- Related Stories
-
Vista for the masses
April 4, 2007 -
Flaw found in Office 2007
February 23, 2007 -
Zero-day attack hits Word
February 15, 2007 -
Microsoft patches 20 security flaws
February 13, 2007 -
Microsoft to deliver patches by the dozen
February 8, 2007
The vulnerabilities aren't considered high-risk, yet they affect the latest releases of Microsoft's Web browser and operating system software. Microsoft has promoted the security of both IE 7 and Windows Vista. The flaws could let attackers get their hands on sensitive user information, security experts have warned.
The French Security Incident Response Team said in an alert that the IE vulnerability, which also affects IE 6, could be exploited in phishing attacks, scams that try to trick people into giving up sensitive information such as credit card data and Social Security numbers. The problem exists because of an error in the way the browser handles certain "onunload" events, the security monitoring company said. Attackers could exploit the issue to spoof the browser address bar, FrSirt said.
The Windows issue is due to a problem with a component that does not properly validate user permissions. This could be exploited by an attacker with access to the machine to get information on protected files, according to a second FrSirt alert. The problem affects Windows Vista, XP, 2000 and Windows Server 2003, FrSirt said.
Microsoft is looking into both vulnerabilities, which were made public last week. Neither of the flaws has been used in any attacks and exploiting the issues is hard, a company representative said.
The IE flaw could only be exploited if an attacker were to lure a victim to a malicious Web site and then persuade the user to enter the address of a trusted site into the address bar. "Customers can avoid this attack by opening and using a new instance of IE before visiting an untrusted site," Microsoft said.
The Windows problem, aside from requiring the attacker to be logged on to the vulnerable computer, appears to only expose file information, not the actual contents of the file, Microsoft said.
Upon completion of its investigations, Microsoft may issue a security advisory or provide security updates through its monthly patch process, the representative said.
See more CNET content tagged:
attacker, Microsoft Internet Explorer 7, vulnerability, Microsoft Internet Explorer, Microsoft Windows Vista
In the same period since Vista's release (in october IIRC) Windows XP had about five critical vulnerabilities. Vista has had one report of one potential nonccritical vulnerability. And the other alternative OSs had their share also.
So why would you expect them to return your money? They delivered on their promise, at least so far.
They should have gone on and told just how insecure and vulnerable Vista is... but they won't.
Thus they're openly telling the world that pre-Vista OS'es were even more vulnerable... (* ROFLOL *)
Walt
In the same period since Vista's release (in october IIRC) Windows XP had about five critical vulnerabilities. Vista has had one report of one potential nonccritical vulnerability. And the other alternative OSs had their share also.
So why would you expect them to return your money? They delivered on their promise, at least so far.
They should have gone on and told just how insecure and vulnerable Vista is... but they won't.
Thus they're openly telling the world that pre-Vista OS'es were even more vulnerable... (* ROFLOL *)
Walt
Really, IE 7 isn't a bad version of the browser, though I wonder how many unknowing people will run into the problem of XP automatically updating to it, then the browser not working due to some abnormal toolbar they didn't know they had. I had to fix atleast two computers where the IE7 upgrade was buggy, causing problems throughout the PC
as Safari. I'd like Firefox a lot more if its form widgets weren't so
damn ugly.
Oh, we all owe MS a debt of gratitude though. The tag that basically
drives all of our Web2.0 Ajax goodness was a non compliant tag
that MS inserted into IE 5.0.
Really, IE 7 isn't a bad version of the browser, though I wonder how many unknowing people will run into the problem of XP automatically updating to it, then the browser not working due to some abnormal toolbar they didn't know they had. I had to fix atleast two computers where the IE7 upgrade was buggy, causing problems throughout the PC
as Safari. I'd like Firefox a lot more if its form widgets weren't so
damn ugly.
Oh, we all owe MS a debt of gratitude though. The tag that basically
drives all of our Web2.0 Ajax goodness was a non compliant tag
that MS inserted into IE 5.0.
Not really. Every month when you apply a Microsoft Patch, they change the default browser back to IE again.
Microsoft should be forced to create a program that WOULD allow IE to be deleted entirely from their OS'es and also be forced to STOP making IE the default browser with every monthly patch they release!!!
Walt
Not really. Every month when you apply a Microsoft Patch, they change the default browser back to IE again.
Microsoft should be forced to create a program that WOULD allow IE to be deleted entirely from their OS'es and also be forced to STOP making IE the default browser with every monthly patch they release!!!
Walt
They should also discontinue support for ActiveX controls in IE. The only reason for using them is for Microsoft's idiotic Windows Update feature anyway.
And they should stick with support for the Sun Java VM. The Microsoft VM is a massive security flaw.
They should also discontinue support for ActiveX controls in IE. The only reason for using them is for Microsoft's idiotic Windows Update feature anyway.
And they should stick with support for the Sun Java VM. The Microsoft VM is a massive security flaw.
Don't expect your house to stay up long when it is build on top of garbage.
If MS had even a slightest clue, they would have started over for IE7 and Vista.
Don't expect your house to stay up long when it is build on top of garbage.
If MS had even a slightest clue, they would have started over for IE7 and Vista.
- YOU CAN GET WINDOWS UPDATES WITHOUT IE
- by ozidigga February 27, 2007 10:33 PM PST
- www.windizupdate.com
- Like this Reply to this comment
-
(70 Comments)