Forum Moderators: open
The flaw allows malicious code to be loaded onto the machines of Windows XP users, even though they may have installed the XP Service Pack 2 security software.It opens a machine to hackers even though a user has not completed any action - they simply have to visit a web page containing the rogue code.
Danish security company Secunia has upgraded a security warning on a flaw in Internet Explorer 6.0, to "extremely critical".The flaw allows malicious code to be loaded onto the machines of Windows XP users, even though they may have installed the XP Service Pack 2 security software.
Worse yet, Microsoft is "working on" a patch. Look at the solution Secunia offers [secunia.com] for now:
Solution:
Use another product.Alternative workarounds:
1) The vendor recommends that the "Drag and drop or copy and paste files" option is disabled.
2, 3) Set security level to high for the "Internet" zone.
Best to switch to a different browser until Microsoft comes up with a patch...
But, more to the point of the thread. The wife just enrolled in a lon distance education class that is using some app that requires IE.
I had finally weaned the entire family off of IE and removed it from the machines. :(
WBF
Secunia has constructed a test, which can be used to check if your browser is affected by this issue:http*//secunia.com/internet_explorer_command_execution_vulnerability_test/
How safe is the test? ;)
[ftc.gov...]
If so, I didn't realize that this 'new' issue is the same security hole.
Last Update: 2005-01-07
---------------------------------------------------
This news is 3 days old.
Only one sources opinion with motives unknown.
The link to test ones browser now does not work.
And when it did it did not work as we were told.
Yet this topic gets front page billing on WebmasterWorld followed by a microsoft bashing led by an administror of these boards. Need I remind you the current state of "computing" would not exist were it not for microsoft. These boards used to be better than this.............................
Best stick to the facts rather then emotion, rumor, and innuendo.
However:
Nathan Mercer, technology specialist at Microsoft New Zealand, confirmed that three patches will be released tomorrow morning, NZ time. However, Mercer was unable to say whether the patches cover the Internet Explorer-related issues reported by Secunia.
Goes to figure I guess about the Microsoft IE 6 SP2
I am neither for or against various systems as a whole.
Although our eventual transition to the firefox is a result of some of the security issues related to the explorer.
As far as the explorer and it's luke warm security, I and the rest of us here don't have a lot of time to spend on fixing things, so the windows is shut off due to the much better security that Symantec offers us.
I did have a real good go at a security breech the other day on one of our older, much less used machines in the back office. (not a part of our network) It was a grand thrill to get after it.
I beat the living daylights out of the thing.
It's been so long since I have had to get into the registry files on any machine, that it was like taking a good long springtime stroll for a change.
Yet this topic gets front page billing on WebmasterWorld followed by a microsoft bashing led by an administror of these boards. Need I remind you the current state of "computing" would not exist were it not for microsoft.
Um, that's true. For example the lack of rich apps on the Internet is caused by Microsoft destroying Netscape and then failing to develop the only viable browser for years. They did this on purpose because the Internet is a threat to their cash cow. Which is rich apps on the desktop.
The bias against Microsoft was not created in a vacuum. There are many reasons for it.
The show depicts the Netscape rush to put online the source code for their browser on March 31 1998.
According to the Code Rush credits, the "documentary" was co-written by G. Pascal Zachary, an anti-Microsoft New York Times journalist.
Nevertheless, I'm glad Code Rush was made available to the non-technical public. It helps them to clearly discern what's good and what's bad. What's trustworthy and what's not.
In regard to the latest flaw, I'm happy there's Windows Update at my fingertips to fix it.
But, it's getting silly now. I almost never use IE because of all these problems. Since switching to Firefox life has been so much easier. OK, great, MS have done a lot for computing but let's fact it, while there may be some debate about Windows itself, IE is a now a complete disaster.
It took me about ten minutes to create a variant that did whatever I wanted. I can execute any DOS command I want on a users machine from the homepage of my website with any click required.
This is the worst security hack I have EVER seen. Any user with XP and SP2 running IE is at very serious risk.
The link to test ones browser now does not work.
Best stick to the facts rather then emotion, rumor, and innuendo.
Best thing is to just use Firefox and switch all your family and friends to it ;)
How to completely delete IE from my machine? Isn't there some nice uninstall tool?
Several ;)
[fedora.redhat.com...]
[mandrakelinux.com...]
[ubuntulinux.org...]
[suse.com...]
etc.
Also: [apple.com...] if you prefer.
I moved exclusively to Linux nearly 2 years ago, and I would never go back. All browsers have bugs and problems, IE and Firefox included, but it is the tight integration with the underlying operating system which makes IE vulnerabilities much, much more dangerous. This is a fundamental, deliberately-introduced design flaw in Windows, that no level of patching of the browser is truly going to resolve.
I just installed it and the exploit's test page doesn't work now (it did previously).
time to go roll out on all the systems in the office...
As for IE vs. Firefox vs. Opera vs. whatever in terms of security, there are other issues besides OS integration that make some browsers safer than others. Defect rates increase exponentially with code size, for example. I'd be curious to know how many lines of code are executed as part of IE and various libraries and controls that execute on its behalf. Those browsers that are Open Source also have an advantage in that the code gets looked at by far more people. Code review catches a higher percentage of bugs than testing does.
Running the test page in Win98SE with an unpatched (although otherwise up to date) IE6 with security settings set to "prompt" or "disable" for all ActiveX settings:
I get either a notice that "..browser settings do not allow ActiveX controls...may result in incorrect page display..." or a security warning to download and install Secunia's "hhctrl.ocx" object.
In addition, BOTH temporary pages Secunia sends to the cache contain the "Exp/Phel-A" virus.
Virus aside, without the ActiveX control, the test fails. It looks like a Javascript error in the test itself. Perhaps with the ActiveX control loaded, the test works as intended. I'm not going to find out ...
I think I'll stick with Firefox and Sophos Antivirus.
:)
Jennifer
Um, that's true. For example the lack of rich apps on the Internet is caused by Microsoft destroying Netscape and then failing to develop the only viable browser for years. They did this on purpose because the Internet is a threat to their cash cow. Which is rich apps on the desktop.The bias against Microsoft was not created in a vacuum. There are many reasons for it.
I wouldn't really say Microsoft's cash cow is rich desktop apps. Microsoft's cash cow is enterprise level liscencing, and partnerships with companies like dell to put windows on every new computer they ship.
I mean, think about it. How many individuauls do you know that have actually gone out and bought Office, or VisualStudio, or some other high-end product like that?
Now, how many big companies are there out there that buy insane liscencing packages to put Office on 5000 machines at a time, or put VisualStudio on the machines of 100 developers, or Windows Server on an entire farm of servers. Not to mention the whole "microsoft certified technology provider" thing - which basicly just means somebody shelled out a handful of cash to get a copy of a .gif to put on thier site.
To say the internet is a threat to a company like microsoft, is - silly at best. Stupid people are the biggest hinderance to the advancement of technology - by far. Be it internet or otherwise. Not companies like MS. Until people remove thier heads from the other parts of thier body, and get with the program, mainstream society will always be 10 steps behind, and thus technology will be choked by peoples' inability to use it.
I am quite pleased that MS got a patch out so quickly for this issue. It really worries me when the knuckleheads who exploit holes get too much of a head start.
