- Related Stories
-
Exploit code makes IE flaw more dangerous
November 4, 2004 -
IE exploit is top of the hacks
November 2, 2004 -
Major browsers bitten by security bugs
October 20, 2004
The vulnerabilities allow for remote code execution with no actions from the computer user, eEye said. Although the flaws would not allow self-propagating worms to infiltrate a system, there is the potential of attackers installing backdoor Trojans without a person's knowledge, Ben Nagy, an eEye senior security engineer, said Friday.
"If a user is tricked (into going) to a site carrying malicious code, they can become infected by just surfing across a banner ad," Nagy said.
eEye notified Microsoft several days ago of the flaws in the default installation of Outlook and IE and is giving the software giant time to develop a patch before releasing details on which versions of the software are affected, Nagy said.
For now, only a few details are included in eEye's page of upcoming advisories.
Nagy added that eEye is also still conducting its own testing of various platforms to evaluate which ones are affected and to what degree.
No exploits are known to have been developed yet, Nagy said.
"Microsoft has acknowledged a vulnerability does exist and is real, but I doubt they will release a patch out of (their monthly) cycle," Nagy said.
Microsoft, meanwhile, said it is investigating privately reported, possible vulnerabilities in Microsoft Windows.
"At this time, Microsoft is not aware of any malicious attacks attempting to exploit the reported vulnerabilities, and there is no customer impact based on this issue," said a company spokeswoman. "Upon completion of this investigation, Microsoft will take the appropriate action to protect our customers, which may include providing a fix through a service pack, our monthly release process or an out-of-cycle security update, depending on customer needs."
See more CNET content tagged:
eEye Digital Security, flaw, vulnerability, Microsoft Outlook, Microsoft Internet Explorer
Wow! They gave MS several DAYS to create a patch.
Aren't these "security" consultants wonderful. Everyone has to pay attention to them immediately. If not, you are the bad guy.
Several days are not even enough for investigation if a company is serious in solving the problem!
Get a live, guys!
PixelSlave
Also stated was this quote: "Microsoft has acknowledged a vulnerability does exist and is real, but I doubt they will release a patch out of (their monthly) cycle," Nagy said.
To me it sounds like eEye did their part and notified MS and understand it will take time to develop a patch.
Just my 2 cents...
together to beat Netscape, and in the process, became to source
of much of Windows key coding. That's innovation for you. IE
and Outlook were badly conceived, badly written, badly
integrated, and now cannot be really changed without screwing
up Windows too.
Anyhow, it's nice that MS has people looking out for their
interests. I just wish MS was looking out for its customers
interests.
Maybe that's why I am a MS cusotmer so rarely.
However, times change and that was a long time ago. Now, Microsoft is dedicating huge resources to shoring up in security story. You may chose to ignore them, like Netscape did years ago, but in time Microsoft's operating system and browser will be more secure than anything else.
Two points come to mind immediately....
one is that stories like these are the result of people at security companies with a vested interest in finding security holes in IE. These companies are unwittingly helping Microsoft secure IE. The number of these vulnerabilities is certainly a static number and the more that are found, the sooner all of them will be found.
Second, unlike vitually anyone else, Microsoft is slowly but methodically converting all its programs to be CLR (Common Language Runtime) based. The CLR, like other virtual machines, provide a better security model and sandbox better suited for programs that access the Internet.
Where is there a Java based broswer?
Why is firefox not Java based?
Your comments while appropriate for the today will slowly but surely lose their relevance as Microsoft works toward a better computing model.
I claim that any browser that runs any version of java is vulnerable. As holes are closed the attacks will concentrate on this area for all browsers.
Unless signed, a Java applet can not access anything on your computer, it can't even write to a file or read one, or access the directory structure.
As for signed applets, if you download a signed applet without scrutinizing it, then it is your fault.
Setting IE to high security is a band aid solution that cripples your web browsing abilities. It is still more flawed then Firefox set to default.
Another example of Micro-crap.
Robert
Someone else said they probably would only release that on the monthly cycle, and as much as I hate defending MS for any reason, this is basically what IT of most businesses have asked for to make their patching process easier.
There's no exploit yet anyway, and the security company released no helpful information for the bad guys, so we can afford to wait a little bit.
Besides, like others have said, with the High security setting, this flaw doesn't matter. And since I'm running Firefox and Thunderbird, this doesn't matter for me at all. I just get to read about another flaw I get to avoid since I switched. Somewhat refreshing, actually. :)
The fact is that Microsoft operating systems cannot distinguish what is a malicious act and what is not. They do not learn over time how to make this distinction. They also cannot distinguish between processes launched directly by a user or on behalf of a user. I'll venture to say that 95% of the folks reading this are logged on as Admin, or using an account with Admin rights. This is understandable because it is a huge annoyance to have actions fail because of insufficient rights, but it further compromises the system.
What all 3rd party MS security tools have in common is that they attempt to distinguish between malicious and non malicious acts. If an action is potentially malicious, then they give the user the opportunity to allow or disallow the action. If the user guesses wrong, something bad happens.
A recent CNET article on Longhorn asked the question as to whether customers will embrace the new release, be willing to pay for it. A quick review of planned security enhancements in Longhorn leads me to conclude that the core security weaknesses still exist in Longhorn. It is the same old "close the barn door after the horses get out" approach. So no, Longhorn does not represent a compelling upgrade, and next year at this time we will still be reading about new MS security exploits, this time in Longhorn.
Microsoft Details Longhorn Security
Joris Evers, IDG News Service
Thursday, February 26, 2004
"A component of the protection system, dubbed "dynamic system protection," will track which security patches (Keith: bad news) users have installed. The component will make changes to the Windows firewall to fend off any attacks that appear to take advantage of a security flaw that users have not yet patched themselves against. Keith: bad news)
For example, if Microsoft has provided a patch for a flaw (Keith: bad news) involving ActiveX controls, dynamic system protection will block ActiveX controls from running on a Windows system until that patch is installed, Microsoft says.
What does all this mean? Don't look to Microsoft to solve their own security problems (or apparently even find them), because they do not understand the underlying causes.
Keith
www.techcando.com
Aiye. . .
I hate Microsoft.
insecurity that the registry effective file system core exposes
Windows to! As long as the registry remains, Windows can never
be internet secure!
- Mislabled threat
- by April 5, 2005 6:45 AM PDT
- "The vulnerabilities allow for remote code execution with no actions from the computer user, eEye said."
- Like this Reply to this comment
-
(43 Comments)This would mean that a computer sitting at the login prompt would be vulnerable... which would mean that app servers would also be vulnerable... this gets IT support hopping.
But.... if you read further:
"If a user is tricked (into going) to a site carrying malicious code, they can become infected by just surfing across a banner ad," Nagy said.
That would require USER INTERACTION with the computer.
The sky is not falling.