*another* severe IE security vulnerability found

can't wait 'till second Tuesday for MS to fix

[amznVibe]

Here we go again, fully patched systems, even with SP2 allow this bug to slip through:

[secunia.com...]

The vulnerability is caused due to insufficient validation of drag and drop events issued from the "Internet" zone to local resources. This can be exploited by a malicious website to e.g. plant an arbitrary executable file in a user's startup folder, which will get executed the next time Windows starts up.

Microsoft officially will only release patches every 2nd Tuesday of the month. That's almost a full 30 days away. Save yourself some pain, switch to FireFox, Opera, etc.

[Hester]

Disgusting.

---

Solution:
Disable Active Scripting or use another product.

[bill]

Is this the same as this one [webmasterworld.com]? I thought that one had been debunked?

Then again I don't use IE... ;)

[amznVibe]

Nope it's a whole new one. And yes, it does affect sp2 patched PCs.

90%+ of IE's problems are because of OS integration and active-x. SP2 can't fix that.

[MatthewHSE]

Is it just my imagination, or is XP buggier than W2K? Somehow W2K doesn't seem to be getting as much attention as XP.

[encyclo]

Some Friday fun for IE users!

How to crash Internet Explorer (and therefore Windows) in 11 bytes!

Step 1:

Create a file with just the following markup, and save it as

test.html

(or whatever):

[b]<style>@;/*[/b]

Step 2:

Open the file in IE. Kaboom! That's all, folks. I think it still works in SP2, but I'm not sure.

[Lord Majestic]

What disgusts me is that you can't easily reinstall whole IE - after installing Microsoft VS 2003 it installed some patches to IE which completely stopped JavaScript from working even though its enabled. Tried to reinstall - complains newer version is installed, wont give option. Faking registry to make it believe its uninstalled (as Microsoft suggested) is not good enough.

After wasting few hours I moved to Firefox both at home and at work and feel no regrets.

[Stefan]

Yep, that's very effective, encyclo.

It's interesting to then open it in Firefox.... you get some gobbeldy-gook but it sure doesn't crash.

[mattglet]

encyclo-

Being an Opera user, that is absolutely hilarious. I saved the page on our dev server, and had a co-worker try it out.

"What the hell did you just do?"

Too funny.

[isitreal]

I ran that on IE 5.5 and it didn't do anything, oh well, guess it's an IE 6 thing? Glad I never switched to 6, I only use 6 for testing, on another platform.

[Hester]

Why?

[DrOliver]

I can't even save the file encyclo suggested. The moment I am saving it, off it goes. Nowhere to be found on the hard-drive. So I cannot even crash IE with it. The file disappears the moment I am saving it, without a chance of opening it in any application.

Funny. It doesn't even say goodbye when it does that. Just *poof* and gone. Well, actually, not even *poof*. Just gone.

[benihana]

do you have AV software running?

as soon as i tried to save , McAfee deleted it.

[Receptional Andy]

Why?

If the question was why does that code crash IE, then a pretty good explanation is here - [seclists.org...]

[DrOliver]

do you have AV software running?

Yes, of course.

as soon as i tried to save , McAfee deleted it.

That might be it for me too.

[StupidScript]

Those of you who regret "updating" to IE6, or are having problems with some of the patches you've installed since "upgrading" can often do one of a couple of things to get back in the groove:

1) XP users can "rollback" their system to pre-IE-update condition and start over

2) In Add/Remove Programs, when you select IE to uninstall, it offers to "rollback" to the previous version, if you have kept the files required to do so...which you should always do for at least one generation of MS releases...just in case.

I know on several systems, installing the IE6 "upgrade" and then returning to windowsupdate produces lots of errors with the MS site. To fix it, you've got to do the "rollback" thing, install the rest of the security updates, set your security to low-medium, and THEN try the "upgrade". That usually works, for those who can't do without IE.

Very happy with Firefox, thenk ewe. I'll take modularity over integration in any situation where it is not absolutely necessary...and this is clearly one of those instances.

[Adrian2k4]

@encyclo

I tested it with IE 6.0.2900.2180.xpsp_sp2_rtm.040803-2158 (note WinXP Pro SP2) and it didn't work.