New IE 8 Zero Day Discovered 134
Trailrunner7 (1100399) writes "Researchers have disclosed a new zero day vulnerability in Internet Explorer 8 that could enable an attacker to run arbitrary code on vulnerable machines via drive-by downloads or malicious attachments in email messages. The vulnerability was discovered and disclosed to Microsoft in October, but the company has yet to produce a patch, so HP's Zero Day Initiative, which is handling the bug, published its advisory Wednesday. The ZDI has a policy of disclosing vulnerability details after 180 days if the vendor hasn't produced a patch. The use-after-free flaw lies in the way that IE handles CMarkup objects, and ZDI's advisory says that an attacker can take advantage of it to run arbitrary code."
Re:why are they taking so long? (Score:5, Interesting)
You forgot to add to your timeline:
4/08/2014 - Windows XP (stuck on IE 8) goes out of official support
Ironically, one day before the disclosure was supposed to happen, how convenient for Microsoft.
IE8 Last for Windows XP (Score:4, Interesting)
Internet Explorer 8 was the last Internet Explorer available for Windows XP. Was Microsoft tempted to ignore the security exposure until XP fell out of support? Are there other security vulnerabilities in Windows XP reported before April, 2014, that Microsoft has ignored? Will Microsoft ignore (or at least slow walk) reported security vulnerabilities in their other products as they get nearer (but not actually reach) their end of support dates?
These continuing security defects are really beyond ridiculous. Maybe regulators -- the European Commission? -- ought to be mandating that vendors fix security vulnerabilities in their products within, say, 120 days. That would extend to all products sold (refurbished, new, whatever) within the past, say, 7 years. Otherwise, the vendor will be automatically barred from selling anything unless and until their security messes are cleaned up.
Re:IE EIGHT? (Score:5, Interesting)
Re:IE EIGHT? (Score:2, Interesting)
Right. And the other $500 for the other puter'. oh, and the $300 for the app upgrades. Oh, and the $100 for a printer that has drivers. Or, M$oft, you could just patch what's broke for the common good. Eventually all good chipsets come to an end, and they move off. But until then...
Don't blink this time MS (Score:5, Interesting)
Re:American Date Format (Score:4, Interesting)
third of the fifth? or fifth day of the third?
month-day-year is just madness. for various reasons. if you don't get the reasons then you're just knee(1 foot) deep in madness already.
even year-month-day makes more sense and overall readability is best with day-month-year. one tanker, 100 barrels and 10 cups. makes no sense to go 100 barrels, 10 cups and one tanker.
Zero-Day allowing the attacker run arbitrary code (Score:3, Interesting)
"Zero-Day exploit allowing the attacker to run arbitrary code"
I thought these words should be history based on the implemented NX bit, sandboxing, multiple lines of defense and Data Execution Prevention [wikipedia.org] features of MS Windows after XP.
Why do all these features fail, when they are specifically designed for exposed code like IE? Or does this warning assume the worst case, where all these other features are turned off?