      Well, you could argue that it was quickly discovered to still exist in IE7. Interestingly, this vulnerability contradicts claims that IE7 is a rewrite. Clearly, it is not.

    • Using Vista RC1 (Score:5, Interesting)

      by Utopia (149375) on Thursday October 19 2006, @11:18AM (#16503015)
      The Secunia test says I am not vulnerable with Vista RC1

      Vista RC1 was released almost a month ago.
      So I am surprised this new XP IE7 build still exibits this issue.

      Looking at the source, I suspect this is not a IE issue at all, instead this is a MSXML issue.
      Vista has anewer version of MSXML.
      XP IE7 seems to be using the older version.

       

  • Misunderstanding (Score:5, Funny)

    by MrSquishy (916581) on Thursday October 19 2006, @10:06AM (#16501699)
    Maybe the line should read "You wanted it easier AND more secure?".

  • Let's be fair (Score:5, Informative)

    by Lars T. (470328) <Lars.TraegerNO@SPAMgooglemail.com> on Thursday October 19 2006, @10:07AM (#16501729) Journal
    The same problem is known on IE 6 since April 2006 [secunia.com]

  • Not much of a surprise (Score:3, Insightful)

    by Salvance (1014001) on Thursday October 19 2006, @10:08AM (#16501745) Homepage Journal
    This shouldn't be too much of a suprise ... how many software products are 100% bug free when released, particularly Microsoft's? Anyone who downloads or buys any software within the first few weeks is just asking for it ... and anyone who buys a Microsoft product within the first year is bound to have issues, whether security breaches or just annoying bugs.

  • News? (Score:3, Funny)

    by Treacharous (994718) on Thursday October 19 2006, @10:09AM (#16501759)
    Doesn't everyone use firefox anyway?

  • Come on (Score:3, Informative)

    by critter_hunter (568942) <critter_hunterNO@SPAMhotmail.com> on Thursday October 19 2006, @10:11AM (#16501803)
    It's a "Less critical" vulnerability - not really dangerous at all. Firefox still has equally important unpatched "vulnerabilities" [secunia.com] - some of which [secunia.com] date back to 2004 [secunia.com]. Retards.

        • Re:Come on (Score:5, Informative)

          by truthsearch (249536) on Thursday October 19 2006, @11:22AM (#16503069) Homepage Journal
          This IE hole requires no user interaction. Unlike the firefox bugs he links to a simple web page can leverage this IE hole with no extra user input. And considering the URI exploited is used within email I'd imagine Outlook is susceptable, too. So the firefox vulnerabilities mentioned are much less likely to be exploited than this IE hole.

  • Yawn. (Score:5, Funny)

    by Honest Olaf (1011253) on Thursday October 19 2006, @10:13AM (#16501847)
    Stretch. Scratch.

    Oh, an IE vulnerability? That's cool man.

    Hey, anyone want to get some lunch?

  • IE7 maybe not vulnerable? (Score:5, Informative)

    by jrsp (513795) on Thursday October 19 2006, @10:17AM (#16501915)
    IE7, freshly installed this morning, on XP SP2 reports not vulnerable. Perhaps it was already patched, or the exposure is more limited than the post implies...

    Not an MS fan, but truth and accuracy are always good.

  • There will always be issues (Score:4, Insightful)

    by Programmer_In_Traini (566499) <eniac0 AT gmail DOT com> on Thursday October 19 2006, @10:39AM (#16502291)
    People will always find something. When you got hundreds of thousands of people checking your software for whatever issue they can find, odds are that they WILL find something. Just because its fun to bash MS doesnt mean its feasible to create a software with zero vulnerabilitise, that's impossible, new vulnerabilites are created each weeks.

    I mind much less IE's security than IE's compliance to w3 standards. now THAT is annoying. having constantly to create two versions of your code. one for the compliant browsers and then one for IE.

    For some reason, the suits at MS thinks that because lots of people use their software they have a moral obligation to tell people what the standards should be. Ok...I know IE7 is not as bad... but its still bad :-)

  • So much for "more secure"? (Score:5, Funny)

    by Trillan (597339) on Thursday October 19 2006, @11:58AM (#16503647) Homepage Journal
    Dude, 24 hours is more secure for Internet Explorer.

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.