Microsoft Investigating New Internet Explorer Flaw
Another bug was found in Internet Explorer. Oh yay.
The Microsoft Security Response Center issued a warning Friday indicating that users of Internet Explorer 6, 7 and 8 are vulnerable to malware through an un-patched bug in VBScript. The exploit was originally uncovered by Polish security analyst Maurycy Prodeus of iSEC Security Research. He said that the flaw only resides within Windows XP SP3--all other versions of Windows are not affected by the vulnerability.
According to this post, it's possible to invoke winhlp32.exe from Internet Explorer which in turn might lead to remote code execution. Attackers could execute malicious code when their fake web pages convince visitors to press the F1 key. The good news is that Microsoft has not received reports on attackers actually using this exploit.
"Windows Help files are included in a long list of what we refer to as unsafe file types," Microsoft reports. "These are file types that are designed to invoke automatic actions during normal use of the files. While they can be very valuable productivity tools, they can also be used by attackers to try and compromise a system."
Microsoft said that it's currently investigating the situation, and will "take appropriate action to protect customers." Microsoft suggests that consumers follow its "Protect your Computer" guidelines by enabling a firewall, applying all software updates, and keeping anti-virus definitions up-to-date.
Still, Windows XP users may want to consider alternate browsers, as Internet Explorer is a high-profile target for malware developers.
- Ultra Rare NES Game Sells for $41,300
- After the iPad? The iBoard and iMat, Of Course!
- UK Piracy Bill Could Kill Public WiFi Hotspots
- Secret Service Flounders With 1980s Mainframe
- PS3 Bug Blocks Users From Gaming On and Offline
- Microsoft Complains Google is Anti-Competitive
- Facial Recognition App Could Be Stalkers' Dream
- Nintendo Wii Modded into A Laptop
- Google Launches Tool to Find Chile Quake Victims
- PS3s Fix Themselves After Leap Year Bug Snafu
- Google Goes on Picnik, Acquires Company
- Four Wiseguys Indicted in $20M Online Ticket Scam
- GM Recalls 1.3 Million Cars, Bad Steering
- Comic-Themed HDTVs Costs Under $900
- Sofa Boat Has Laptop Docking, Joystick Control
- Topeka, Kansas Changes Name to Google (Really)
- Apple Sues HTC Over 'Stolen Patented Inventions'
- Corporate Warfare: Execs at Infinity Ward Fired
- Disco USB Drive Lights Up Your Files
One word... Firefox.
Another word... Opera
better word... linux
Another word: alternative.
Sorry, pet peeve of mine. Alternate means to switch back and forth; alternative is a different choice or option.
Lord knows there have not been any issues with Firefox or Opera... and I get plenty of security updates on my linux system.
THE WORD: bird
Firefox + adblockplus is a good way to go.
Lord knows there have not been any issues with Firefox or Opera...
what world are you living in?
All web browsers and os have issues. Although the amount of issues and the kind of issues varies between them.
Anybody ever wonder if "bugs" crop up in older Operating Systems and coincidentally the OS developer urges people to upgrade to the newest OS?
what world are you living in? All web browsers and os have issues. Although the amount of issues and the kind of issues varies between them.
True, but how many other browsers and OSes use VBScript and ActiveX? I can almost hear the malware writers echoing "Developers! Developers! Developers!" in the background.
If Linux was so great we it would have more then a few percentage of users. Yes, if you care to put up with the frustrations of Linux then by all means install it because it is safer because so few use it. The same goes for browsers, user's should use Opera for the same reason as Linux. Nobody hardly uses it.
Firefox + adblockplus is a good way to go.
You forgot NoScript
better word... linux
Sure for everyday use ie. web,office,etc Linux is good, but until me games run on Linux (WITH OUT WINE) I'll need Windows.
In other news, the sky is blue.
VBscript needs to die, I'm continually amazed at what a steaming pile of cack it is. It's completely worthless for web stuff, and unfortunately, despite it's absolutely amazing shortcomings, it's the best tool for the job on Windows systems for non-web automation scripting due to the fact that M$ spent so much effort forcing it on everybody. Your only other choices are dos/batch(utter shit) and powershell(a complete waste of effort).
Linux on the other hand, has awesome scripting, but M$ isn't even smart enough to just copy that...
Yours Truly,
Professional VBscripter
GEEZ! Windows XP SP3 problem! Business as usual.
hmmm
Interesting!
Lets remap the F1 key input to "ANY KEY PRESSED!"
hehehehehehehehehehehehehehehehehe
sucks to be netbook users
hehehehehehe
Another word: alternative.Sorry, pet peeve of mine. Alternate means to switch back and forth; alternative is a different choice or option.
from dictionary.com:
–adjective
8.
being in a constant state of succession or rotation; interchanged repeatedly one for another: Winter and summer are alternate seasons.
9.
reciprocal; mutual: alternate acts of kindness.
10.
every second one of a series: Read only the alternate lines.
11.
constituting an alternative: The alternate route is more scenic.
12.
alternative (defs. 4, 6).
I am so sick and tired of hearing about Linux this and that. If it was so great everyone would be running it and you could actually run good software and games on it. Enough...Linux will NEVER come anywhere near Windows. Have I used Linux? sure..it's fun to play with but when I want to get anything accomplished or play games I run Windows.
Next, why do we never hear any exploits about MacOS or anything Apple makes? Apple = 8% market share that's why. No one cares about MacOS, and everything else I just mentioned, because it doesn't run anything important enough to want to exploit.
It has surpassed it, i can do everything on linux twice as fast as i do on windows 7 and with out the need for antivirus and antispyware.
Most people that buy computers don't even know about any other OS's so use what it came with, which is why windows is so common.
It's not because linux or apple's market share is low that there aren't nearly as much exploits as windows it's because they aren't windows and don't run as root or use .exe files
Google runs linux (and was recently hacked)
otacon72: First off, not everybody plays games, believe it or not. 2nd, it's not Linux's fault that they're not getting support from game makers.
Windows is complete shit anyway, if you don't believe me, try taking up:
C++/COM Interop programming for Windows(epic WTF of all-time, it's amazing that anybody ever did anything with it)
VBScript: Odd scripting language with some peculiar features missing, and a hideous syntax.
C#/VB .NET: It looks good at first, but once you get into it, you realize that there's no consistency in how the class libraries were thrown together, and generally it lacks many, many important features. It gets a B-minus for effort.
It's a complete hodge-podge of backward-compatible bad ideas, Linux is sooooooooo much better...... and has far more potential...
Dont forget
MYTHTV!!!!!!!!
why cant microsoft include a program to cut out my commercials in windows media center 7 recorded shows!!!!!!
mythtv can do it and has been doing it for YEARS!
its SO HARD as i love the windows 7 interface yet like the commercial skipping method of mythtv
Don't you just love the irony in Microsoft's products? Press F1 for help and you get malware. But I think the best one is you need to press Start to shutdown your PC. Classic!!
what world are you living in? All web browsers and os have issues. Although the amount of issues and the kind of issues varies between them.
On my planet, we have a concept called sarcasm.
If Linux was so great we it would have more then a few percentage of users.
Incorrect. By this logic IE6 is almost as good as Firefox.
when I want to get anything accomplished or play games I run Windows.
It sounds to me like you never looked at a package manager, or the "anything" that you want to accomplish is just playing games. After all, games is the only thing you've been specific about. The only things that I can't do on Linux that I do on Windows is game (of course) and use 3DS Max. I don't really like Blender, but it has some advantages over Max that I don't personally use.
Next, why do we never hear any exploits about MacOS or anything Apple makes? Apple = 8% market share that's why. No one cares about MacOS, and everything else I just mentioned, because it doesn't run anything important enough to want to exploit.
Market share is passed off as the only determining factor in how much malware is made for an OS. This is certainly a factor, but not the only factor. In Windows you run, by default, with privileges far higher than necessary. UAC is a step in the right direction towards correcting this, but it's still too crude. In OSX I am not sure of the default privileges as I don't use it. In Linux, you run with only the privileges required at any given moment. The most that malware could do is mess up your Home directory. The system is quite safe unless you give root access to the malware (all OSs are inherently "insecure" due to social engineering attacks).
C#/VB .NET: It looks good at first, but once you get into it, you realize that there's no consistency in how the class libraries were thrown together, and generally it lacks many, many important features. It gets a B-minus for effort.
That's a shame. I quite like C# myself apart from the lack of proper cross-platform compatibility. Visual Studio and C# together make it easy to get an application up and running quick, at least for me.
Another Word: Chrome
Firefox FTW
Lord knows there have not been any issues with Firefox or Opera... and I get plenty of security updates on my linux system.
I don't know about current numbers, but I read an article (probably here on toms) once that detailed security flaws and concluding there were more flaws found per unit of time in firefox than internet explorer. Obviously considering the longer lifetime of internet explorer the total amount of flaws is higher, but if time is taken into the equation ie wins with the lowest flaw count. Now I don't think that applied in the same ratio to fixed and unadressed flaws, so perhaps firefox are better at patching - after all the oen source community does less testing and more patching (read: faster patch time and higher quantity of patches).
ps. I use chrome where I can and ietab (like the one for ff) for chrome where I can't use it natively.
Incorrect. By this logic IE6 is almost as good as Firefox.It sounds to me like you never looked at a package manager, or the "anything" that you want to accomplish is just playing games. After all, games is the only thing you've been specific about. The only things that I can't do on Linux that I do on Windows is game (of course) and use 3DS Max. I don't really like Blender, but it has some advantages over Max that I don't personally use.Market share is passed off as the only determining factor in how much malware is made for an OS. This is certainly a factor, but not the only factor. In Windows you run, by default, with privileges far higher than necessary. UAC is a step in the right direction towards correcting this, but it's still too crude. In OSX I am not sure of the default privileges as I don't use it. In Linux, you run with only the privileges required at any given moment. The most that malware could do is mess up your Home directory. The system is quite safe unless you give root access to the malware (all OSs are inherently "insecure" due to social engineering attacks).That's a shame. I quite like C# myself apart from the lack of proper cross-platform compatibility. Visual Studio and C# together make it easy to get an application up and running quick, at least for me.
just to add something, under linux, nothing is running by it self, the only way something will run is if at the beginning of the chain of files that run, the user ran the first file.
for example, a virus that is downloaded in windows starts to run by it self, similar virus under linux will not run unless the user executed it.
the uac is a good idea, problem is that over 80% of the windows users that I know hav disable it because it is annoying... so much for that defense...
just to add something, under linux, nothing is running by it self, the only way something will run is if at the beginning of the chain of files that run, the user ran the first file.for example, a virus that is downloaded in windows starts to run by it self, similar virus under linux will not run unless the user executed it.the uac is a good idea, problem is that over 80% of the windows users that I know hav disable it because it is annoying... so much for that defense...
That is not entirely true. It is in part true, as there are autorun.inf files and similar features, but for the vast majority of situations the user has to actually run a program to start it - also programs that have file associations set - like opening .hlp files with winhlp32.exe - and far as I know KDE has a feature to execute files in a similar manner. IE make sure that odt files are opening with openoffice writer (swriter.exe in windows, dunno what it's called in a linux distro). So essentially it's the same feature - it just isn't being used.
As for uac - yes that is a problem. By making it so restrictive and annoying in vista/2008 systems, people by default just click continue with no regard to the content. But that's the consequence of a slightly daft approach to security, not the feature itself. And I may want to add that the problem is the same in linux - people almost by default use sudo with most everything to make sure it actually works. su is a similar feature to uac (probably where microsoft got the idea for the 'run as' feature that preceeded uac). So it's pretty much the same situation on both platforms - people merely have more focus on the redmond product than on the hundreds of smaller os options.