AJAXify your Wordpress

Learn how I ajaxified my wordpress blog with these few steps...

SBS Show!

Listen to the latest episode of the SBS Show, Dave Sobel talks about process management...

Vladville Newsletter!

Looking for a more focused, exclusive insight into the world of SMB tech & business? Sign up for my newsletter!

Internet Explorer Exploit
Posted: 11:42 am
November 21st, 2005
Post a comment
Security

According to SANS: The UK group "Computer Terrorism" released a proof of concept exploit against patched versions of Internet Explorer. We verified that the code is working on a fully patched Windows XP system with default configuration. The bug uses a problem in the javascript 'Window()' function, if run from 'onload'. 'onload' is an argument to the HTML body tag, and is used to execute javascript as the page loads. Impact: Arbitrary executables may be executed without user interaction. The PoC demo as tested by us will launch the calculator (calc.exe). Mitigation: Turn off javascript, or use an alternative browser (Opera, Firefox). If you happen to use Firefox: This bug is not affecting firefox. But others may. For firefox, the extnion 'noscript' can be used to easily allow Javascript for selected sites only.

4 Comments

Dave |

I’ll save you the trouble.

http://www.getfirefox.com

Haven’t we had enough problems with IE to just kill it once and for all?



SBSRocks |

Dave,

Obviously you don’t work in Corporate World. IE is used to access many 1000s of Legacy apps.

Vlad is pointing to a none vulnerability and recommending Firefox as an alternative and you turn it into a getfirefox rant.

Microsoft is making a great effort to embrace Firefox, see: http://www.informationweek.com/story/showArticle.jhtml?articleID=174400315



Jprice |

Vlad is not advocating Firefox, he just copied the post at SANS word for word.

I on the other hand am a big fan. Most of the problems that come up are exploits of javascript and activex, the latter only associated with IE. If its so big in corporate networks, its use should be restricted to the corporate network space and they should use a more secure web browser to access Internet resources.

IE at this point causes more problems than good. With rise of AJAX I hope everyone is developing outside of Microsofts flawed and security-lacking browser.



SBSRocks |

First, allow me to edit my english. “none” should read known. Second, Let me explain that many of these IE accesses are behind many many firewalls.

If corp moved to Firefox they would then be inline for all firefox vulnerabilities. It isn’t about the browser but about what is deployed and what business reason there is to move or change. MBA’s rule in corporate space.








 

Categories

 

Archives

 

About

Divider Divider