Researchers Reveal New IE Zero-Day Vulnerability
UPDATE
Thursday, December 23, 2010 by DrJBHL | Discussion: Personal Computing
I wasn't planning on posting today, but when I read this, I felt I should whip something up quickly.
Security researchers have released attack code that exploits an unpatched bug in Microsoft's Internet Explorer (IE) and sidesteps defenses baked into Windows 7.
Microsoft late Wednesday confirmed that all versions of Internet Explorer (IE) contain a critical vulnerability that attackers can exploit by persuading users to visit a rigged Web site. The site can then hijack personal data and install malicious code and/or malware. This will bypass all security software and Windows 7 protestion. Network Administrators and IT Professionals can download EMET 2.0 from MS who claim it can be configured to protect servers.
MS Security Advisory (2488013) HERE.
Although the company said it would patch the problem, it is not planning to rush out an emergency update.
The next regularly-scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.
Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.
The vulnerability in IE6, IE7 and IE8 surfaced several weeks ago when French security firm Vupen disclosed a flaw in IE's HTML engine.
The bug first surfaced earlier this month when French security firm Vupen announced it had uncovered a flaw in IE's HTML engine, however the vulnerability was noted and explained earlier in a Chinese trade publication.
Doc suggests using Firefox, Opera, or any non iE based browser until this vulnerability is patched.
 |
|
Page 2 of 5 | |
|
|---|
Reply #22 Friday, December 24, 2010 1:26 AM
oh and don't get me wrong, please. I'm really glad you took the time to post this. TY!
Reply #23 Friday, December 24, 2010 2:56 AM
Hmm, just loaded up Opera and I've got to admit, it's pretty perky. In terms of browsing it kind of feels like I've upgraded my processor a few clicks. "I think this could be the start of a beautiful relationship" 
My Rust-Bucket and I thank you Doc.
Reply #24 Friday, December 24, 2010 4:16 AM
You're welcome, DaveRI. 
Another thought for safe browsing is installing and browsing through Microsoft's Virtual Machine 2007 (TY CarGuy1).
Reply #25 Friday, December 24, 2010 5:00 AM
Just went and downloaded Opera. One thing is different, opening a new tab and seeing a bunch of thumbnails with each one linked to a website. Cool. Now all I gotta do is open click and I'm off. Not going for the boost thingy yet. This is pretty fast as it is. Another thing I'm liking, more real estate to work with. Not so much in the way of thick tool bars.
Reply #27 Friday, December 24, 2010 6:16 AM
This is true but you don't have to configure it in Opera, its already there when you open a new tab. I am gonna check it out though. I'm only test driving Opera right now. So far I'm liking it but I'm not giving up Firefox any time soon.
Reply #28 Friday, December 24, 2010 6:22 AM
As taz said, it's 'speed dial' and you can edit each thumb to whichever website you'd like.
Reply #29 Friday, December 24, 2010 7:40 AM
Okay Doc. Let me ask you somethin'. What happens if I have both Opera and firefox open at the same time. Will the fox become a diva or will Opera start lookin' for the henhouse? Sorry ... couldn't resist. 
Reply #30 Friday, December 24, 2010 8:09 AM
I've heard that it may be slower than other browsers at the moment but buggy I don't agree with.
Reply #32 Friday, December 24, 2010 9:13 AM
Guess what. i went and got speed dial for Firefox. Did the install, restarted FF and the page said install successful. Even configured it to show speed dial button on the tool bar. Speed dial button is not there. Add-on is not there. Open new tab ... blank page. So much for that.
Reply #33 Friday, December 24, 2010 9:31 AM
Google Chrome is another good alternative just not as "refined" as FF, Opera and Safari (to me anyway) yet because it's not been in development as long. Still, I know a lot of tech savvy friends who swear by it and use it exclusively as a primary browser. I personally like Safari but I think it may have something to do with my Mac conversion a couple of years back until the skinning bug hit again... 
I've been "computing" since MS DOS (punch cards in college) around 1980 and I've seen these browsers (and Windows versions) progress to where they are today. I've followed browsers like FireFox (Gecko at first...a branch off from Netscape in the late 90's) and Opera (always been fast but early versions were butt UGLY and kind of confusing) but MS never did "get it" when it comes to browsers (even when they tried to steal Netscape's ideas in the day). IE just became a part of the Windows OS in XP because in earlier versions of Windows you could completely uninstall it like any other program and it wasn't integrated into the system. Unfortunately now even though you're running another browser, ole IE will still be there lurking in the background whether you like it or not... 
Reply #34 Friday, December 24, 2010 9:59 AM
Although the company said it would patch the problem, it is not planning to rush out an emergency update.
The next regularly-scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.
Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.
Yeah. I wasn't talking about their patching process at all, so not sure where you're going with that.
Reply #35 Friday, December 24, 2010 11:09 AM
True. Every time I run CCleaner it finds temp files in IE. I don't use it so where they come from is a mystery to me. I'm gonna find a way to disable it ... if that's possible.
Reply #36 Friday, December 24, 2010 11:26 AM
ole IE will still be there lurking in the background whether you like it or not...
True. Every time I run CCleaner it finds temp files in IE. I don't use it so where they come from is a mystery to me. I'm gonna find a way to disable it ... if that's possible.
You use it if you load Impulse.
Reply #37 Friday, December 24, 2010 11:38 AM
I don't think you can....completely. It's integrated into the OS so that it'll be the system default app for certain program's .dlls... 
Reply #38 Friday, December 24, 2010 12:38 PM
Yeah, SpeedDial was a nice added bonus. Gotta get Opera out on the track & work up a real sweat to be sure, but it looks very promising.
Reply #39 Friday, December 24, 2010 12:52 PM
Quoting DrJBHL, reply 21From my OP:
Although the company said it would patch the problem, it is not planning to rush out an emergency update.
The next regularly-scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.
Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.
Yeah. I wasn't talking about their patching process at all, so not sure where you're going with that.
I didn't think you'd seen it, and didn't want your computer to be possibly vulnerable until February.
Reply #40 Friday, December 24, 2010 5:10 PM
fine on mine. Start page, new tab, drag and drop, the whole works.
Please login to comment and/or vote for this skin.
Welcome Guest! Please take the time to register with us.
There are many great features available to you once you register, including:
- Richer content, access to many features that are disabled for guests like commenting on the forums and downloading skins.
- Access to a great community, with a massive database of many, many areas of interest.
- Access to contests & subscription offers like exclusive emails.
- It's simple, and FREE!
|
|
Page 2 of 5 | |
|
|---|
Reply #21 Friday, December 24, 2010 12:52 AM
Quoting DrJBHL, reply 3Lightof Abraxis, it's called that "zero-day" -- because the flaw becomes public before a patch is ready to stop its exploitation.
especially now that it's the buggiest and slowest of the browsers.
The problem is that 'vulnerability' could be anything from 'can look at the files in one directory' to 'can smite your box.' MS will usually fix vulnerabilities even when there isn't even a verifiable threat due to other safeguards.
I haven't used IE8 in ages but I've been back on the IE9 beta for a while and loving it. Can't wait for the RC.
From my OP:
The next regularly-scheduled Patch Tuesday is Jan. 11, but because Microsoft usually updates the browser every other month, and just did so last week, it's possible the vulnerability won't be addressed until February.
Microsoft's usual practice is to release an emergency fix only if attacks appear and then grow in strength. Microsoft has never revealed how it sets the point at which a rush patch is triggered.