Microsoft: Hole exploit endangers all IE versions
An unpatched security hole in Internet Explorer that is being exploited affects all versions of the browser, making it more serious than originally believed when it was first publicized two days ago, Microsoft says.
Microsoft is investigating reports of attacks against a new vulnerability in IE but said in an update to a security advisory issued late on Thursday that all versions of IE are potentially vulnerable.
The company recommends setting the Internet zone security setting to "high" and using access control lists to disable Ole32db.dll to provide the most effective protection against an attack.
"Our latest information is that there are still limited attacks seeking to load malicious software on vulnerable systems," Christopher Budd writes in the Microsoft Security Response Center blog.
Microsoft has seen several hundred detections of exploits from around the globe, though the sites taking advantage of the vulnerability appear to be hosted on Chinese domains, Microsoft said in a Microsoft Malware Protection Center blog.
"The exploit sites we've seen so far drop a wide variety of malware--most commonly password stealers like new variants of game password stealers like Win32/OnLineGames, and Win32/Lolyda; keyloggers like Win32/Lmir; trojan horse applications like Win32/Helpud along with some previously unseen malware which we generically detect as Win32/SystemHijack," the Malware Protection Center blog says. "We fully expect the variety of malware being dropped by this exploit to broaden as the exploit code starts to circulate around the Internet underground."
People visiting trusted sites could be affected as well from sites targeted by SQL injection attacks through which malicious code is injected into sites, Microsoft says.
A Microsoft spokesman said he could not say when a fix would come. The next Patch Tuesday is scheduled for January 13.
Microsoft's updated advisory lists a number of mitigating factors: Protected Mode in IE 7 and IE 8 in Windows Vista limits the impact of the vulnerability; IE on Windows Server 2003 and 2008 runs in a restricted mode known as Enhanced Security Configuration that sets the security level for the Internet to high; the attacker could only gain the same user rights as the local user; known attacks can not exploit the issue automatically through e-mail.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
If you release the patch and it works, great! If you release the patch and it hoses the rest of your system or some third party application, then you get yelled at for not testing it. It's not an easy line to walk at all.
Of course, given that you are zero knowledge of software engineering, you wouldn't know this.
I don't think I'd trust Safari- that browser hasn't had much success in the security area so far. Give it ime though and it will catch up. Firefox is doing better there and Chrome eveh better than Firefox.
The_Decider wrote:
"If you fix something and it breaks lots of other stuff(or just one thing) you didn't do a very good job of design.:
Have you ever tried to test millions of line of code to make sure that the single bit change you are about to make doesn't affect the rest of it? Are you willing to take that chance with blind trust? I for one would rather have it tested than to rush in like a blind fool.
"Of course, given that you are zero knowledge of software engineering, you wouldn't know this."
You're right. I don't know how difficult it is, but then again, neither do you. That doesn't exactly make you the knowledgable person to be making such comments, does it?
I won't, but thanks for the warning - I don't use Windows @ home, and @ work Firefox works well enough. Now Safari on Mac? No problems. :)
@Fil0403:
I think you got it backwards... IE is more like the old pickup truck in the garage that constantly has troubles and lousy gas mileage (and a rust-hole in the floorboards) - you only use it when you need to (like when you have to update Windows). Firefox is more like a Volvo - hella safer to drive. Safari is like a Subaru for the same reasons. Chrome I don't know about - never used it, and don't currently see a need to.
BTW, if MSFT hadn't embedded IE so damned deeply into the OS, it wouldn't have half the troubles it experiences. Food for thought, no?
/P
http://en.wikipedia.org/wiki/Deductive_fallacy
http://en.wikipedia.org/wiki/False_dilemma
/P
...and the similarities end there.
An application that has a security hole that can't be taken advantage of (because the OS keeps it in a sandbox, or has a security structure built to contain any damage it may do) is still a secure application.
Internet Explorer's problem lies in the fact that Microsoft stupidly embedded it so deeply into Windows (all in an attempt to avoid being found liable in a lawsuit FFS!), that a security hole in Windows stands a solid chance of allowing an attacker to compromise the whole machine.
A good example of how to secure applications at the OS level? A Linux LAMP server (Linux, Apache, MySQL, and PHP). When you use PHP to run a website, PHP is highly permissive, and is often a PITA to code securely. OTOH, if PHP gets popped, so what? The worst you have is a script that you get to fix (the one that let the attacker do something he shouldn't have), some altered content you have to fix or remove, clear out the mail queue, and that's it. The underlying web server and OS are still untouched.
/P
Mozilla isn't perfect either, but they seem to have more urgency about patches than Microsoft, which in recent years only releases patches on patch Tuesday. Even if M$ immediately creates a patch they sit on it until patch tuesday and let you deal with any issues in the meantime. That seems like the best case scenario because there are many security issues that sit unresolved for months sometimes even years as Secunia notes.
Mozilla doesn't make you invincible, but given the choice between the two it is pretty clear that M$ takes a more lax approach to security so I think it isn't much of a stretch to say that one has a better chance security wise with Mozilla than M$ IE.
"When was the last time a FF exploit existed that could turn your computer into a zombie/bot?"
Um, actually just last month. That was the reason for the security patch. FF gets a *lot* of security patches. And I'm glad that it does.
If M$ fixed all security vulnerabilities in the old version of Windows, who'd ever buy the new one? Might seem like I'm MS bashing, but it makes perfect business sense. If the old version does too good of a job, nobody wants the new version unless you add in so much new stuff they can't help it. If you just leave security vulnerabilities in the old versions, people have no choice.
URL for that one?
I also recall that it only affected Windows machines in that aspect (complete remote control, that is).
You're fault - you should know better than to hit the 'boot to crap mode' Windows key.
Change to something better. Change to something free maybe!
Heh...
ethana2@gmail.com
at your service.
I do something silly like use common sense- it doesn't need to be patched and works with all OS's.
Get real, get another browser and be thankful that their are alternatives
Why do you people without a clue continue to parrot that BS?
Other market leaders don't get exploited every other second. Security and market share are disjoint.
Windows get owned for one simple reason: it is easy. With wide open doors like IE, active x, and a good chunk of the windows API that do the heavy lifting for exploit writers, it is no wonder they get shredded.
Yep, it's MSFT's issue and one they are addressing with a patch in compatibility testing currently.
You really should try harder in your trolling attempts. This one wasn't even tricky or entertaining. Usually you have a really good rant or start foaming at the mouth, but this time- meh. I'll give you a C+ for effort.
I use Chrome, FireFox, and sometimes Flock to browse with and with the prudent use of free software, AVAST antivirus, ThreatFire, and Spybot Search & Destroy, my systems stay clean.
I also use a MAC and an old PC with UBUNTU. They stay virus free too,....go figure,.....
Quit whizzing on each other, why don't ya!
I use a Mac, Windows box and Linux boxen for each of their preferred areas of excellence. None of them can do it all so wasting your breath complaining about how this or that is better tha nthe other is... well, a waste of breath.
Use what works for you and quit trying to convince others that they are wrong simply because they have a different color of logo on their case. Racism (and that's what it is at that level) is so very much outdated.
I'm only interested in INFORMATION that will help me to deal with this problem.
IE is crap.
These people agree to anything. Give me your bank details now!
Opera is great - coming into its own for sure.
Chrome and Safari - too nascent, too fragile.
IE - a lot of sites still require it (and Windows) to work.
Linux - basic desktop with a smattering of useful but restricted software.
Mac - amazing desktop with a smattering of useful but restricted software (some sites won't like the OS).
What's a guy to do? Follow orders and make things as safe as possible while we wait for Windows 7!
DRM also doesn't run on my machine.
Why resign yourself to wait for 'Windows Crap Mode 7' ? You think it's going to be fresh?
Is that a joke or are you just stupid?
Oh wait, you let MS do your thinking for you-you are stupid.
Funny that.
Wouldn't it make more sense to present your case in a thougthful and logical manner, respecting others for their own opinions, and not taking anything personally. You're far more likely to have your comments taken seriously when you are polite and respectful.
- by Fil0403 December 13, 2008 6:34 AM PST
- Maybe someone can explain me how users of "Microsoft's browser" in Microsoft Windows Vista "are at risk" of anything other than their own stupidity if, with the default settings, "Microsoft's browser" cannot modify anything outside the Temporary Internet Files folder without user consent.
- Like this Reply to this comment
-
-
- by Penguinisto December 13, 2008 7:54 AM PST
- ...because in order to get any performance or normal use out of it, you have to tweak Vista to remove UAC?
- Like this
-
- by Penguinisto December 14, 2008 9:01 AM PST
- Oh, and BTW:
- Like this
-
- by Dalkorian December 15, 2008 4:35 PM PST
- Maybe you can ask M$, since it's their buggy code and their advisory about the bug in question. I can take a guess - a bug in the code?
- Like this
-
Showing 1 of 2 pages (81 Comments)http://www.theregister.co.uk/2008/12/12/ie_zero_day_misconceptions/
Why do fista apologists confuse "annoying" with "secure"?