Jump to content

Home

Microsoft Acknowledges Devastating IE Bug


CaptainRAVE

Recommended Posts

Microsoft has acknowledged a devastating flaw in their Internet Explorer browser, which allows hackers to bypass safeguards in downloading programs, to execute malicious code. Microsoft Outlook and Outlook Express are also affected.

 

Microsoft has known about the problem since mid-November, but is only just now getting around to testing a patch to fix the problem.

 

Microsoft has declined to release exact details about the bug, saying it is too severe to accidentally divulge how to take advantage of it. Recently, MS was forced to release a patch for another IE bug, which had a flaw in how cookies were handled.

Link to comment
Share on other sites

That bug was discovered by Georgi Guninski. Basically, IE lets you put a layer with a specific z-index over the download verification box...so basically someone could spoof the name of the download.

Example:

veryBadVirus.exe can show up as funnyPicture.jpg with some clever coding.

Link to comment
Share on other sites

Well, I expect no less from Microsoft. I know they are a prime target for hackers, who are always coming up with new work-arounds, but it still proves MS is not vigilant enough in testing the loopholes in their own software. They are also known to drag their heels to correct such problems, which is not very helpful.

 

Having said that, I don't think switching to other browsers, etc., will necessarily solve the problem. It seems the more popular certain software becomes, there are always those waiting in the wings ready to exploit it's bugs.

 

It does seem to me, though, that MS should be building in more rigid self-monitoring into their software to try and combat the problem.

Link to comment
Share on other sites

Yeah I haven't been feeling too benevolent towards microsoft lately myself... though I don't condone the use of malicious hacker code to cause trouble to innocent people. ; p

 

They bought up my ISP and forced my roommate and I to switch over to MSN's service (which is apparently some of the lowest rated service anywhere). Due to one of their "security requirements" and an apparent design flaw, I am forced to use not one, but TWO email programs, one to send, and one to recieve. Needless to say that forcing me to use Outlook after all these years chews the big one. Apparently the very nature of the program and all of its fun script-easy interface leaves it with as many holes as a piece of swiss cheese. Sadly, I have no other choice, other than using crappy web based, or text only email clients. Really sucks having more than one account.. ; p

 

I keep myself up to date as best I can, but then I still have to wait for the fixes to actually get released.

 

Kurgan

Link to comment
Share on other sites

Originally posted by Tie Guy

Well, i'm glad that IE6 didn't work for some reason and i was forced to keep IE5. I'll switch after they get the patch out though....i guess.

 

Yes, I had that problem and ended up using IE5 again. For some reason IE6 kept crashing every single time I loaded it up......it began to really try my patience :mad: ......anyway, I prefer IE5, its much much better in my opinion....actually, its pretty much the same, lol.

Link to comment
Share on other sites

Originally posted by CaptainRAVE

 

Yes, I had that problem and ended up using IE5 again. For some reason IE6 kept crashing every single time I loaded it up......it began to really try my patience :mad: ......anyway, I prefer IE5, its much much better in my opinion....actually, its pretty much the same, lol.

 

Yeah, IE 6 crashes on me all the ti-.....................

Link to comment
Share on other sites

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...