Welcome to WebmasterWorld Guest from 54.167.40.25

Forum Moderators: bill

Message Too Old, No Replies

New Internet Explorer Vulnerability Posted on Web

No patch available at this time

     
1:37 pm on Sep 15, 2006 (gmt 0)

Administrator

WebmasterWorld Administrator rogerd is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Aug 2, 2000
posts:9685
votes: 0


Computer code that could be used to hijack Windows PCs via a yet-to-be-patched Internet Explorer flaw has been posted on the Net, experts have warned.

The code was published on public Web sites, where it is accessible to miscreants who might use it to craft attacks on vulnerable Windows computers. Microsoft is investigating the issue, the company representative said in a statement Thursday.

Microsoft says that Windows users should disable ActiveX and active scripting controls.

Attack code targets new IE hole [news.com.com]

1:54 pm on Sept 15, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Sept 19, 2000
posts:2499
votes: 22


Gee I'm glad I have a Mac! ;)
2:24 pm on Sept 15, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:June 2, 2003
posts:1184
votes: 0


Microsoft says that Windows users should disable ActiveX and active scripting controls.

The Microsoft Security Respose Advisory # 925444 indicates the following.

At Risk:
Microsoft Internet Explorer on Windows 2000 Service Pack 4, on Windows XP Service Pack 1, and on Windows XP Service Pack 2.

Not At Risk:
Customers who are running Windows Server 2003 and Windows Server 2003 Service Pack 1 in their default configurations, with the Enhanced Security Configuration turned on, are not affected.

4:04 pm on Sept 15, 2006 (gmt 0)

Full Member

5+ Year Member

joined:Feb 15, 2006
posts:201
votes: 0


For those who still don't know, there is a new browser in town called Mozilla Firefox.
Well, not so new, but so much better...
What are people waiting for?
7:15 pm on Sept 15, 2006 (gmt 0)

Administrator

WebmasterWorld Administrator rogerd is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Aug 2, 2000
posts:9685
votes: 0


Today's Firefox security update [webmasterworld.com]. ;)

Any software that achieves significant market acceptance will be subject to hack attempts.

6:42 pm on Sept 16, 2006 (gmt 0)

Junior Member

5+ Year Member

joined:Sept 12, 2006
posts:140
votes: 0


The difference is the Firefox update is a fix to a potential hole while IEs announcement is an unpatched hole.

In addition, from what I'm reading, popularity or high usage of a product does not indicate it will automatically become a target for abuse.

10:35 pm on Sept 17, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Apr 25, 2005
posts:677
votes: 0


Firefox has had a security update as well
4:28 am on Sept 18, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member powdork is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Sept 13, 2002
posts:3346
votes: 0


Whats important is not whether you are safe, but whether or not the general public actuallly does disable activeX controls. This has rather huge implications for any flash websites or content.
1:30 pm on Sept 18, 2006 (gmt 0)

Administrator from JP 

WebmasterWorld Administrator bill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month Best Post Of The Month

joined:Oct 12, 2000
posts:14487
votes: 49


If memory serves, I don't believe this is the first time we've been told to disable ActiveX on IE. I've had it explicitly turned off for quite some time. Only a select few trusted sites are allowed to run ActiveX on my machines.
3:26 pm on Sept 18, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member powdork is a WebmasterWorld Top Contributor of All Time 10+ Year Member

joined:Sept 13, 2002
posts:3346
votes: 0


At least half the websites I visit regularly are all flash or use flash extensively. Running without activeX is not an option. Firefox has been the answer for me for quite a while now. If Sirius would get their act together I would never use IE other than testing my own sites.

Their have been recommendations to turn off activeX several times in the past. It didn't seem too many people listened in the past.

12:59 am on Sept 20, 2006 (gmt 0)

Administrator from JP 

WebmasterWorld Administrator bill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month Best Post Of The Month

joined:Oct 12, 2000
posts:14487
votes: 49


The whole Internet security system is set up on Windows so that you can allow ActiveX for those sites you regularly visit but deny it for everywhere else. That's the way I've been using IE since the first time they had these problems. You just have to go through the process of adding those sites to the appropriate security group once. After that you're a bit more secure.
3:42 pm on Sept 24, 2006 (gmt 0)

Senior Member

WebmasterWorld Senior Member 10+ Year Member

joined:Mar 31, 2003
posts:1316
votes: 0


Some experts believe the timing of the new attack is no coincidence, suggesting that attackers look to take advantage of a full month before Microsoft is scheduled to release its next bunch of fixes.

And the reason why they can't release a patch in mid-month?
2:01 am on Sept 25, 2006 (gmt 0)

Administrator from JP 

WebmasterWorld Administrator bill is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month Best Post Of The Month

joined:Oct 12, 2000
posts:14487
votes: 49


They can, and sometimes do issue patches outside of the regularly scheduled Patch Tuesday. If this vulnerability is being actively taken advantage of on the net you can probably expect to see a patch sooner.