Another MS Internet Explorer Security Hole 18
chkorn writes "Michal Zalewski detected another security issue in Microsoft's Internet Explorer. With a well formed FRAME or IFRAME tag a Buffer Overflow happens and you can execute bad code on the stack.
In his announcement on Bugtraq, he added a proof of concept and explained that all Internet Explorer 6.0 versions are affected, except Windows XP SP2 installations."
Foresight? (Score:1)
Re:Foresight? (Score:2)
AKA NX.
Chris
implementation (Score:5, Informative)
I tried it on Mozilla 1.7.3 and it freezes it for about a minute, and then unfreezes and shows a blank IFRAME.
If you want to try it w/o extracting and all that stuff, click here [chrisbenard.net].
Chris
Re:implementation (Score:2)
Another MS security hole... (Score:2, Insightful)
I think this artificially inflates Linux et al.'s security record to some degree, as Linux / other OSs administrators are more likely to be up to date, being generally more technically savvy.
Re:Another MS security hole... (Score:4, Interesting)
Yes, but isn't that one of Microsoft's main selling points with Windows, that users don't need a clue, just run it and MS takes care of the rest, the great Toaster Oven of operating systems?
"How hard is it to turn on Windows Update..."
Most of the Windows users I run into who aren't updated are afraid to update because the last time they tried that it hosed their systems. Some few have never heard of Windows Updates.
"...Linux / other OSs administrators are more likely to be up to date..."
Well yeah, but some of us are just plain lazy too. *inn*
Ciao.
Re:Another MS security hole... (Score:1)
THAT is why it is unfeasible.
Actually I'd be interested to hear from other sysadmins who do this successfully. What's the best way to keep a network of about 20 Wintel PCs updated off a 256kbps pipe?
Re:Another MS security hole... (Score:2)
not so important these days (Score:4, Informative)
SP2 is meant to stop this kind of stuff happening. People are installing SP2.
This is good, and a step forward - in a few weeks it's looking like it'll be over 50%.
I don't mean to winge, but pre-SP2 security holes don't seem newsworthy to me...
(* the company I work for runs tracking/surveying code on lots of UK commercial/retail web sites - we're seeing 3-5% per week increase in SP2 traffic, last week it went over 30% of total traffic)
Re:not so important these days (Score:2)
Re:not so important these days (Score:2)
but I don't think it's a reason for more MS-bashing and more IE-bashing for another hole in an old version of a browser. Newer versions are not vulnerable and people are deploying the newer versions at a substantial rate.
Yes it is [yet another] vulnerability, but it's not another 'all IE users get rooted' one.
<nitpicking> - the article says IE6 - so presumably not IE 5 and earlier; so the vulnerable portion is 50% rather than 70%. </nitpicking>
Re:not so important these days (Score:2)
Re:Hmmm... (Score:4, Interesting)
Just sticking your head in the sand and saying people should patch their systems is not going to help when MS has decided that the features of IE on XP SP2 are not going to be back ported to IE on other platforms. If anything, this can only drive more people into the arms of Firefox et al.
FIREFOX (Score:1)
If you ask me IE is like swiss chese full of holes and leaves a bad taste in your mouth
Well... (Score:1)
D. Admin Rights Needed To Load and Play On Windows(r) 2000 or XP
If you are running Windows(r) 2000 or Windows(r) XP, you must have Administrator rights to properly install and play the game.
One of the biggest security 'Don'ts' is to run applications without access restric