dslreports logo
MSIE exploit
Microsoft pondering emergency patch

This is not broadband news, but it is worth noting as broadband users are the most at risk: An new exploit is rapidly spreading through the shadier sides of the web is aimed at MSIE users on Windows platforms.

Merely visiting a poisoned URL (whether directly or via a pop-up or probably other more subtle ways) is enough for a PC to be infected. Some anti-virus scanners will block the infection today, others may not. Newer infection code that is not picked up by AV scanners could easily be added to the mix.

At this stage Microsoft is apparently thinking of including the fix in the next scheduled update (April 11th) but may rush a fix forward. Security researchers are noting that the number of poisoned URLs are increasing rapidly as the users of the exploit seek to build or add to their bot-nets. The only known easy fix right now is to disable "active scripting", a setting that breaks functionality on most popular websites.

You can read more information here: security forum topic.
view:
topics flat nest 

JE
JE 's BACK BABY
Premium Member
join:2000-12-15
Charlotte, NC

JE

Premium Member

OH REALLY?

What's new About This? Apparently NOTHING! We're used to these things.

JE

justin
..needs sleep
Mod
join:1999-05-28
2031
Billion BiPAC 7800N
Apple AirPort Extreme (2011)

1 recommendation

justin

Mod

Re: OH REALLY?

you are? so you don't use MSIE anymore?

actually zero-day exploits for MSIE that are actively in the wild prior to a microsoft patch are quite rare. Perhaps one other earlier this year. And MS very rarely rushes out fixes that they have to offer to all MSIE users before their schedule fix.

thatdood
join:2002-07-03
Plano, TX

thatdood

Member

Re: OH REALLY?

Windows Meta File Vulnerability was rushed

Jigsaw
Stardust We Are
Premium Member
join:2000-10-21
Cleveland, OH

Jigsaw to justin

Premium Member

to justin
Know what kind of bothers me thou.They can't seem to Get this worked out.How many more exploits are there that we don't even know about.Im not bashing the one thing i do know is the only computer that is safe from this stuff is not on the internet and buried 10 feet underground .
Nanaki (banned)
aka novaflare. pull punches? Na
join:2002-01-24
Akron, OH

Nanaki (banned)

Member

Re: OH REALLY?

said by Jigsaw:

Know what kind of bothers me thou.They can't seem to Get this worked out.How many more exploits are there that we don't even know about.Im not bashing the one thing i do know is the only computer that is safe from this stuff is not on the internet and buried 10 feet underground .
Same is true for other browsers oses etc. Weve already seen a few ff exploits granted they were of little real concern. But this is how it started for IE as well.

Want to be safe take this fact to heart and be ready when a exploit is released for app x.

JE
JE 's BACK BABY
Premium Member
join:2000-12-15
Charlotte, NC

JE

Premium Member

IE, FF, and Opera. Mostly FF.

JE
tbeckner
join:2004-03-20
Bend, OR

tbeckner

Member

Re: OH REALLY?

If you are running IE 7 Beta 2 like I am, then you don't have to worry about this exploit.

Tech-2006
@dsl.irvnca.pacbell.n

Tech-2006 to JE

Anon

to JE
DON'T USE IE ANYMORE !!!!

Firefox is the only way to go nowdays.

Oxygen
Times Square can't shine as bright
Premium Member
join:2001-12-04
Huntington Station, NY

Oxygen

Premium Member

Poisoned URL

Was I redirected to a poisoned URL when I clicked this news article?

LinuxJunkie
join:2005-01-19
Cyberspace

LinuxJunkie

Member

Another Reason

Yet another reason I do common day-to-day tasks such as web browsing, e-mailing and document writing from my SUSE Linux box and Mozilla Firefox. Sure, not everything works as easily or quite as it does on Windows (gaming support comes to mind) but then again, neither do zero-day exploits as anything this serious would've been discovered by the open source community long beforehand.
Roop
join:2003-11-15
Ottawa, ON

Roop

Member

Re: Another Reason

Yet another reason I do common day-to-day tasks such as web browsing, e-mailing and document writing from my concrete basement while wearing a tinfoil hat.

Cheese
Premium Member
join:2003-10-26
Naples, FL

1 edit

Cheese

Premium Member

Re: Another Reason

said by Roop:

Yet another reason I do common day-to-day tasks such as web browsing, e-mailing and document writing from my concrete basement while wearing a tinfoil hat.
Tinfoil hats can increase the chance your brain being read

»Re: Tin foil hat time?

Jigsaw
Stardust We Are
Premium Member
join:2000-10-21
Cleveland, OH

Jigsaw

Premium Member

Re: Another Reason

said by Cheese:
said by Roop:

Yet another reason I do common day-to-day tasks such as web browsing, e-mailing and document writing from my concrete basement while wearing a tinfoil hat.
Tinfoil hats can increase the chance your brain being read

»Re: Tin foil hat time?
Maybe you should have your rig completely owned then you might think different.

Cheese
Premium Member
join:2003-10-26
Naples, FL

Cheese

Premium Member

Re: Another Reason

said by Jigsaw:

said by Cheese:
said by Roop:

Yet another reason I do common day-to-day tasks such as web browsing, e-mailing and document writing from my concrete basement while wearing a tinfoil hat.
Tinfoil hats can increase the chance your brain being read

»Re: Tin foil hat time?
Maybe you should have your rig completely owned then you might think different.
Good thing it hasn't happened in 10 years eh? Maybe because I take precautions to prevent these types of things?

Jigsaw
Stardust We Are
Premium Member
join:2000-10-21
Cleveland, OH

Jigsaw

Premium Member

Re: Another Reason

So does LinuxJunkie so what was your point?

LilYoda
Feline with squirel personality disorder
Premium Member
join:2004-09-02
Mountains

1 edit

LilYoda

Premium Member

Re: Another Reason

said by Jigsaw:

So does LinuxJunkie so what was your point?
I think his point was a joke about tinfoil hats, which you seem to have missed...
Or did you mean to respond to respond to roop instead of Cheese69?

jap
Premium Member
join:2003-08-10
038xx

jap

Premium Member

email rendering question....

the eweek article says:
...exploiting a vulnerability in the method by which Internet Explorer handles HTML rendering," said MSRC Program Manager Stephen Toulouse.
Do most email clients still piggyback on IE's rendering engine? I've been on TheBat! for years so haven't kept up on it.

I'm betting they do, but also wondering if email clients can (and do) place limits upon rendering capabilities to reduce risk of in-client bad behavior ... or does IE architecture force the adoption of current user's browser security settings?
jp10558
Premium Member
join:2005-06-24
Willseyville, NY

jp10558

Premium Member

Re: email rendering question....

Eudora has a choice to use a rather crappy Eudora renderer or IEs, I use the eudora one so I'm less likely to get affected/infected. HTML mail doesn't really matter to me, I prefer plain text anyway so if you can force the mail you care about to text(you mostly can do this still) then you're ok.

OldschoolDSL
Premium Member
join:2006-02-23
Indian Orchard, MA

1 recommendation

OldschoolDSL

Premium Member

Try another browser (just once)

You won't have to get rid of Internet Explorer.

But it wouldn't hurt to try something new. If you don't like it, uninstall it and go back to Internet Explorer.

Firefox : »www.getfirefox.com/

Opera : »www.opera.com/

Netscape (8.1) »browser.netscape.com

Some of these come with built in anti-spyware & anti-adware support which will help you keep things secure.

I would like it if people who are using Internet Explorer tried another browser today. It really will not hurt to try something new.

LoneGreyWolf
Premium Member
join:2002-09-09
Winter Haven, FL

LoneGreyWolf

Premium Member

Re: Try another browser (just once)

said by OldschoolDSL:

You won't have to get rid of Internet Explorer.

But it wouldn't hurt to try something new. If you don't like it, uninstall it and go back to Internet Explorer.

Firefox : »www.getfirefox.com/

Opera : »www.opera.com/

Netscape (8.1) »browser.netscape.com

Some of these come with built in anti-spyware & anti-adware support which will help you keep things secure.

I would like it if people who are using Internet Explorer tried another browser today. It really will not hurt to try something new.
I wish I could get my wife to use another web browser as I use Firefox, but she tried Firefox and absolutely hates it, tried Opera and we both hated it and of course tried netscape, but again she hates it. She will not switch from IE and using Avast! seems to still allow these exploits to happen. Hopefully, Avast! will get on the ball and update to protect against this, otherwise I see a /format coming up and being on dial-up, I am not looking forward to that prospect.

OldschoolDSL
Premium Member
join:2006-02-23
Indian Orchard, MA

OldschoolDSL

Premium Member

Re: Try another browser (just once)

said by LoneGreyWolf:
said by OldschoolDSL:

You won't have to get rid of Internet Explorer.

But it wouldn't hurt to try something new. If you don't like it, uninstall it and go back to Internet Explorer.

Firefox : »www.getfirefox.com/

Opera : »www.opera.com/

Netscape (8.1) »browser.netscape.com

Some of these come with built in anti-spyware & anti-adware support which will help you keep things secure.

I would like it if people who are using Internet Explorer tried another browser today. It really will not hurt to try something new.
I wish I could get my wife to use another web browser as I use Firefox, but she tried Firefox and absolutely hates it, tried Opera and we both hated it and of course tried netscape, but again she hates it. She will not switch from IE and using Avast! seems to still allow these exploits to happen. Hopefully, Avast! will get on the ball and update to protect against this, otherwise I see a /format coming up and being on dial-up, I am not looking forward to that prospect.
Avast! is Internet Explorer. It's just an "add-on" or "plug-in" that using Internet Explorer and gives it a new look and feel.

LoneGreyWolf
Premium Member
join:2002-09-09
Winter Haven, FL

LoneGreyWolf

Premium Member

Re: Try another browser (just once)

said by OldschoolDSL:

said by LoneGreyWolf:
said by OldschoolDSL:

You won't have to get rid of Internet Explorer.

But it wouldn't hurt to try something new. If you don't like it, uninstall it and go back to Internet Explorer.

Firefox : »www.getfirefox.com/

Opera : »www.opera.com/

Netscape (8.1) »browser.netscape.com

Some of these come with built in anti-spyware & anti-adware support which will help you keep things secure.

I would like it if people who are using Internet Explorer tried another browser today. It really will not hurt to try something new.
I wish I could get my wife to use another web browser as I use Firefox, but she tried Firefox and absolutely hates it, tried Opera and we both hated it and of course tried netscape, but again she hates it. She will not switch from IE and using Avast! seems to still allow these exploits to happen. Hopefully, Avast! will get on the ball and update to protect against this, otherwise I see a /format coming up and being on dial-up, I am not looking forward to that prospect.
Avast! is Internet Explorer. It's just an "add-on" or "plug-in" that using Internet Explorer and gives it a new look and feel.
You have me confused. The Avast! that I am talking about is my free anti-virus software. I'm not sure what your talking about.
Trill
join:2003-12-18
Crestview, FL

Trill

Member

Re: Try another browser (just once)

I think OldschoolDSL is confusing Avant with Avast.

RVAguy
Premium Member
join:2006-01-05
Richmond, VA

RVAguy to LoneGreyWolf

Premium Member

to LoneGreyWolf
My wife didn't like firefox either, until i found a nice theme, and changed all the shortcuts from ie to firefox and used the IE icon for the shortcuts. Now she loves it. I use the NOIA 2.0 theme for firefox.

MysticGogeta
The Robot Devil
Premium Member
join:2005-03-14
Katy, TX

MysticGogeta

Premium Member

Re: Try another browser (just once)

The problem is my mom refuses to use it my dad I got him to use and when i showed him how to use the tabbed browsing he loved it and never came back to internet explore
The main problem is she quotes "I'v used IE for years why the hell would I switch?" and stays with that theory.
Nanaki (banned)
aka novaflare. pull punches? Na
join:2002-01-24
Akron, OH

Nanaki (banned) to OldschoolDSL

Member

to OldschoolDSL
said by OldschoolDSL:
said by LoneGreyWolf:
said by OldschoolDSL:

You won't have to get rid of Internet Explorer.

But it wouldn't hurt to try something new. If you don't like it, uninstall it and go back to Internet Explorer.

Firefox : »www.getfirefox.com/

Opera : »www.opera.com/

Netscape (8.1) »browser.netscape.com

Some of these come with built in anti-spyware & anti-adware support which will help you keep things secure.

I would like it if people who are using Internet Explorer tried another browser today. It really will not hurt to try something new.
I wish I could get my wife to use another web browser as I use Firefox, but she tried Firefox and absolutely hates it, tried Opera and we both hated it and of course tried netscape, but again she hates it. She will not switch from IE and using Avast! seems to still allow these exploits to happen. Hopefully, Avast! will get on the ball and update to protect against this, otherwise I see a /format coming up and being on dial-up, I am not looking forward to that prospect.
Avast! is Internet Explorer. It's just an "add-on" or "plug-in" that using Internet Explorer and gives it a new look and feel.
Thats not avast thats avant browser. And that add on is a heap of crap. Very hard to get your default browser set to any thing but it once you install it. Dont think its so much cause they dont want you useing any thing else but do to a bug. Basically once you set something else as default you cants open avant or back it goes to being default.

WileEC
mindtaker, macky cat, etc.
join:2002-02-07
Yonkers, NY

WileEC to LoneGreyWolf

Member

to LoneGreyWolf
Here's some advice. Either take IE off her desktop, start menu, etc., or get your wife her own pc to destroy. Anyone still using IE at this point is playing russian roulette. It's just a matter of time until your wife visits a site that has it's way with your PC. Yes, there are steps you can take to make IE more secure, but honestly, I don't see the point. FF is so superior IMO... skins, tabbed browsing, extensions to customize FF to do everything from ad blocking to showing the local weather forecast. IMO it does everything better than IE and it's very safe since it does not support ActiveX controls and it is not integrated into the OS. Your wife may hate FF, Opera and Netscape, but I wonder how she'll react when your PC is hijacked in some way and it's her fault for being so unreasonable?

well, good luck with that.

LoneGreyWolf
Premium Member
join:2002-09-09
Winter Haven, FL

LoneGreyWolf

Premium Member

Re: Try another browser (just once)

said by WileEC:

Here's some advice. Either take IE off her desktop, start menu, etc., or get your wife her own pc to destroy. Anyone still using IE at this point is playing russian roulette. It's just a matter of time until your wife visits a site that has it's way with your PC. Yes, there are steps you can take to make IE more secure, but honestly, I don't see the point. FF is so superior IMO... skins, tabbed browsing, extensions to customize FF to do everything from ad blocking to showing the local weather forecast. IMO it does everything better than IE and it's very safe since it does not support ActiveX controls and it is not integrated into the OS. Your wife may hate FF, Opera and Netscape, but I wonder how she'll react when your PC is hijacked in some way and it's her fault for being so unreasonable?

well, good luck with that.
Problem with doing anything like that, is I have to know when to pick my fights, and that is not something I am willing to fight over. I wish I could put her on her own computer, but seeing that we have dial-up, connect at 26.4kbps, it's not like I could network. We already have 2 phone lines, that costs us $180 a month. I can't afford a 3rd phone line.

I have been spending the day backing up everything of importance on the computer just in case. I am still doing it as I type this. Will probably be doing until sometime in the morning. I just hope that I am doing all this for nothing, but at least if something happens I will be able to get things just about back to normal with in a reasonable amount of time.
kdandaoc
join:2003-10-13
608052427

kdandaoc

Member

Re: Try another browser (just once)

I've used IE for years without any problems with the exception lowrisk adware form tigerdirect and newegg. I know where to surf and where to stay away from. If more people knew what is "safe", it wouldn't be an issue.

If you're looking for porn or going through third party links from crap like myspace, then you're looking for trouble!
mad_3_P
join:2003-02-25
Marietta, GA

mad_3_P

Member

Re: Try another browser (just once)

Hear Hear!!! But, we should be so lucky. Personally, I use IE, FF & Opera w/ no problems. Them, in conjunction w/ Trend-micro AV incl. spyware plugin and Spybot SD keep me safe & secure. Only probs encountered are w/ filesharing, but then "duuuuuhhhh" !!!!!
crazykid
join:2002-11-18
Sterling Heights, MI

crazykid to LoneGreyWolf

Member

to LoneGreyWolf
Actually, Avast! does protect against this in the professional version with its script blocker

ssj4android
Redefining Reality
join:2002-04-14
Wyoming, MI

ssj4android to OldschoolDSL

Member

to OldschoolDSL
Netscape is pretty much just an IE shell now, isn't it?

FFH5
Premium Member
join:2002-03-03
Tavistock NJ

FFH5

Premium Member

Re: Try another browser (just once)

said by ssj4android:

Netscape is pretty much just an IE shell now, isn't it?
It is half Firefox and half IE. Some web sites are pre-configured to IE. But you can select which engine you want to be the default for non-configured web sites. If you make Firefox the default, you should not be subject to this particular vulnerability.
Necronomikro
join:2005-09-01

Necronomikro

Member

Re: Try another browser (just once)

Aye. It has both rendering engines, and you can choose firefox or IE for each site. Unfortunately, the newest netscape seems to think that TrustE is a valid source for determining which sites should render in IE.

-kn-
@69.158.x.x

-kn- to OldschoolDSL

Anon

to OldschoolDSL
yay friendly response, no bashing, just a list of a few major choices

i switch to opera when going to dangerous sites :P

Zeb
Premium Member
join:2000-07-10
Richardson, TX

Zeb

Premium Member

:(

"An new exploit" llool

gatorkram
Need for Speed
Premium Member
join:2002-07-22
Winterville, NC

gatorkram

Premium Member

FF isn't perfect either.

You all act like FF can not, and will not, and has not had major security issues. It has, it will.

Fatal Vector
join:2005-11-26

Fatal Vector

Member

How nice


ANOTHER IE exploit. How many exploits ARE there in this Microsoft crap? Seems like they cant design ANYTHING right. This one is another "flaw" in the way IE handles graphics, and it's HTML, no less. Really, how lame can you get?

••••

HaHaShell
@comcast.net

HaHaShell

Anon

Another reason I don't use ANY Microsoft products

I'm so glad I use Linux and FireFox, it cost a lot less and I get better service too.

kamm
join:2001-02-14
Brooklyn, NY

kamm

Member

Re: Another reason I don't use ANY Microsoft products

said by HaHaShell :

I'm so glad I use Linux and FireFox, it cost a lot less and I get better service too.
Good luck, pal - I prefer games, professional video editing and such instead of compiling my own drivers every time I plug in something.

I have RHEL Pro WS as my secondary OS at work, moreover I use RH since 5.0, so I think I'm well-versed enough to make this statement about linux: it's a great OS for work, it's still a pain in the @ss for home unless you're a linux geek or young and it's still useless for gaming or video editing (yes, video editing, not compositing.)
kamm

kamm

Member

This isn't news...

... because at least one other expolit like this - merely visiting a page - was open for YEARS after it's been reported to then confirmed by Microsoft - maybe it's still the same?
ssynfallan
join:2001-07-24
Denver, CO

ssynfallan

Member

And they all come out of the woodwork

Internet Explorer is not evil. ActiveX support in IE is. Turn it off.

Tools > Internet Options > Security > Select "Internet" and click "Custom Level"

Everything under "ActiveX Controls and plug-ins" should be set to "Prompt" if you are a savvy computer user and read dialogs that pop up and everyone who uses your computer is too. Everything should be set to "Disable" if anyone that uses your computer wouldn't know an ActiveX control from a doorknob. You can leave the "Script ActiveX controls marked safe for scripting" enabled if you want Macromedia Flash to continue to run and disable everything else if you don't want anything more installed.

No need to switch to Firefox to achieve the same level of security in IE. Some sites won't work without ActiveX controls but they need to stop using them anyway, not to mention the activex content won't work for Firefox either.

Fatal Vector
join:2005-11-26

Fatal Vector

Member

Re: And they all come out of the woodwork


I just leave ALL that scripting, etc, crap disabled in the internet zone. If I like/need a site, I can allways put it in the trusted zone. If the site cant display properly without active X (not too many cant), or, without scripting, then oh well, too bad for them.

All this automatic crap was designed for Joe and Jane Box of rocks anyway. Typical Microsoft: EVERYTHING on by default.