Slashdot Log In
Bring Down Internet Explorer In Six Words
Posted by
kdawson
on Wed Aug 08, 2007 04:20 AM
from the don't-you-think-she-looks-tired dept.
from the don't-you-think-she-looks-tired dept.
Marcion writes "Some handy Japanese guy called Hamachiya discovered a bug in Internet Explorer. Under certain conditions, an asterisk when used as a wildcard can crash IE as soon as the user attempts to go to another page." The article claims the "five HTML tags and a CSS declaration" crash IE7 as well as IE6, but I couldn't get IE7 to fail. This page says that as of June, IE6 was at about 37% market share and IE7 under 20%.
This discussion has been archived.
No new comments can be posted.
Bring Down Internet Explorer In Six Words
|
Log In/Create an Account
| Top
| 239 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Tear in my eye (Score:5, Insightful)
Re:How is this fucking useful ?? (Score:5, Funny)
If you don't speak Japanese.... (Score:5, Funny)
(http://babelfish.alt...%2F%2Fslashdot.jp%2F)
Erm... then again, maybe not.
(If you liked that translation, you might enjoy Babelfish's attempt at Slashdot.jp [altavista.com].)
Re:If you don't speak Japanese.... (Score:4, Funny)
Heh. I can just imagine a 'tie-inspector' walking round making sure your business attire is up to standard, or else he unleashes an angry cat on you. Or maybe he tortures a cute kitten in front of you, not sure on that point.
Re:If you don't speak Japanese.... (Score:5, Informative)
Ask and ye shall receive
A bit anti-climactic really.
Re:If you don't speak Japanese.... (Score:4, Funny)
Re:If you don't speak Japanese.... (Score:4, Informative)
(http://slashdot.org/)
Hello! Good afternoon!!!!!
I stumbled across a browser crash, so today I'll tell you about it!
Here it is!
<style>*{position:relative}</style><table><input>
Sample (If you're using IE, your browser will close! You have been warned!)
It seems IE6 or programs using IE6 components will definitely crash!
I haven't checked IE7 though!
It seems to be when you have and input or select or such just below a table or tr or such,
and you use the css wildcard * to set everything to position:relative.
By the way, if the input has its style directly set to relative, it doesn't crash. What's up with that?
I don't really get it, but it sure is interesting...!
Anyone out there who loves Firefox or Opera should go spread this all over and decrease IE's market share!!!
Hmm.. (Score:4, Informative)
Is it crashed or not? (Score:4, Interesting)
(http://babelfish.alt...%2F%2Fslashdot.jp%2F)
It takes a few seconds to crash after the new tab is opened; that's enough time to type in an auto-completed URL and have it start loading. Strange thing about this is that even though Windows shows the standard "crashed" dialog box for IE, beneath that I can still see (e.g.) Slashdot continue to load in the background until I dismiss the dialog.
Re:Is it crashed or not? (Score:5, Informative)
An exception was thrown that was not properly caught. The error is caused by improper error trapping. Otherwise, the browser would just render things improperly or claim there was an error on the page because it doesn't properly parse and render the style tag.
Re:Is it crashed or not? (Score:5, Informative)
When an exception is thrown and is not properly caught. The error is caused by improper error trapping. This is a classic "crash."
Re:Hmm.. (Score:4, Funny)
(http://gildude.blogspot.com/)
Bring Down A Website In Six Words (Score:5, Funny)
A
Crappy
Article
On
Slashdot
Re:Bring Down A Website In Six Words (Score:5, Funny)
(http://whineymacfanboy.googlepages.com/ | Last Journal: Thursday April 12 2007, @09:28AM)
PacaOS is the operating system for Pacas [wikipedia.org] - its a fork of rodentOS. HTH.
Re:Bring Down A Website In Six Words (Score:5, Funny)
get
firefox
from
mozilla
dot
com
/.ed ? (Score:2)
I Install ViSta! (Score:1, Funny)
Bring down my system in 13 chars. (Score:5, Funny)
What's the chars? (Score:1)
(http://august.lilleaas.net/)
Bring Down Internet Explorer In Six Words (Score:1, Offtopic)
No. You're kidding. Can't be. (Score:3, Insightful)
Seriously, here's a phone. Call someone who cares. Or at least isn't surprised. Or at least thinks it's newsworthy.
I don't care if I have to wave karma goodbye now, but sensibly, is there an event running today that tries to see how many really uninteresting, uninspired and utterly pointless "news" can make it to the front page on a single day? Yes, it's possible to crash IE. Hey, breaking news, you can even crash it in a way that allows you to execute arbitrary code. Wow. Teh horrorz.
This ain't news. It may be a new hole detected, but could we at least get less lurid subject lines that sound like it's the end of the world? How about "new bug in IE detected"? It would have been at least as accurate and more objective. You might get the same "duh, no kidding" replies, but at least people wouldn't make fun of you for making something trivial as an IE bug sound like it's the end of the internet.
Re:No. You're kidding. Can't be. (Score:4, Insightful)
Attitudes like this are why computer security is in such a dismal state. Crashing an application from a remote system means that application is not filtering it's input correctly and is subject to a remote compromise. Just because IE goes bu-bye and starts right up again doesn't mean everything is peaches. By the time you've restarted the app or rebooted windows, you may have already been compromised with the software of choice by the remote. This cold be a backdoor, keylogger, trojan whatever - and you won't even know it other than "my computer is slow". People need to wise-up because malware is getting sneakier and more cost effective for the people that write it.
Articles like this are news worthy because it brings light to the fact that something is amiss and needs fixing. Unfortunately, other than negative PR, there's little incentive for proprietary software to fix these things. That's one of the reasons IE has been, and still is, such a security nightmare. Firefox is only about 2/3 better (3 pages vs. 8 pages) judging by number of CVEs*. Still, security is about lessening risk. It's foolish to use IE these days with much better options available.
[*] - https://www.kb.cert.org/vuls/html/search [cert.org]
Re:No. You're kidding. Can't be. (Score:4, Informative)
(http://slashdot.org/)
Umm... 9 days ago?
http://secunia.com/advisories/26201/ [secunia.com]
The vulnerability is caused due to an input validation error within the handling of system default URIs with registered URI handlers (e.g. "mailto", "news", "nntp", "snews", "telnet"). This can be exploited to execute arbitrary commands when a user e.g. using Firefox visits a malicious website with a specially crafted "mailto" URI containing a "%" character and ends in a certain extension (e.g. ".bat", ".cmd")
This command would make firefox go "away"
mailto:test%25../../../../windows/system32/tskill
html source is: (Score:2, Interesting)
</style><table><input></table>
Dr.Who (Score:3, Funny)
(http://www.gpmidi.net/)
Why go to all that trouble? (Score:2, Funny)
Stunned into near silence (Score:1)
No big deal. (Score:4, Insightful)
(Last Journal: Wednesday October 31, @08:33AM)
MSFT should try to fix the bug that is crashing IE, because crashes in IE have a tendency to become a remote execution bug later. But still, no point in bashing MSFT on this issue. Browsers crashing on malformed input is well known. Firefox, my fav and only browser, too crashes often on malformed input. There is this thing called fuzzing, sending deliberately malformed input to the browser and see what happens. Firefox used to crash more often than IE under fuzzing. Now they provide fuzzing tools for their testers to strengthen mozilla products.
I think they used that in... (Score:1)
How to bring down a server (Score:1)
Common to Trident? (Score:5, Interesting)
If it's Trident that's bringing down IE, then you're looking at HTML code that could also bring down Windows Media Player, several versions of Outlook and Outlook Express, MSN Messenger, Steam (from Valve), and other applications which use it to render web pages. I think at least some versions of Winamp used trident as well, but I'm not sure about that.
IE Usage @ w3schools? (Score:5, Informative)
Yeah, but don't you think w3schools would be a bit biased? W3schools is a site full of tutorials and information for developers. Developers tend to prefer FireFox due to its robust plugin system and some of the excellent plugins for that system (Firebug, Web Tools, etc.) so I'm not surprised that FireFox has a higher rate of use on such a site. In fact, I am surprised that it's not higher!
*Six* words? Amateurs. (Score:2, Funny)
As any pimply-faced 14 year old surfing the web alone in his bedroom could've told you, all it takes is your Mom unexpectedly calling your name from right outside your door to cause IE to be shut down immediately.
So? One can easily crash Firefox too... (Score:4, Informative)
(http://www.aeiveos.com:8080/~bradbury/)
I suspect all of the Mozilla based browsers will effectively die if one throws enough "heavyweight" pages at them (i.e. those which are activity heavy [because there isn't a Javascript/Active HTML/Animated GIF scheduler]) or run out of swap space (again because memory allocation failures are not handled gracefully).
IMO, developers place too much emphasis on feature enhancements rather than making the existing browsers run reliably (bugs shouldn't linger for 3 years), with a minimal machine footprint (Netscape 4.7x required significantly less memory than Firefox) and effective priority scheduling of the "top" window (user responsiveness).
Why IE? (Score:1)
Old news (Score:2)
Bigger news is why is it still there?
Also crashes Outlook... (Score:4, Informative)
Safari can beat that (Score:2)
(http://quadrocket.co.uk/)
Big deal. I can crash Safari 2.0.4 in two clicks. Enable Slashdot's new discussion system and click on a 'Reply to This' link. Press the Back button. Crash.
Doesn't crash in Mac OS (Score:2)
(http://www.dreamhost.com/r.cgi?objekt)
Writing Contest! (Score:1)
Mixed results with ies4linux (Score:1)
And this crashes Ff 2.0.0.5 (Score:1)
Six more words to bring down the Internet (Score:2)
One Javascript command (Score:2)
(http://ermarian.net/)
for (x in document.write) { document.write(x);}
Was a great prank (ie, a sig link saying "IE USERS DON'T CLICK HERE"). Heh.
infinite loop, causing a memory error or buffer ov (Score:1)
Those 6 words... (Score:1)
(Last Journal: Tuesday June 12, @11:03AM)
The Barry Bonds Bug (Score:2)
(http://www.macpundit.com/)
The Six Words (Score:2)
(http://nsblog.org/)
Is it... (Score:1)
IE is not 37% (Score:1)
I know it's real subtle... (Score:3, Informative)
(http://www.oddquad.org/)
Another site (Score:2)
http://marketshare.hitslink.com/default.aspx [hitslink.com]
I won't speculate on the accuracy of these sites but it's interesting to compare the w3 statistics with the hitslink.com statistics. Linux for example gets twice the share on the w3 counter as on the hitslink.com site. Vista gets fewer hits on the w3 counter than on the hitslink.com site, it's currently standing at 5,4%, I thought it would be in more widespread use by now. The older Macs are completely missing from the w3 counter although I know for a fact that loads of people are still using them.
Re:Uh huh (Score:1)
Re:Internet Explorer Haters (Score:2)
The difference is, though, that you can take my MacBook Pro away from me when you pry it from my dead cold fingers... Expensive or not.. Other than some minor quirks, I am so much more efficient during the day on my MacBook Pro than I ever way on Windows...
Re:Browser Metrics (Score:3, Insightful)
It may be more accurate, but still not very, considering that it says that Latvia makes up 4% of web usage.
Re:Uh huh (Score:1)
Wait... where have I heard of that idea before [youtube.com]...?
Re:Who cares? (Score:2)
(http://lunarworks.ca/)
He's one of the company owners, and gets all pissy if I even install a security update on his machine. But if he wants to risk losing his QuickBooks when his computer eventually gets 0wned through IE6, well, that's his problem then.
Re:Uh huh (Score:2)
(Last Journal: Thursday August 18 2005, @08:44AM)
hee hee hee
Truth hurts, So Mod Me A Troll (Score:1)
let me count for you (Score:2)
2. {
3. position
4. :
5. relative
6. }