Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Highly Critical Hole Found in IE 336

Posted by CmdrTaco from the must-be-thursday dept.
dotpavan writes "Eweek reports on a highly critical MS Internet Explorer hole found by Secunia Research's Andreas Sandblad. The vulnerability is due to the processing of the "createTextRange()" method call applied on a radio button control. From Secunia, "The vulnerability has been confirmed on a fully patched system with Internet Explorer 6.0 and Microsoft Windows XP SP2." The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview (January edition) though it could be avoided by turning off Active Scripting, as suggested by Microsoft Security Response Center blog. How would this put MS in the market, hit by the ever-growing shots of vulnerabilties? And would the divorce of IE7 from Vista's Windows Explorer help?"
This discussion has been archived. No new comments can be posted.

Highly Critical Hole Found in IE More

Highly Critical Hole Found in IE

Comments Filter:

  • Patch available (Score:5, Funny)

    by thrillseeker ( 518224 ) on Thursday March 23, 2006 @03:22PM (#14982380)
    here [mozilla.com]
    • That won't fix the problem completely. To complete the fix, iexplore.exe should be replaced with a program that runs firefox.exe instead.
      • You actually have to do alot more registry editing than that. I once went through and modified my machine to forward all references to the DLL and IE to firefox instead. Unfortunately I found out that the directory explorer actually IS explorer and that Outlook requires IE as well or it just won't work.

        They could have removed IE a long time ago but just decided NOT to.

    • mirror (Score:4, Funny)

      by eclectro ( 227083 ) on Thursday March 23, 2006 @03:38PM (#14982516)
      here. [opera.com]

      IE user, your house is on fire. Run for the hills! Go! Go!

    • Re:Patch available (Score:5, Insightful)

      by Stellian ( 673475 ) on Thursday March 23, 2006 @04:02PM (#14982711)
      Mozilla has bugs to. Lots of them. The difference, however is the time it takes to patch them.
      Folks like Secunia can profit only when the patch takes a long time to develop. As long as it is a secret vulnerability, it has value. This vulnerability is the perfect example: MS was notified about this on 13/02/2006, 40 days ago. They had all the opportunity to fix it in this month's security patch, but thy did not. So the patch will come no earlier than 2 months after discovery - that's a huge window of exposure.
      It was only when I have rediscovered the bug, and posted [seclists.org] an inquiry about it on the Full Disclosure mailing list, that Secunia rushed to finally publish the advisory. I must note that I did not develop the exploit independently, I simply piked it up on underground forums.
      I say this is not "responsible disclosure", and that it is *irresponsible* to keep a bug of this magnitude unpatched for 2 months. Because there is a high risk that it will be found by the bad guys in the meantime - just like it happened with this bug.

      --
      Stelian ENE

      • Re:Patch available (Score:4, Insightful)

        by weisen ( 461536 ) on Thursday March 23, 2006 @05:05PM (#14983322)
        I think that it's a matter of attitude, also. The referenced security blog says:

              We're going to continue to look into this but remind you also that safe browsing practices can
              help here, like only visiting trusted websites, etc.

        The idea that the user should be careful about which sites they browse to is insane. It's hard to imagine a corporate culture that thinks this way, if it's a pervasive attitude, ever producing a reasonably secure product.

        It's one thing to expect the user not to download an executable and then run it as Administrator. It's quite another to expect people to be "careful" which Google hits they click on.

  • Highly Critical Hole Found in IE? (Score:5, Funny)

    by Anonymous Coward on Thursday March 23, 2006 @03:24PM (#14982403)
    Must be thursday.

  • Perhaps it would save time... (Score:5, Funny)

    by Threni ( 635302 ) on Thursday March 23, 2006 @03:24PM (#14982406)
    ...if researchers just identified the bits that *weren't* totally insecure?

    • Re:Perhaps it would save time... (Score:2, Funny)

      by Anonymous Coward
      ...if researchers just identified the bits that *weren't* totally insecure?

      Come on, the RFC on this [faqs.org] is several years old!

      Damn networking hardware monopoly is hampering progress!

  • It is not a dupe! (Score:5, Funny)

    by Life700MB ( 930032 ) on Thursday March 23, 2006 @03:25PM (#14982410)

    It's a brand new hole!


    --
    Superb hosting [tinyurl.com] 20GB Storage, 1_TB_ bandwidth, ssh, $7.95

  • Hole? (Score:2, Funny)

    by jav1231 ( 539129 )
    Is it shaped like a woman's mouth? I mean, that's a highly critical hole.

  • Just (Score:2, Informative)

    by Eightyford ( 893696 )
    Just stop using activex.
  • Can't we just take it for granted that IE is just choc-full-o-holes, and these holes will always get discovered by some third party, and MS will eventually make a patch for it. Then lather, rinse, and repeat? Why do stories like this even make it to Slashdot anymore?

    • because (Score:5, Insightful)

      by dotpavan ( 829804 ) on Thursday March 23, 2006 @03:29PM (#14982450) Homepage
      .. MS will eventually make a patch for it..

      its the time period that sometimes makes it more panicky.

    • Slashthink. (Score:4, Informative)

      by Captain Scurvy ( 818996 ) on Thursday March 23, 2006 @03:58PM (#14982672)
      So collectivist nerds can sit and giggle self-contentedly to themselves when MS looks bad.

    • Why do stories like this even make it to Slashdot anymore?

      Why do they mod you flaimbait? This is a good question.

      1. Microsoft security problems are one of a handful of topics that appeal to the slashdot priesthood. It is really quite an ecclectic group: global warming, crank science, amateur space programs, criticism of the Bush administration... These are confortable subjects that reaffirm their views.
      2. This forum mainly came about to resist Microsoft and promote free software. It is interesting that ov
    • Can't we just take it for granted that IE is just choc-full-o-holes, and these holes will always get discovered by some third party, and MS will eventually make a patch for it. Then lather, rinse, and repeat? Why do stories like this even make it to Slashdot anymore?
      Get the facts:
      The Internet Explorer is a not so secret remote admin tool! (aka backdoor)

  • Do what now? (Score:5, Funny)

    by Rob T Firefly ( 844560 ) on Thursday March 23, 2006 @03:27PM (#14982438) Homepage Journal
    TFA: Microsoft plans to release a pre-patch advisory with workarounds for a "highly critical" vulnerability that could put millions of Internet Explorer users at the mercy of malicious hackers

    So this article updates us to the fact that they plan to update us with an article prior to the update?

  • Could be worst... (Score:5, Funny)

    by __aaclcg7560 ( 824291 ) on Thursday March 23, 2006 @03:29PM (#14982457)
    It could've been a very cynical hole in IE concerning when Windows Vista will finally be released.

  • How does this fare with previous statements? (Score:3, Insightful)

    by OneSeventeen ( 867010 ) * on Thursday March 23, 2006 @03:29PM (#14982458) Homepage Journal

    With security being #1 in IE7, and numerous IE7 articles published by both microsoft and non-microsoft advocates praising the security and reliability of the new MS Browser, can we conclude that even with their upcoming browser media hype is still the best feature?

    Personally, I understand if people don't want to use Firefox, it isn't the best browser either, no browser is the best across the board. I don't, however, understand why people want to continue to use Internet Explorer. It has been proven time and time again to be buggy, and patches take weeks longer than in most other browsers.

    Not being a hardcore developer myself, I don't know what causes this, but might this have been avoided if Microsoft adhered to the Javascript standards rather than "tweaking it" for IE?

  • Proof of concept (Score:5, Funny)

    by Anonymous Coward on Thursday March 23, 2006 @03:32PM (#14982471)
    <input type="radio" action="crash">
  • How would this put MS in the market, hit by the ever-growing shots of vulnerabilties?

    Come again?

  • got it backwards (Score:3, Funny)

    by gurutc ( 613652 ) on Thursday March 23, 2006 @03:34PM (#14982487)
    IE is the hole, into which are placed 'features' such as this exploit, tied to the feature called 'activex.' Remove these 'features' and all that is left is the nothingness that is a hole.

  • Use it for good not evil (Score:3, Funny)

    by slashbob22 ( 918040 ) on Thursday March 23, 2006 @03:34PM (#14982491)
    createText("install firefox.exe");
    createTextRange(-1);

    And just let the exploit install firefox. It's just that easy.
    • Sounds like you've been using Linux too long. To install software in Windows, you have to go to a website, download its "wizard" file, and click Next through a series of dialogs. It may be possible to compress that into a single line command in Linux, but probably not in Windows.

      Yes sir, Windows is much more secure than Linux in the area of Internet Explorer arbitrary code execution vulnerabilities!

  • divorce (Score:2, Funny)

    by Tachikoma ( 878191 )
    And would the divorce of IE7 from Vista's Windows Explorer help?
    maybe, but i still recommend divorcing windows entirely. i've loved computers before (not sexually ... you perverts!) but not until my power book did one love me back...

  • Dupe! (Score:3, Funny)

    by p0 ( 740290 ) on Thursday March 23, 2006 @03:39PM (#14982522)
    Dupe!

  • I am... (Score:4, Funny)

    by PFI_Optix ( 936301 ) on Thursday March 23, 2006 @03:54PM (#14982638) Journal
    ...Jack's complete lack of surprise.

  • IE 7 in Vista would have been safe (Score:5, Insightful)

    by ThinkFr33ly ( 902481 ) on Thursday March 23, 2006 @04:05PM (#14982748)
    IE 7, when run on Windows Vista, would not have fallen victim to this or any other exploit of this nature. The reason for this is the fact that IE 7 on Vista runs as a user with virtually no privileges, regardless of privileges of the user using IE 7.

    Essentially all actions that require higher privileges, such as writing to non-temp locations on the file system, executing applications, installing plugins, changing settings, etc, will be done through the use of a broker.

    The broker is very small, perhaps only a few thousand lines of code. This makes auditing the broker far easier than auditing the hundreds of thousands of lines in IE 7.

    When IE 7 wants to save a file to the user's desktop, for instance, it must first "ask" the broker if it can do this. The broker is written in such a way that all actions require the user to confirm this is OK via a dialog box. If the user says it's OK the broker completes the action on behalf of IE 7.

    If IE 7 has a buffer overflow or exploit of some kind and tries to do something nasty it will always fail because it is running as a user with basically no privileges on the system.

    There is a video that describes this in detail on Microsoft's Channel 9 [msdn.com] web site.

    • Re:IE 7 in Vista would have been safe (Score:4, Funny)

      by Tumbleweed ( 3706 ) * on Thursday March 23, 2006 @04:28PM (#14982949)
      This just goes to show that if you give MS enough time, they'll eventually be able to reinvent UNIX-like security. That's a relief.

      • Re:IE 7 in Vista would have been safe (Score:4, Insightful)

        by Tim C ( 15259 ) on Thursday March 23, 2006 @04:59PM (#14983246)
        How so? It's not uncommon for "special" system processes to need to be started as root but to give up the extra privileges as quickly as possible, but I have never heard of an "ordinary" user process switching to an even less privileged user account.

        Besides which, the security model in NT-based systems is much richer than that in Linux-based systems. Unfortunately a few poor design/marketing decisions and a generation of sloppy coders too used to 9x-based systems has gone a long way to obviate that advantage, as far too many people simply run with administrative privileges.

        That said, the clueless will always be a danger to themselves, whatever system they run.
        • the security model in NT-based systems is much richer than that in Linux-based systems

          I beg to differ, unless you qualify that with default. Even then, there is little difference in capability in actual practice, as you pointed out. The security model in Linux has almost always been as rich as you want it to be. Process and role based access control has been available and used in Linux for several years in systems where that level of control is desirable, and has even crept into default installations o

    • Some people dont worry about low priviledges remote vulnerabilities, even if there could potentially be local vulnerabilities that could scale your priviledges. Also, what could do your current user (supposing there are no local vulnerabilities) could be enough damages to be worried (from deleting or corrupting all your documents to sending spam or spreading virus, all are easy and frequent options that dont requires high priviledges).

      In linux, assuming no local vulnerabilities you are mostly in the same

    • When IE 7 wants to save a file to the user's desktop, for instance, it must first "ask" the broker if it can do this. The broker is written in such a way that all actions require the user to confirm this is OK via a dialog box. If the user says it's OK the broker completes the action on behalf of IE 7.
      This is very little security.

      A lot of users have no idea what any of it means, and are easily tricked. And Windows has so many prompts that even many sophisticated users begin to answer yes without paying atte
      • So what do you want them to do? Not allow users to save files? Give me a break.

        The dialogs they will see are EXACTLY the same as they see now. They will have no idea it's a "broker". IE will act more or less just like it does now.

        Of course, if you watched the video, you would know that.
    • I remember hearing that ActiveX would only allow privileged operations if the code was digitally signed and verified as trustworthy, and hence would be as safe as Java... so you know what? I'll believe IE 7 is secure when it has been out for 6-12 months and hasn't had a major vulnerability reported.

      Sure, Microsoft probably has a convincing sounding explanation for why this time, their system will be secure. But they had a convincing sounding explanation many times in the past, and it never made a damn bit o
      • I agree. The only way to know if this scheme will work is by seeing how it has faired after a few months of being in the wild.

        But what I'm saying is that the basic design of this is more secure than not only previously version of IE, but all browsers for all operating systems.

        It makes sense to treat browsers a little differently than most applications since they are often the primary attack vector for most users.
    • When IE 7 wants to save a file to the user's desktop, for instance, it must first "ask" the broker if it can do this. The broker is written in such a way that all actions require the user to confirm this is OK via a dialog box. If the user says it's OK the broker completes the action on behalf of IE 7.

      Wait, so I right click an image, choose "save to desktop", and then a dialog will come up asking me if I "really want to" do that?

      You know, my usual response to dialog boxes like that is something along the li

  • MS Claims Latest IE 7 Beta is not Susceptible (Score:3, Informative)

    by squidguy ( 846256 ) on Thursday March 23, 2006 @04:07PM (#14982762)
    The vulnerability has also been confirmed in Internet Explorer 7 Beta 2 Preview (January edition) though it could be avoided by turning off Active Scripting, as suggested by Microsoft Security Response Center blog.

    Per the same blog, the 20 March release of IE7 Beta is not vulnerable.

    Caveat emptor... I haven't tested it.

  • The 1st IE7 worm after the 'divorce' from windows (Score:5, Funny)

    by rubberbando ( 784342 ) on Thursday March 23, 2006 @04:11PM (#14982809)
    shall be named "alimony"!

  • But they spend 20 billion on making windows secure (Score:3, Insightful)

    by SmallFurryCreature ( 593017 ) on Thursday March 23, 2006 @04:20PM (#14982871) Journal
    So clearly this bug does not exist in Windows XP SP2 and most certainly the same bug does not exist in the completly Windows Vista.

    Didn't we just have an article about MS wanting to go after Big Blue's business in the serious computer market? That they had spend 20 billion dollars on getting Windows ready to compete with the big boys and that IBM better look out?

    Some MS fan boys of course swallowed that line hook, line and sinker. The same line MS has spun since it began business. "The next version will be lots better then what our competitor offers so please buy our [inferior] product now, we promise to ship the next version on time and as promised. Honestly. Have we ever lied to you before, or failed to meet a deadline, or failed to live up to our own hype?".

    So the question by the poster of how this will affect MS in the market.

    Not at all.

    Simple as that. MS can keep producing crap and the public will continue to lap it up. I don't even care for the reasons and excuses anymore. They start to sound more and more like what you get at an Alcoholic Anonymous meeting or a session for battered wives.

    As a LAMP developer I was recently offered a position with the opportunity to grow into .NET development. Gee thanks. What is the bonus package like? Kick in the nuts?

    For those wondering what IE 7 and Vista will be really be like. More of the same old crap just a lot more useless crap that nobody really uses but that adds a lot of bloat that makes it impossible to debug. IF IE 1 - 6 have been buggy security holes and IE 7 has so far had the exact same bugs and security holes as 6 then it is obvious that MS hasn't really done anything with that supposed security audit of theirs.

    First WMF now this. Vista is just another re-release of the same crap code that MS has been logging around since Billy boy first stole his basic interpreter.

    Business as usuall. No doubt they will make a fat profit on it.

  • <hole> IE: you suck
    <IE> :<

  • Comment removed (Score:4, Funny)

    by account_deleted ( 4530225 ) on Thursday March 23, 2006 @04:53PM (#14983191)
    Comment removed based on user account deletion

  • Highly Critical (Score:3, Funny)

    by gnovos ( 447128 ) <gnovos@ c h i p p e d . net> on Thursday March 23, 2006 @04:55PM (#14983203) Homepage Journal
    This hole will complain endlessly about your banal surfing habits and tell you taht are beginning to look a little fat. It's amazingly critical.

  • not as bad is it sounds (Score:2, Informative)

    by tota ( 139982 )
    for sure, I don't mean to be defending IE, but according to the original bug report (copied from Full Disclosure ML):
    *******
    I can't find any info on this delicious IE bug, but it seems to be publicly known:

    r=document.getElementById("c");
    a=r.createTextRange();

    It will badly access a (virtual?) pointer table, making EIP to jump at a random address. This has various effects on the system I've tested

    • Re:not as bad is it sounds (Score:3, Informative)

      by say ( 191220 )
      I doubt the code says EIP.jumpTo(rand.newInt()). There is probably a way to foresee what address the EIP will pick, and that makes this potentially exploitable. But obviously it would be very, very difficult.

Slashdot Top Deals

Saliva causes cancer, but only if swallowed in small amounts over a long period of time. -- George Carlin

Close