Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Security Internet Explorer Mozilla The Internet

Gaping Holes In Fully Patched IE7, Firefox 2 303

Posted by kdawson from the just-when-you-thought-it-was-safe dept.
Continent1106 writes "Hacker Michal Zalewski has ratcheted up his ongoing assault on Web browser security models, releasing details on serious flaws in fully patched versions of IE6, IE7 and Firefox 2.0. The vulnerabilities could cause cookie stealing, page hijacking, memory corruption, code execution, and URL bar spoofing attacks." Here is Zalewski's post to Full Disclosure.
This discussion has been archived. No new comments can be posted.

Gaping Holes In Fully Patched IE7, Firefox 2 More

Gaping Holes In Fully Patched IE7, Firefox 2

Comments Filter:

  • Ah well (Score:5, Informative)

    by GFree ( 853379 ) on Monday June 04, 2007 @08:38PM (#19390503)

    Gaping Holes In Fully Patched IE7, Firefox 2
    In other words, it doesn't matter which browser you use, you're gonna get F'd in the A regardless? Sounds painful.

    • Re:Ah well (Score:5, Informative)

      by rts008 ( 812749 ) on Monday June 04, 2007 @09:06PM (#19390777) Journal
      RTFA...Try the demo's...It will reduce the FUD.

      I tried the demo page/file and got no response whatever.

      "2) Title : Firefox Cross-site IFRAME hijacking (MAJOR)
            Impact : keyboard snooping, content spoofing, etc
            Demo : http://lcamtuf.coredump.cx/ifsnatch/ [coredump.cx]
            Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=38268 6 [mozilla.org] [May 30]"
      from:(http://lcamtuf.coredump.cx/ifsnatch/) which is from:2) Title : Firefox Cross-site IFRAME hijacking (MAJOR)
            Impact : keyboard snooping, content spoofing, etc
            Demo : http://lcamtuf.coredump.cx/ifsnatch/ [coredump.cx]
            Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=38268 6 [mozilla.org] [May 30]"

      and this:"3) Title : Firefox file prompt delay bypass (MEDIUM)
            Impact : non-consentual download or execution of files
            Demo : http://lcamtuf.coredump.cx/ffclick2/ [coredump.cx]
            Bugzilla : https://bugzilla.mozilla.org/show_bug.cgi?id=37647 3 [mozilla.org] [Apr 04]"

      I tried both link's test button and got no response whatever.

      IMHO, this must be something related to running Windows, as my Kubuntu 7.04 Feisty w/ Firefox 2.0.04 (with NoScript, Adblock, Adblock Filterset, and Flashblock) just does not act on this.

      I guess I need to install some version of Windows to experience this...I feel deprived and left out!

      Does this work with Firefox w/ NoScript on Windows?

      From past experience, I have no doubts that it works with any version of IE on any Windows platform.

      • Re: (Score:3, Informative)

        by Sizzlebeast ( 987883 )
        Firefox 2.0.0.4 w/ NoScript and it won't work on windows either. I guess i have to allow it...not gonna happen :) I guess I'm safe

        • Re: (Score:3, Funny)

          by rts008 ( 812749 )
          Thanks for the info! :-)

          I can't convince my wife to switch to *nix/BSD, she is used to WinXP and IE 7 from work, and doesn't want to change. :-(

          I might be able to sneak Firefox in on her with some creative registry hacks, and some install/configure obfustications. We'll see.

      • probably NoScript (Score:3, Insightful)

        by r00t ( 33219 )
        You're a rare weirdo. Much of the web won't work without scripting, or at least won't work well.

        You're missing out on the nicer wiki/blog editors, live updates to the price of a computer purchase as you add/remove components, tolerable web mail interfaces, and (if your CPU is fast) the experimental slashdot interface.

        Those are just the nerd things. I'm told there are numerous non-nerd things on the web as well, with far more scripting.

        • Re: (Score:3, Informative)

          by MightyYar ( 622222 )
          But you can use NoScript and still allow useful scripts... that's the whole point! The whole advantage of NoScript is that you can click on any shady site that you wish with little-to-no chance of compromising your machine. Presumably, you won't allow scripts from said shady site... when you get to YouTube and the videos won't play, then you enable scripting.

          • Re:probably NoScript (Score:4, Informative)

            by Barny ( 103770 ) on Monday June 04, 2007 @10:33PM (#19391509) Journal
            Yup, noscript doesn't let such nasties run, unless you give them permission, which seems to be half the problem for most internet users.

            As for the person saying noscript is hard to use, its usually a matter of just clicking the script item (like a youtube vid that is being blocked) and it allows it to run temporarily, should be built in standard imho.

            Combine it with a nice ad server blocker (kerio personal firewall for instance) and the web just suddenly starts working as it was meant to :)

            • ...which seems to be half the problem for most internet users.
              Yeah, I really don't see any software product that will solve social engineering tactics.

            • Re: (Score:2, Interesting)

              by TheSeer2 ( 949925 )
              NoScript blocks certain activities by default without any option of re-enabling them. I used to use NoScript but after it interfered with a website I used regularly (this was on my NoScript allow list) I had to abandon it.
        • I'd rather decide which scripts run, and which do not. Noscript does that and does that well. I won't install Firefox without it. :)
        • I use NoScript all the time. If I get to a page who's scripts I _want_ I allow them, or temporarily allow them.

          I don't miss much except for the bullcrap. Yea, it takes all of a keystroke or a context menu selection whenever I decided I want "the full web experience".

          The truth is, most of the time, nobody _wants_ "the full web experience."

          Live and Learn... give it a try for a while and you will get hooked (unless you are incredibly lazy, which I am also, sometimes. 8-)

      • Comment removed (Score:5, Informative)

        by account_deleted ( 4530225 ) on Monday June 04, 2007 @09:43PM (#19391093)
        Comment removed based on user account deletion

      • Re: (Score:3, Interesting)

        by egr ( 932620 )
        first two works on my Fedora 7 (Firefox 2.0.0.4 without NoScript), NoScript is not a part of Firefox so I think it should be really tested without it, however the last one didn't work, instead it asked me to download html page with download manager
      • It says in the advisory that javascript is used to inject the exploit. Disabling javascript, whether manually or through NoScript is obviously going to cause the demo to fail. That doesn't mean that your version of Firefox is not vulnerable though, it just means javascript is required to exploit the vulnerability.

        • Re: (Score:2)

          by rts008 ( 812749 )
          Thanks for the reply!

          You make an excellent point.

          Also, thanks for the clarification. What this means to me is that I can go into the settings in IE 7 on my wife's PC (WinXP Pro SP2...so far I cannot get her to switch to Linux) and discourage this crap.

          Anymore, just connecting to the internet is like fighting the Borg...they always adapt to the frequencies and continue to try to assimilate all.

          • You can also install Firefox and use one of the IE-look-alike themes. I have one for Luna at home (the XP Fisher-Price interface) and one for Vista at work, and suddenly Firefox behaves a lot like IE. You can also set IE Tabs and have it open IE-only sites on an IE tab by default, this requires nothing more than two mouse clicks. Obviously, you need to get IE patched up if you are going to use IE tabs =)

            Then you can slowly add nifty FF extensions and slowly win her over to the Dark Side, bwahahaha... er, t

      • Im not sure these even worked on me... sure, I still use Firefox 1.5.0.8. Haven't had a reason to upgrade. Maybe I still shouldn't.
      • The test cases linked to on Bugzilla require scripting. I'd link you to the document, but that wouldn't work from here, so you'll have to dig them out of Bugzilla yourself. They're on the non-duplicate bug page, the one from the middle of May.

  • Woot! (Score:4, Funny)

    by Anonymous Coward on Monday June 04, 2007 @08:40PM (#19390531)
    Wow, I'm so glad I installed Firefox so I'm immune to all of these IE bugs!

    Oh, wait, what did that say?

    -AC

    • Re:Woot! (Score:5, Funny)

      by Mark_in_Brazil ( 537925 ) on Tuesday June 05, 2007 @01:01AM (#19392503)

      Wow, I'm so glad I installed Firefox so I'm immune to all of these IE bugs!

      Oh, wait, what did that say?
      It said the only critical flaw in the bunch is in MSIE 6 only.

      This has been another edition of Easy Answers to Stupid Astroturfer Questions.

  • Victim Statistics? (Score:5, Insightful)

    by Anonymous Coward on Monday June 04, 2007 @08:41PM (#19390539)
    Perhaps I'm ignorant, but does anyone ever find themselves a victim of these "gaping holes"? I can't say as I've ever browsed on to a site and found myself the victim of a compromised computer or ended up with viruses. Is there a site/blog that reports such statistics?

    • Re: (Score:3, Informative)

      by eli pabst ( 948845 )
      There are a shitload of sites that host malicious code to intentionally infect vulnerable browsers. Even regular sites are occasionally hacked to host malicious code. The most recent big name one I can think of is the Miami Dolphins football team website during the last superbowl. A few years back a number of sites that produce banner advertisements were hacked, which resulted in widespread malicious banners getting hosted on tons of otherwise secure sites. I don't know of any database of malicious webs

    • Are you sure? (Score:5, Insightful)

      by kybred ( 795293 ) on Monday June 04, 2007 @09:56PM (#19391189)
      I can't say as I've ever browsed on to a site and found myself the victim of a compromised computer or ended up with viruses that I know of.

      There, fixed that for you.

  • Gaping holes? (Score:5, Funny)

    by Paktu ( 1103861 ) on Monday June 04, 2007 @08:44PM (#19390567)
    Article tagged as goatse.

    • Re:Gaping holes? (Score:4, Interesting)

      by evanbd ( 210358 ) on Monday June 04, 2007 @09:17PM (#19390875)
      Is it just me, or are the more humorous / inane tags showing up less? "duh" "haha" "itsatrap" and friends. Is this because the slashdot editors changed something, or because people are using them less?

      • Re: (Score:2)

        by Nimey ( 114278 )
        Do you really think *this* crowd would use those tags less? Or any established Internet forum?

        Taco changed the code; I'm guessing to disallow the stupid tags that got put on almost every story, like those you mentioned. Maybe to greylist those who kept tagging that way, too.

        Taco, got anything to say?

        • Re:Gaping holes? (Score:5, Interesting)

          by dkf ( 304284 ) <donal.k.fellows@manchester.ac.uk> on Tuesday June 05, 2007 @03:59AM (#19393563) Homepage

          Taco changed the code; I'm guessing to disallow the stupid tags that got put on almost every story, like those you mentioned. Maybe to greylist those who kept tagging that way, too.
          I think there's a list of tags that are permitted (blacklisting tags would be easier to route around by finding alternate things that mean the same thing) but as far as I can see, there's no downside to using a non-blessed tag; it just gets dropped on the floor.

          I think it's a shame though; the old tagging system added a good bit of fun to the site, and the "joke" tags were sometimes very appropriate indeed. The new system is just boring crap that reproduces what is already in there from the article categories or a simple search of the part of the story on the front page; a search engine could do those tags, or even plain old grep, and so they add nothing of value. The old system was better because it provided a snapshot of what people thought about the story, despite being much more open to abuse.

          Bring back the open tags! Please!

      • Is it just me, or are the more humorous / inane tags showing up less? "duh" "haha" "itsatrap" and friends. Is this because the slashdot editors changed something, or because people are using them less?

        My first reaction was that people had gotten bored with the joke tags. This is the internet, after all, and internet fads fade with time just as the real-world ones do -- faster, even.

        Then I remembered that a few days ago I saw people commenting on pouring hot grits down pants, and petrified Natalie Portm

        • and internet fads fade with time

          Really? I [hampsterdance.com] am [allyourbas...ngtous.com] not [badgerbadgerbadger.com] sure [facebook.com] I [myspace.com] agree. [slashdot.org]

      • Re: (Score:2)

        by sr180 ( 700526 )
        Possibly like how the dupe tag doesnt work anymore.
  • In order to be affected, doesn't one first have to go to the shady site that has this stuff scripted in the page? Yes, this may be a bug, but like a web page-bound virus, is one that the user has to inflict upon himself by going to a site he probably shouldn't be going to in the first place.

    • Re: (Score:3, Insightful)

      by afidel ( 530433 )
      Hacker hijacks web server of popular site, but instead of simply defacing the front page the slip in a little bit of code to release a botnet installer or adware installer based on this type of vulnerability. It happens all the time.

    • Re:But in order to be affected... (Score:5, Informative)

      by snowraver1 ( 1052510 ) on Monday June 04, 2007 @09:53PM (#19391167)
      It's called a Man-in-the-middle attack. Say you go to google.ca (I'm Canadian) It goes something like this:

      You> Yo DNS server, I wanna Talk to google.

      DNS> Roger that! Go to 72.14.253.103.

      You> Yo 72.14.253.103 Whacha got?

      72.14.253.103>Index.html

      You> Looks like Index.html says I need the google picture.

      Eve (Eve is sitting at the same coffee shop as you. Eve is bad)> Ahem, err, sir, I have this envelope for you. It's from google. It contains your picture. *Sniker*. (You don't notice the snicker)

      You> OH N0E$! TH3 P1CtUr3 us3d a buff3r ov3rflow vuln3rab1lity and n0w you have a virus that mak3s you typ3 lik3 a n00b!

      For more information look here: http://en.wikipedia.org/wiki/Man_in_the_middle_att ack [wikipedia.org]
    • Two problems with your theory:
      1. Hackers can post to message boards messages containing innocent-looking links to "bad" sites. This happened to me years ago at IGN's boards, before I started checking the status bar to see what the actual URL of a link was before clicking it.

      2. Hackers sometimes hack legit sites and inject script code into them (normally at the end of the page), so that visiting a legit sites runs mal-script.

    • Re:But in order to be affected... (Score:5, Interesting)

      by Bob of Dole ( 453013 ) on Monday June 04, 2007 @10:34PM (#19391519) Journal
      Don't be so sure that avoiding "shady" sites will protect you.
      I run a few perfectly un-shady sites (an imageboard, a specialized search engine, and a funny images repository), but recently some users started complaining about the popups that were trying to install spyware.
      I don't have any popups on my sites! (I don't even use target="_new"!) but still users were getting spyware popups. The popups were so evil that the only way to avoid getting redirected to the spyware site was to disable javascript (Even in firefox. in IE it just installed the spyware automatically, but firefox at least you had to click "download". Still, it made my site unusable)

      I went into my advertisers control panel, checked for anything remotely shady. Nothing. I tried turning off all third party advertisers (like doubleclick), figuring maybe one of them was redirecting users. Nope, some users still got popups. Worst of all, I NEVER got the popup, no matter what browser I was using.

      It turns out it's cause I'm an American. The advertiser had specified that the advert with the embedded redirect only show up in every country except America. That stopped me from seeing it on the site, but what about the control panel? I could see all the ads there, even the ones not targeted at my location. Here's what they did in actionscript: (pseudocode)

      if getTimeZone() in EUROPE_TIMEZONES:
          redirectToSpyware()
      else:
          displayHarmlessAdvert()

      So even when I checked the ads in the control panel they looked fine.

      My point is, don't think there's a scary corner of the internet where all the spyware/exploits hang out. The bastards making this crap know that most people don't go to those kinds of places, so they'll do anything they can to sneak their crap onto legitimate sites. (MySpace got hit with one of these a few months back, I think)

      • Re:But in order to be affected... (Score:5, Insightful)

        by beyondkaoru ( 1008447 ) on Monday June 04, 2007 @11:38PM (#19391993) Homepage
        ok, i'm not a web developer so i wouldn't know, but is there any way to force your advertisers (malicious or otherwise) to not use javascript/flash/whatever? since it's essentially running code we don't trust on the client's computer...

        essentially, do the noscript thing on your own servers, or host ads (i assume they're mostly just pictures with links) on your own servers somehow.

        • Brilliant (Score:5, Interesting)

          by zCyl ( 14362 ) on Tuesday June 05, 2007 @03:03AM (#19393249)

          ok, i'm not a web developer so i wouldn't know, but is there any way to force your advertisers (malicious or otherwise) to not use javascript/flash/whatever? since it's essentially running code we don't trust on the client's computer...

          essentially, do the noscript thing on your own servers, or host ads (i assume they're mostly just pictures with links) on your own servers somehow.

          That's the most brilliant idea I've seen in this entire thread so far. We need a <noscript>, or perhaps a <sandbox></sandbox> tag which allows us to specify what can be done inside of a frame, embedded object, or anything else linked to from a remote site.

          That would make a huge difference.
      • I've been using their "free" basic service for years; it was always their small little 16x16/32x32 icon; not really intrusive.

        Then suddenly my pages using their stats service had a nasty pop-under. I've seen this at other sites too and found out the "new" advertisement ways after a few weeks when I started getting bothered seeing the same pop-unders over and over while I wasn't even on any other sites.

        These pop-unders were all activated under Firefox and it's clearly in their TOS they can advertise on websi

      • Re: (Score:2)

        by TheLink ( 130905 )
        From the perspective of a web application programmer and security consultant, I think it would be very useful to have HTML tags to mark HTML
        sections where active content should be disabled, possibly selected active content.

        Right now the HTML environment with respect to potentially dangerous
        content is:
        In order to stop, you must make sure that none of the 1001 GO buttons were
        pressed before. There is no STOP button. No Big Red Emergency Stop button.

        This seems to be a disaster prone situation. Like driving a ca
    • unless because he went to the site by accident by typo error like www.goggle.com. i don't know but you but i've made plenty of typos while typing web addresses.

  • Didn't learn lesson from javascript (Score:5, Insightful)

    by mrcaseyj ( 902945 ) on Monday June 04, 2007 @08:44PM (#19390573)
    They said they could make javascript secure but it's still a huge source of holes. Instead of learning our lesson, Flash, another executable web format is taking over. Don't use flash because it's cool. Only use it if you really need it for your web page.


    And if Ubuntu was really concerned about security they would ship it by default with a web browser already set up under a separate username with strict selinux policies.

    • I don't know if anyone has done a count, but it seems like every time I look at a report of a major security problem in some browser it is Javascript or ActiveX or something similar where the browser locally executes code served up by the server.

      We all knew back in the early days of Javascript that it would be a security nightmare. But we (collectively) went ahead with it. We put together web pages that depended on it, so browsers had to support it and users had to enable it. Now we've waited so long

    • Re: (Score:3, Interesting)

      by foniksonik ( 573572 )
      When the browsers provide support for seamless SVG that gets push data from a socket connection I'll stop using Flash. When browsers provide seamless client side data validation and inline error prompting for forms, I'll stop using Javascript.

      Any web page that can't benefit from the above uses of the technology probably isn't all that more informative than an email would be.

      Static information is useful but stateless information is becoming useless. This is interactive media... not a book that you can access

  • alternatives (Score:5, Insightful)

    by sudo ( 194998 ) on Monday June 04, 2007 @08:46PM (#19390577) Homepage
    Well there's always Opera?

  • Lynx (Score:2, Funny)

    by Anonymous Coward
    I use Lynx, you insolent clod! Get off my lawn!

  • One of the demos on Firefox doesn't work (Score:4, Informative)

    by ericferris ( 1087061 ) on Monday June 04, 2007 @08:47PM (#19390597) Homepage
    I am using the latest Firefox 1.5. I went to the demo page : http://lcamtuf.coredump.cx/ifsnatch/ [coredump.cx] . The first test shows that it is possible to rewrite the content of an iframe. That is rather dangerous in situations involving trusted messages.

    The 2nd demo was supposed to snoop on the keyboad, but it invoked a pop-up, which was immediately blocked by the pop-up blocker. So unconfimed as far as I know. However, the demo page did open a CNN.com page.

    Anyone has better "luck" to demo the keyboard snooping?

  • Sounds like Terrorist to me. (Score:5, Funny)

    by 3seas ( 184403 ) on Monday June 04, 2007 @08:49PM (#19390629) Homepage Journal
    cookie STEALING, page HIJACKING, memory CORRUPTION, code EXECUTION, and URL bar spoofing ATTACKS.

    So where the fuck is home land security when you need them.

  • Go old NoScript (Score:5, Insightful)

    by Nutsquasher ( 543657 ) on Monday June 04, 2007 @08:50PM (#19390643)
    Keeps all of that Firefox JavaScript nastiness at bay, plus flash ads to boot. :)

    • Re: (Score:3, Insightful)

      by Bender0x7D1 ( 536254 )

      Yes, that is a solution, but it isn't a good solution.

      If we continue down that line of thought we end up at the point where we just go back to static pages with no scripting. Now, in general, I prefer static pages without all the extra "eye-candy", but I also understand the benefits of having scripting, (and even flash) running. By even having a preference for static pages, I think I am in the minority of people on the Internet. Let's face it, the average person likes all of the "extras" that come with

      • Re:Go old NoScript (Score:4, Insightful)

        by MLease ( 652529 ) on Monday June 04, 2007 @09:31PM (#19390997)
        When I want to allow flash or a script to run, it's easy enough to do. The point of NoScript is that nothing runs without my explicit consent, just because I happened to visit a website. If I allow something malicious to run, it's my own fault.

        -Mike
      • It is an excellent solution. Your post leaves me with the impression that you don't know what NoScript [noscript.net] is. NoScript is a Firefox extension that allows a user to selectively enable JavaScript for web sites.

        If we continue down that line of thought we end up at the point where we just go back to static pages with no scripting.

        I already do that. I only have JavaScript enabled for about 20 web sites. I've found out that I'm not missing anything as most web sites function perfectly without JavaScript enabled.

  • I'm not familiar with iframes, but would not running javascript on untrusted webpages protect from this?

  • First to fix? (Score:2, Insightful)

    by doctor_nation ( 924358 )
    Anyone want to wager on who has this hole fixed first, IE or Firefox?

    • Re: (Score:3, Interesting)

      by KarmaMB84 ( 743001 )
      Microsoft has to be a lot more careful about breaking third party crap with a browser fix so obviously Firefox will get patched first.

  • Slashdot responses (Score:5, Insightful)

    by Frankie70 ( 803801 ) on Monday June 04, 2007 @09:22PM (#19390923)
    1) If Article Posted about IE security bugs
        - Regular mudfest, everyone throwing mud on Microsoft
    & IE. Everyone saying I have FF/Linux/Safari whatever,
    so I am safe. Nobody talks about changing settings,
    disabling javascript or Activex as a good workaround.

    2) If Article Posted about FF security bugs
        - Lot of workarounds posted - disable Javascript,
    get some plugin, change some settings, don't go to
    the website etc. How great that the it is open source,
    someone will fix the bug in one hour & release patch.
    Bugs are avenues to show how great open source is.

    Now both are posted together, let's collate responses
    at the end of the day
    • I run Microsoft Windows XP SP2, so I am safe. IE users can simply disable JavaScript in the control panel - any user of closed source knows how to do that! Plus, they don't even have to go to the web site. Microsoft will fix the bug by the next Tuesday of the next month, which is an AMAZING response time, don't you think! The best thing about closed source is you don't have hackers accessing it!

      Now, as far as Firefox, that STUPID Mozilla Foundation makes some of the most amateur mistakes! They can't even fo

      • Re: (Score:3, Funny)

        by jez9999 ( 618189 )
        I run Microsoft Windows 95 unpatched, so I am safe. No-one targets this old piece of crap anymore!

  • Another Firefox vulnerability posted today (Score:4, Informative)

    by whitehatlurker ( 867714 ) on Monday June 04, 2007 @09:47PM (#19391121) Journal
    Thor Larholm also announced a Firefox hole [larholm.com] today. Wasn't completely patched in the last release.

  • CrashZilla (Score:2, Informative)

    by EEPROMS ( 889169 )
    Ive renamed Firefox "CrashZilla", it would be nice to browse the web for more than 1 hour without it freezing up or crashing. Yes I have the latest version and all the latest plugins. I have no issues with Konqueror on KDE 3.5.7 (using the same plugins) and Firefox 1.5.* ran for days without crashes.

    • Re: (Score:2)

      by laffer1 ( 701823 )
      Yes, the newer versions of Firefox seem to crash often. I've had 2.0.0.4 crash on me 4 times today in Vista and it crashes on OS X and MidnightBSD as well. (MBSD is using the linux version) It tends to happen on sites that use plugins. I've seen it with Flash sites, and anything loading quicktime. The linux version crashed on JavaScript heavy sites. I have absolutely no plugins or extensions installed in that version. My OS X version also does not use any extensions.

      Safari is crashing in OS X after t

      • Re: (Score:2)

        by Kelson ( 129150 ) *

        I haven't looked at the exploits, but considering both browsers are affected, it makes me wonder if there is a common behavior or something implied in various web standards which led to this problem.


        Nope. The exploits in Firefox and IE are completely separate -- just announced at the same time.

    • You probably have a corrupted profile. Try with a new profile. That usually fixes crashes like that.
  • Cue website installing a WoW password stealer in 3, 2, 1 ...

  • Doesn't seem to bother us (Score:4, Insightful)

    by myxiplx ( 906307 ) on Tuesday June 05, 2007 @05:09AM (#19393877)
    Here at work we use IE6 on XP SP2 workstations and not a single one of those vulnerabilities affects us.

    Why? Because we don't let IE run scripts of any kind unless it's from a site we trust. IE has had security zones for years yet hardly anyone uses them. A single group policy object enforces our list of trusted sites, nobody's computer can run javascript on any site we've not already decided is safe.

    Ok, there's a small risk of someone hacking one of our trusted sites, but I can live with that.

    So far we've had 2 years of uninterrupted browsing, with nobody at our company getting a single piece of malware on their machine.

    And the best bit: It's surprisingly low maintenance. We get maybe one request a month now to add a new site to the list.

Slashdot Top Deals

Trap full -- please empty.

Close