Zero-day exploit hits Internet Explorer
One flaw not addressed in yesterday's Patch Tuesday is a heap overflow within the XML parser reported on Wednesday by Bojan Zdrnja of the SANS Internet Storm Center.
The exploit in the wild on Wednesday creates an XML tag, then waits 6 seconds in an attempt to thwart antivirus engines. The exploit could then crash the browser and run malicious code when the browser is restarted. The user must be running Windows XP or Windows Server 2003, and using Internet Explorer 7.
Zdrnja writes that "at this point in time, it does not appear to be wildly used, but as the code is publicly available, we can expect that this will happen very soon."
A Microsoft representative said the company is "investigating new public claims of a possible vulnerability in Internet Explorer. Once we're done investigating, we will take appropriate action to help protect customers. This may include providing a security update through the monthly release process, an out-of-cycle update, or additional guidance to help customers protect themselves."
As for a workaround, Zdrnja suggests using a browser other than Internet Explorer. Microsoft says anyone who has been affected by this exploit can get help online or by calling the PC Safety hotline at 1-866-PCSAFETY.
As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments. 
2) your best solution to this problem for now is right here: http://mozilla.com
3) in regards to #2, then again, Windows itself allows any flaw that affects an application a lot of avenues to travel deeper into the OS. Man... this is hopefully what MSFT should be fixing, not just patching the browser.
or here: http://www.google.com/chrome
Please be sure to include Apple in your tirade if you want to be open minded and honest about the issues.
Grats on never having issues....I know its possible not too.
But as for you mozilla claims....are you referring to Firefox or something else? Do you have anything to back up your bigger security holes statement? As for crashing....yeah I don't many people who complain about that one but I'll take your word for it even though mine never does.
@EcuadorHomesOnline: Good for you! I hope you continue to remain virus-free... I just hope you don't mind if I'm not so certain about your chances of achieving that goal continuously.As for your claims about Firefox, I'd love to see your evidence of this. Please, show it to me.
"Dan: If/when the iPhone (a mobile app, which makes it vastly different) ever has any such flaw and exploit in activity, I will happily mention it. In the meanwhile, IE has yet another exploit happily rounding the Internet, and it in turn digs nice and deep into the OS... which IMPO is inexcusable."
Well, that is your opinion, and you have a right to have one. But then again your opinion is only worth as much as your credibility and respect by your peers. It doesn't really put you in a good position, but that's one you created for yourself.
So, there is a new vulnerability. Big freaking deal. It's easily dealt with. If you prefer to run around like Chicken Little, that is certainly up to you. Unfortunately it just makes you look like- well, Chicken Little.
"Dan: If/when the iPhone (a mobile app, which makes it vastly different) ever has any such flaw and exploit in activity, I will happily mention it. In the meanwhile, IE has yet another exploit happily rounding the Internet, and it in turn digs nice and deep into the OS... which IMPO is inexcusable."
Well, that is your opinion, and you have a right to have one. But then again your opinion is only worth as much as your credibility and respect by your peers. It doesn't really put you in a good position, but that's one you created for yourself.
So, there is a new vulnerability. Big freaking deal. It's easily dealt with. If you prefer to run around like Chicken Little, that is certainly up to you. Unfortunately it just makes you look like- well, Chicken Little.
Just not using IE (or not updating it because of that reason) is not a fix. You should always keep systems default browser updated (including Safari on OS X).
People who don't know enough to hate internet exploder with a passion are pitiable, but sometimes they're able to learn from their mistakes.
Think of it this way, you are a burglar trying to get into my house. You found two worm holes, one takes you to my front porch (most applications, including 3rd party browsers in general) and the other one takes you into my living room (internet exploder). Get it yet?
The first thing I do to any winblows box I get my hands on is hide IE from it's user and install a browser of their choice, or Firefox if they don't have a choice (or STUPIDLY choose IE). To me that is a security measure, though only a small step. It's like locking the front door to your house, it won't stop every single determined burglar but it will stop the curious neighborhood children from wandering through the house at will.
Did you mean "widely" used ?
- by willbw December 11, 2008 2:57 PM PST
- Your all forgetting windows is made to break thats why it uses a crummy registry with limited access. They create there own problems your ignorant if you use Ie anyway.
- Like this Reply to this comment
-
(24 Comments)