Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Bring Down Internet Explorer In Six Words

Posted by kdawson on Wed Aug 08, 2007 05:20 AM
from the don't-you-think-she-looks-tired dept.
Bug Internet Explorer Microsoft Security The Internet
Marcion writes "Some handy Japanese guy called Hamachiya discovered a bug in Internet Explorer. Under certain conditions, an asterisk when used as a wildcard can crash IE as soon as the user attempts to go to another page." The article claims the "five HTML tags and a CSS declaration" crash IE7 as well as IE6, but I couldn't get IE7 to fail. This page says that as of June, IE6 was at about 37% market share and IE7 under 20%.
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Bring Down Internet Explorer In Six Words 25 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Tear in my eye (Score:5, Insightful)

    by ceeam (39911) on Wednesday August 08 2007, @05:25AM (#20153843)
    I didn't think I'll see the day when browser crashing on something would be a newsworthy item. We - the industry - have made improvements in the last years I guess.

  • If you don't speak Japanese.... (Score:5, Funny)

    by Dogtanian (588974) on Wednesday August 08 2007, @05:28AM (#20153857) Homepage
    ...then here's a word perfect translation of that article [altavista.com] (courtesy of Babelfish [altavista.com]).

    Erm... then again, maybe not.

    (If you liked that translation, you might enjoy Babelfish's attempt at Slashdot.jp [altavista.com].)

  • Hmm.. (Score:4, Informative)

    by wumpus188 (657540) on Wednesday August 08 2007, @05:29AM (#20153867)
    It indeed crashes IE here... Windows 2K3, IE7

    • Is it crashed or not? (Score:4, Interesting)

      by Dogtanian (588974) on Wednesday August 08 2007, @05:44AM (#20153939) Homepage

      It indeed crashes IE here... Windows 2K3, IE7
      I'm using IE7 bog-standard Windows XP with SP2, and it "crashed" in the manner described for me too. Remember that (as the article states) you have to open a new tab.

      It takes a few seconds to crash after the new tab is opened; that's enough time to type in an auto-completed URL and have it start loading. Strange thing about this is that even though Windows shows the standard "crashed" dialog box for IE, beneath that I can still see (e.g.) Slashdot continue to load in the background until I dismiss the dialog.

      • Re:Is it crashed or not? (Score:5, Informative)

        by Bacon Bits (926911) on Wednesday August 08 2007, @07:49AM (#20154601)
        It's not a crash, per se. It's a forced closure due to an illegal operation of one component of the browser with code in mshtml.dll.

        An exception was thrown that was not properly caught. The error is caused by improper error trapping. Otherwise, the browser would just render things improperly or claim there was an error on the page because it doesn't properly parse and render the style tag.

  • Bring Down A Website In Six Words (Score:5, Funny)

    by millwall (622730) on Wednesday August 08 2007, @05:30AM (#20153871)
    Post
    A
    Crappy
    Article
    On
    Slashdot

  • Bring down my system in 13 chars. (Score:5, Funny)

    by BlackPignouf (1017012) on Wednesday August 08 2007, @06:02AM (#20154047)
    :(){ :|:& };:

  • No big deal. (Score:4, Insightful)

    by 140Mandak262Jamuna (970587) on Wednesday August 08 2007, @07:16AM (#20154397) Journal
    First please realize I am no MSFT fanboi, I have been extremely critical of that company in my previous postings.

    MSFT should try to fix the bug that is crashing IE, because crashes in IE have a tendency to become a remote execution bug later. But still, no point in bashing MSFT on this issue. Browsers crashing on malformed input is well known. Firefox, my fav and only browser, too crashes often on malformed input. There is this thing called fuzzing, sending deliberately malformed input to the browser and see what happens. Firefox used to crash more often than IE under fuzzing. Now they provide fuzzing tools for their testers to strengthen mozilla products.

  • Common to Trident? (Score:5, Interesting)

    by Stefanwulf (1032430) on Wednesday August 08 2007, @07:26AM (#20154453)
    TFA's servers aren't responding at the moment, so this might be included, but has anyone tried this with non-IE programs which use the Trident layout engine?

    If it's Trident that's bringing down IE, then you're looking at HTML code that could also bring down Windows Media Player, several versions of Outlook and Outlook Express, MSN Messenger, Steam (from Valve), and other applications which use it to render web pages. I think at least some versions of Winamp used trident as well, but I'm not sure about that.

  • IE Usage @ w3schools? (Score:5, Informative)

    by asylumx (881307) on Wednesday August 08 2007, @07:37AM (#20154517)

    as of June, IE6 was at about 37% market share and IE7 under 20%

    Yeah, but don't you think w3schools would be a bit biased? W3schools is a site full of tutorials and information for developers. Developers tend to prefer FireFox due to its robust plugin system and some of the excellent plugins for that system (Firebug, Web Tools, etc.) so I'm not surprised that FireFox has a higher rate of use on such a site. In fact, I am surprised that it's not higher!
  • If the point of this item is to point out bugs in IE it isn't alone. I crashed a large Epiphany session with a segmentation violation a couple of days ago and its relatively easy to crash Firefox if you limit the amount of memory available using ulimit (Firefox doesn't catch "early" C++ memory allocation failures and handle them gracefully). Firefox also has the infamous "window unexpectedly destroyed" bug (#263160) for ~3 years (which will crash the browser if you attempt to close the untitled window).

    I suspect all of the Mozilla based browsers will effectively die if one throws enough "heavyweight" pages at them (i.e. those which are activity heavy [because there isn't a Javascript/Active HTML/Animated GIF scheduler]) or run out of swap space (again because memory allocation failures are not handled gracefully).

    IMO, developers place too much emphasis on feature enhancements rather than making the existing browsers run reliably (bugs shouldn't linger for 3 years), with a minimal machine footprint (Netscape 4.7x required significantly less memory than Firefox) and effective priority scheduling of the "top" window (user responsiveness).

  • Also crashes Outlook... (Score:4, Informative)

    by eglass1 (521686) on Wednesday August 08 2007, @08:51AM (#20155031)
    If you include it in the body of an HTML mail message.

    • Re:No. You're kidding. Can't be. (Score:4, Insightful)

      by bl8n8r (649187) on Wednesday August 08 2007, @07:48AM (#20154593)
      > Seriously, here's a phone. Call someone who cares. Or at least isn't surprised. Or at least thinks it's newsworthy.

      Attitudes like this are why computer security is in such a dismal state. Crashing an application from a remote system means that application is not filtering it's input correctly and is subject to a remote compromise. Just because IE goes bu-bye and starts right up again doesn't mean everything is peaches. By the time you've restarted the app or rebooted windows, you may have already been compromised with the software of choice by the remote. This cold be a backdoor, keylogger, trojan whatever - and you won't even know it other than "my computer is slow". People need to wise-up because malware is getting sneakier and more cost effective for the people that write it.

      Articles like this are news worthy because it brings light to the fact that something is amiss and needs fixing. Unfortunately, other than negative PR, there's little incentive for proprietary software to fix these things. That's one of the reasons IE has been, and still is, such a security nightmare. Firefox is only about 2/3 better (3 pages vs. 8 pages) judging by number of CVEs*. Still, security is about lessening risk. It's foolish to use IE these days with much better options available.

      [*] - https://www.kb.cert.org/vuls/html/search [cert.org]

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.