DrJBHL DrJBHL

Researchers Reveal New IE Zero-Day Vulnerability

▼

Researchers Reveal New IE Zero-Day Vulnerability

UPDATE

from WinCustomize Forums

 

I wasn't planning on posting today, but when I read this, I felt I should whip something up quickly.

Security researchers have released attack code that exploits an unpatched bug in Microsoft's Internet Explorer (IE) and sidesteps defenses baked into Windows 7.

Microsoft late Wednesday confirmed that all versions of Internet Explorer (IE) contain a critical vulnerability that attackers can exploit by persuading users to visit a rigged Web site. The site can then hijack personal data and install malicious code and/or malware. This will bypass all security software and Windows 7 protestion. Network Administrators and IT Professionals can download EMET 2.0 from MS who claim it can be configured to protect servers.

MS Security Advisory (2488013) HERE.

Although the company said it would patch the problem, it is not planning to rush out an emergency update.

The next regularly-scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.

Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.

The vulnerability in IE6, IE7 and IE8 surfaced several weeks ago when French security firm Vupen disclosed a flaw in IE's HTML engine.

The bug first surfaced earlier this month when French security firm Vupen announced it had uncovered a flaw in IE's HTML engine, however the vulnerability was noted and explained earlier in a Chinese trade publication.

Doc suggests using Firefox, Opera, or any non iE based browser until this vulnerability is patched.

 

 

164,931 views 95 replies
Reply #26 from WinCustomize Forums Top

That's the speed dial, Uvah. You can get a speed dial for FF here

 

Reply #27 from WinCustomize Forums Top

This is true but you don't have to configure it in Opera, its already there when you open a new tab. I am gonna check it out though. I'm only test driving Opera right now. So far I'm liking it but I'm not giving up Firefox any time soon.

WindowBlinds - Free yourself of the default settings, customize your desktop.
Reply #28 from WinCustomize Forums Top

Quoting Uvah, reply 25
Just went and downloaded Opera. One thing is different, opening a new tab and seeing a bunch of thumbnails with each one linked to a website. Cool. Now all I gotta do is open click and I'm off. Not going for the boost thingy yet. This is pretty fast as it is. Another thing I'm liking, more real estate to work with. Not so much in the way of thick tool bars.
End of Uvah's quote

As taz said, it's  'speed dial'  and you can edit each thumb to whichever website you'd like. :)

Reply #29 from WinCustomize Forums Top

Okay Doc. Let me ask you somethin'. What happens if I have both Opera and firefox open at the same time. Will the fox become a diva or will Opera start lookin' for the henhouse? Sorry ... couldn't resist. :rofl: :rofl:

Reply #30 from WinCustomize Forums Top

I agree Navagatsio, especially now that it's the buggiest and slowest of the browsers.
End of quote

I've heard that it may be slower than other browsers at the moment but buggy I don't agree with.

Reply #31 from WinCustomize Forums Top

There are people who use IE? 8C

Reply #32 from WinCustomize Forums Top

Guess what. i went and got speed dial for Firefox. Did the install, restarted FF and the page said install successful. Even configured it to show speed dial button on the tool bar. Speed dial button is not there. Add-on is not there. Open new tab ... blank page. So much for that.

Reply #33 from WinCustomize Forums Top

Google Chrome is another good alternative just not as "refined" as FF, Opera and Safari (to me anyway) yet because it's not been in development as long. Still, I know a lot of tech savvy friends who swear by it and use it exclusively as a primary browser. I personally like Safari but I think it may have something to do with my Mac conversion a couple of years back until the skinning bug hit again... ;)

I've been "computing" since MS DOS (punch cards in college) around 1980 and I've seen these browsers (and Windows versions) progress to where they are today. I've followed browsers like FireFox (Gecko at first...a branch off from Netscape in the late 90's) and Opera (always been fast but early versions were butt UGLY and kind of confusing) but MS never did "get it" when it comes to browsers (even when they tried to steal Netscape's ideas in the day). IE just became a part of the Windows OS in XP because in earlier versions of Windows you could completely uninstall it like any other program and it wasn't integrated into the system. Unfortunately now even though you're running another browser, ole IE will still be there lurking in the background whether you like it or not... <_<

Reply #34 from Stardock Forums Top

Quoting DrJBHL, reply 21
From my OP:


Although the company said it would patch the problem, it is not planning to rush out an emergency update.

The next regularly-scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.

Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.

End of DrJBHL's quote

Yeah.  I wasn't talking about their patching process at all, so not sure where you're going with that.

Reply #35 from WinCustomize Forums Top

ole IE will still be there lurking in the background whether you like it or not...
End of quote

True. Every time I run CCleaner it finds temp files in IE. I don't use it so where they come from is a mystery to me. I'm gonna find a way to disable it ... if that's possible.

Reply #36 from Stardock Forums Top

Quoting Uvah, reply 35

ole IE will still be there lurking in the background whether you like it or not...


True. Every time I run CCleaner it finds temp files in IE. I don't use it so where they come from is a mystery to me. I'm gonna find a way to disable it ... if that's possible.
End of Uvah's quote

You use it if you load Impulse.

Reply #37 from WinCustomize Forums Top

I'm gonna find a way to disable it ... if that's possible.
End of quote

I don't think you can....completely. It's integrated into the OS so that it'll be the system default app for certain program's .dlls... :|

Reply #38 from JoeUser Forums Top

Yeah, SpeedDial was a nice added bonus.  Gotta get Opera out on the track & work up a real sweat to be sure, but it looks very promising.

Reply #39 from WinCustomize Forums Top

Quoting Savyg, reply 34

Quoting DrJBHL, reply 21From my OP:


Although the company said it would patch the problem, it is not planning to rush out an emergency update.

The next regularly-scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.

Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.


Yeah.  I wasn't talking about their patching process at all, so not sure where you're going with that.
End of Savyg's quote

I didn't think you'd seen it, and didn't want your computer to be possibly vulnerable until February. :)

Reply #40 from WinCustomize Forums Top

Quoting Uvah, reply 32
Guess what. i went and got speed dial for Firefox. Did the install, restarted FF and the page said install successful. Even configured it to show speed dial button on the tool bar. Speed dial button is not there. Add-on is not there. Open new tab ... blank page. So much for that.
End of Uvah's quote

o_O   fine on mine. Start page, new tab, drag and drop, the whole works.

Reply #41 from WinCustomize Forums Top

Must have been a busted download. I dl'd it again and this time it worked. Now I can play. :P

Reply #42 from Elemental Forums Top

Why would you use something called Internet Exploder :thumbsdown:

Reply #43 from WinCustomize Forums Top

Why would you use something called Internet Exploder
End of quote

Kablaam! There goes IE. Good thing I got FF. :P

Reply #44 from WinCustomize Forums Top

I have FF, Opera, and Google Chrome.

I've used FF since it first came out and have a hard time forcing myself to try anything else.

I like Operas speed. I like Opera Unite. I already had Dave Baxter stream my music collection and I use it to stream my music around the house.

I have WIndows7 on the other PC and have forced myself to run only Google Chrome for everything, including email. I have FF and TB exe sitting in a folder and have been tempted to install 'em but have held off.

I'm really starting to get comfortable with Google Chrome. I have fewer add-ons than I do with FF. The lack of add-ons has been an issue in giving up FF, but after using Opera and Chrome, I realize I have a lot of add-ons in FF that I don't need and are probably slowing it down.

On a side note...occasionally I have downloaded Seamonkey. I think it has great potential but is slow in development. I mess with it and uninstall it after a few weeks and download the next big update. It's not bad, just not as customizable as the three above.

And finally, there is ROckmelt, which I am REALLY liking for Facebook. (I have invites for, btw.)

I stopped using IE years ago. If not for Windows/MIcrosoft updates I would uninstall the damn thing so as not to worry about someone else getting on it.

Reply #45 from JoeUser Forums Top
There are lots of things to like about Google apps, including Chrome. And just enough things about Google to make me leary of them.
Reply #46 from WinCustomize Forums Top

On a side note...occasionally I have downloaded Seamonkey
End of quote

Completely forgotten about SeaMonkey. I figured Mozilla was too busy with FF, TBird, etc. to still have it in development. :|

Reply #47 from WinCustomize Forums Top

I started with FF. Am now running Opera. Do I want to run Google Chrome, SeaMonkey or yet another browser. Hmmmmmmm.

Reply #48 from WinCustomize Forums Top

If you're happy with Opera's performance (sorry about the pun), why install more stuff? You'll end up with a crudded up registry and slow-downs.

 

Reply #49 from WinCustomize Forums Top

Nah ... no more stuff. I got enough. Did install AdBlocker Plus though.

Reply #50 from Stardock Forums Top

Quoting DrJBHL, reply 39

I didn't think you'd seen it, and didn't want your computer to be possibly vulnerable until February.
End of DrJBHL's quote

http://www.oneitsecurity.it/01/03/2010/interview-with-charlie-miller-pwn2own/

That guy thinks IE8 is one of the more secure browsers.

I'm not using IE8 anyway, so I'm not terribly worried.