November 21, 2005 12:35 PM PST
Attack code released for IE hole
- Related Stories
-
Security flaw touches Windows Media Player, IE
October 18, 2005 -
IE flaw puts Windows XP SP2 at risk
September 16, 2005
The exploit code, made public Monday, aims to take advantage of the "extremely critical" vulnerabilities in IE 5.5 and IE 6 running on XP Service Pack 2 (SP2), and IE 6 running on Windows 2000 SP4, security researcher Secunia said in advisory.
Once a PC user is tricked into visiting a malicious Web site, the exploit can be triggered automatically, without the user doing anything.
"An attacker could use the exploit to run any code they want to on a person's system," said Thomas Kristensen, Secunia's chief technology officer. "It could be they want to launch some really nasty code on a user's system."
The flaw lies in a Javascript component of IE used for loading Web pages onto a computer, according to an advisory from SANS Internet Storm Center.
Microsoft has not released a patch for the hole exploited by the code. People can attempt to work around the problem by either shutting off Javascript or using another type of browser, security companies advised.
Security researchers said the IE vulnerability has been known for the past six months, but had previously been seen as a conduit for denial-of-service attacks rather than the remote execution of code. DOS attacks, which attempt to crash a system by flooding it with data, are typically considered less-severe security risks.
"The vulnerability itself has been known about for a while, but it was only a problem for a denial-of-service attack that would sometimes cause IE to crash," said Johannes Ullrich, chief research officer for the Sans Institute. "Up until now, no one knew how to mark the code and find it in memory to execute a remote code attack."
The exploit code was published by an organization called Computer Terrorism.
Because the flaw was initially believed to involve only a potential DOS attack, Microsoft never issued a patch for the problem, Ullrich said. He added it is not yet known whether Microsoft will spin out a patch for the flaw immediately or wait for its monthly patch cycle.
A Microsoft representative was not able to comment early Monday on the flaw or the exploit, but did say that the company is investigating reports of the possible vulnerability for customers using Internet Explorer while running Windows 2000 SP4 and Windows XP SP2.
"We have also been made aware of proof-of-concept code that could seek to exploit the reported vulnerability but are not aware of any customer impact at this time," the representative said.
Microsoft, upon completion of its investigation, will take appropriate action to protect its customers by providing a patch as part of its monthly security bulletin program or in a separate security advisory, the representative added.
See more CNET content tagged:
denial of service,
Microsoft Internet Explorer,
exploit,
vulnerability,
Service Pack 2

lousy security.
It is not that Firefox is perfect, it has had flaws that needed to be patched. Not nearly as many as IE, and IE is "supposed" to be far more mature, since it has been out for ages. The big difference is that the Mozilla Foundation has a fix(not workaround) in 3-4 days, tops. Long before any flaws are exploited. This is why it is legitimate to claim that Firefox is far more secure then IE.
In short, MS is still paying lip-service to security. If you think that Vista and IE7 won't be security sieves also, I have some swampland you may be interested in.
MS security: the biggest joke and oxymoron since MS innovation.
http://www.computerterrorism.com/research/ie/poc.htm
My machine is IE 6 on Windows XP, SP2.
Other than hanging IE the script was not able to do anything even after waited for around 1 hour.
However, Microsoft should look into it closely and seriously. The Proof of Concept failed on my machine that does not guarantee it shall fail on other machine too.
A cat is gone if the pigeon closes his eyes.
~Shantanu
http://godisnear.blogspot.com
We are so lucky that the Government warns of Computer terrorism although such a terrorism could easily translate to real life terrorism if the terrorism related to Government agency Files. If these files were broken into it would not be broken into.
as a matter of fact thye government makes its files very air tight. But then it can't open these files itself. There was an article to that extent. It is like my handwriting. I can't read it myself.
It is time that the internet infrastructure being used now should be abandoned in favor of a new one as discussed in the following two blogs
http://www.newerawisp.blogspot.com/
http://www.blogomonster/fakir005/
The infastructure used to be in place before the internet era. as a matter of fact it is no infrastructure. it is a method of remote computing. In those days people remote computed by using a terminal no more sophisticated than a key board because there were no cellphones. Now we have cellphones that are owned by everyones although I don't have one and Regis and Kelly don't have one.
If that form of computing was reviewed the cellpone could serve as a client and the files could continued to be stored on line. and the browsing duties could be handled by the server.
But then all that sophistication, that has been acquired by the programmers, would not be needed.
- I.E. [can be] safe, too.
-
by ZenWarrior
November 22, 2005 7:02 PM PST
- Granted, I don't run an "out-of-the-box" version of I.E., but an exploit check of this with the I.E.-based Maxthon came back just clean as a whistle--just like FireFox. That is, I discovered absolutely no risk from this particular "risk."
-
Reply to this comment
View
reply
-
-
See all 41 Comments >>And with I.E. (vs. FireFox), I don't have to concern myself with plug-ins being broken, poorly coded, or in need of an update which isn't available, and also no web site compatibility issues. In other words, all of the good and no more of the bad than with any other browser.