 |
 | Home | Contact Us | FAQ | Search & Site Map | Link to Us |
 | Sign In | Join | Other 45 Sites in Network |
Medical Forum / Diseases and Disorders / Arthritis / January 2005New security problems with IE
IE Flaw Exploited I wish firefox worked better on my machine. Yes Mike I know Iinux is absolutely the perfect operating system however I can't use any of my speciaty software. Security firm identifies exploit technique for known browser hole. Matthew Broersma, Techworld.com Friday, January 07, 2005 Internet Explorer has become an even bigger security risk--even under Windows XP SP2--with the publication of a new and extensive exploit. Security researchers have warned that the exploit, which takes advantage of known loopholes in SP2, could allow an attacker to run script code on a user's system via a specially crafted Web page. Known Hole The holes involved have been known publicly for more than two months, but previous exploit techniques required the user to take actions such as dragging an image from one part of a Web page to another. The new exploit--a demonstration of which has been published by Danish security firm Secunia--is fully automated, requiring the user only to visit a Web page in Explorer. Other browsers and operating systems aren't affected. "There now is a 'reliable' working exploit that can compromise an SP2 system by just visiting a Web page," says Secunia chief technology officer Thomas Kristensen. Secunia has raised its warning level to its highest, "extremely critical." Security group Greyhats warned of the new type of exploit in an advisory in late December. Secunia then upgraded its advisory to "extremely critical" and published a demonstration based on a proof-of-concept by a researcher known as ShredderSub7. US-CERT, the U.S. computer security alert organization, has also published an advisory on the issue. Issues Identified Microsoft has warned users to turn off IE's 'Drag and drop or copy and paste files' option as a partial solution. The danger can also be lessened by setting security levels to high for the 'Internet' zone or, as several security firms pointed out, using another browser. The exploit is the first major weakness in SP2 to have surfaced. Microsoft is promoting SP2, released last summer, as a solution to many of Windows' worst security problems. Researchers have identified three separate but related issues in IE: a bug in the validation of certain drag-and-drop events, and zone restriction errors with embedded HTML Help ActiveX controls. The first problem can be avoided by disabling the 'Drag and drop or copy and paste files' option, but the new exploit doesn't rely on this particular bug, researchers said. The HTML Help control exploit bypasses one of SP2's key features, the 'Local Machine' zone lock down, designed to make it far more difficult for attackers to execute script on a local system. Visit my website: http://www.mzuschlag.com > IE Flaw Exploited > > I wish firefox worked better on my machine. > Visit my website: http://www.mzuschlag.com Firefox isn't the only browser available at http://www.mozilla.org/ I use Mozilla 1.7.5 & it works great. Have you tried firefox 1.0 yet? GramPaHugs, Alex, -- Any information is included for informational or entertainment purposes only, is based on my personal experiences & is an expression of my opinion. No endorsement is implied or intended. **************************************************** * Love radiating from 45.10n x 93.30w M/SP Mn * <a href="http://home.mn.rr.com/apbiii">AOL Click</a> * <a href="http://grampahugs.ath.cx/">AOL Click</a> **************************************************** >Firefox isn't the only browser available at http://www.mozilla.org/ > >I use Mozilla 1.7.5 & it works great. Have you tried firefox 1.0 yet? I tried Firefox 1.0. In the past I had trouble with netscape (stability), but I will give Mozilla a try. Wish I could pinpoint the problem. -- MZ Visit my website: http://www.mzuschlag.com > >Firefox isn't the only browser available at http://www.mozilla.org/ > > [quoted text clipped - 6 lines] > Visit my website: > http://www.mzuschlag.com Just a thought here but... How long is it since you did a full disk-wipe and a fresh install of your OS? Crap builds up at a rate of knots in Windows, and, due to the humungously stupid practice of having ALL configs in one HUGE and VOLATILE central "registry" (that anything can write to!), the cock-ups will just keep growing until something crashes. On the subject of needing to use certain Windows specific proggies, how about dual-booting? You can install both Windows AND a Linux OS on the same machine, and just chose which one you want to use at any given time. Assuming you have a few Gb free that is. :\  Signature--------------------------- http://tinyurl.com/4872c Have a nice day, it really does do you good! :) Alex, I'm using .8, what do I gain with 1.0. Sorry it's not working for you Mary, it's got some great features besides the added security. Cooly >> IE Flaw Exploited >> [quoted text clipped - 8 lines] > GramPaHugs, > Alex, >>Alex, I'm using .8, what do I gain with 1.0. They just announced today that Firefox 0.8 has security flaws, so going to 1.0 will get you around those flaws. >>Sorry it's not working for >>you Mary, it's got some great features besides the added security. But it is slow on older systems (All of the Mozilla based apps are slow on older systems) > Alex, I'm using .8, what do I gain with 1.0. Sorry it's not > working for you Mary, it's got some great features besides the > added security. Cooly You probably wouldn't notice a lot of difference Cooly. They cleaned up a few incompatibility problems with XP SP2 & improved java security, pop up control, etc. so you would have a more secure browser. GramPaHugs, Alex, -- Any information is included for informational or entertainment purposes only, is based on my personal experiences & is an expression of my opinion. No endorsement is implied or intended. **************************************************** * Love radiating from 45.10n x 93.30w M/SP Mn * <a href="http://home.mn.rr.com/apbiii">AOL Click</a> * <a href="http://grampahugs.ath.cx/">AOL Click</a> **************************************************** Thanks Alex and Brad too. Cooly >> Alex, I'm using .8, what do I gain with 1.0. Sorry it's not >> working for you Mary, it's got some great features besides the [quoted text clipped - 6 lines] > GramPaHugs, > Alex, Alex wrote to Mary: > Firefox isn't the only browser available at http://www.mozilla.org/ > > I use Mozilla 1.7.5 & it works great. Have you tried firefox 1.0 yet? Alex, I installed and attempted to use Mozilla. But it will NOT allow a search from my selected home page. > Alex wrote to Mary: > [quoted text clipped - 7 lines] > > But it will NOT allow a search from my selected home page. Does that page require a special plug-in? Goto Edit, Preferences, Navigator, Helper Applications , At the bottom of the page put a check in the Plug-in Finder Service & the program will look for the plug-in. Also be sure that at Navigator, Internet Search, the Default Search Engine is set to your choice. HTH, GramPaHugs, Alex, -- Any information is included for informational or entertainment purposes only, is based on my personal experiences & is an expression of my opinion. No endorsement is implied or intended. **************************************************** * Love radiating from 45.10n x 93.30w M/SP Mn * <a href="http://home.mn.rr.com/apbiii">AOL Click</a> * <a href="http://grampahugs.ath.cx/">AOL Click</a> **************************************************** After reading your post, I decided to download both Fire fox (Internet) and Thunder bird (mail and newsgroups). So far so good. IE/OE and Comcast were a frustrating combo. > After reading your post, I decided to download both Fire fox (Internet) > and Thunder bird (mail and newsgroups). So far so good. IE/OE and > Comcast were a frustrating combo. I use Firefox and Thunderbird, too, and am very pleased with them. I have Win Me on a Dell Optiplex GX1 128 MB RAM (originally 64 MB). It's a slow PC but does do a bit better since I added the extra 64 MB. The only time I use IE is when there's no way around it. Firefox is my default browser. Nell >I use Firefox and Thunderbird, too, and am very pleased with them. I >have Win Me on a Dell Optiplex GX1 128 MB RAM (originally 64 MB). It's a >slow PC but does do a bit better since I added the extra 64 MB. > >The only time I use IE is when there's no way around it. Firefox is my >default browser. Damn I am green with envy I have a 1.7 ghz AMD processor with 512 Ram and Firefox crashes every 3-4 minutes. I down loaded with everything off AV, firewall, ad muncher. Still it crashed finally I uninstalled it. grrrrrr. -- MZ Visit my website: http://www.mzuschlag.com >>I use Firefox and Thunderbird, too, and am very pleased with them. I >>have Win Me on a Dell Optiplex GX1 128 MB RAM (originally 64 MB). It's a [quoted text clipped - 10 lines] > Visit my website: > http://www.mzuschlag.com Don't be too envious. Firefox and comcast aren't talking nice right now. I am getting failed SMTP messages when I try to send, not that I know what that means. Adelle >>> I use Firefox and Thunderbird, too, and am very pleased with them. I >>> have Win Me on a Dell Optiplex GX1 128 MB RAM (originally 64 MB). [quoted text clipped - 16 lines] > > Adelle I usually use Thunderbird for my mail but I decided to send from Comcast's message center to a Yahoo account I have and it went rhought fine. For some time, though, Comcast really didn't play nice. None of the links worked worth a darn and clicking on them would get me a .swf or whatever that advertised NFL on Comcast. That's when I would click on the message center, games, what-have-you. Calling Comcast wasn't any use. The ditz in "customer service" (hardee har har) wasn't having a problem so I shouldn't have. I didn't use the homepage for weeks and then one day, without me changing a thing, Comcast's page and it's links worked properly. It did work all that time in IE and my mail popped just fine into and out of Thunderbird, even going through an SMTP route that my antivirus (Avast!) was using. I get the feeling with the popularity of Firefox that they got a lot of compatibilty problem calls and finally fixed it. Nell Ok one more try with firefox. I installed it and it has crashed twice so far. I just wondered if I could post. So I am posting via google and firefox... Oh well...... MZ > Ok one more try with firefox. I installed it and it has > crashed twice so far. I just wondered if I could post. So I > am posting via google and firefox... Oh well...... MZ The only thing I can think of that could be causing your crashes is, Firefox has it's own Java engine & it may be conflicting with another Java engine you have running. Have you tried Thunderbird for Mail - News? GramPaHugs, Alex, -- Any information is included for informational or entertainment purposes only, is based on my personal experiences & is an expression of my opinion. No endorsement is implied or intended. **************************************************** * Love radiating from 45.10n x 93.30w M/SP Mn * <a href="http://home.mn.rr.com/apbiii">AOL Click</a> * <a href="http://grampahugs.ath.cx/">AOL Click</a> **************************************************** > > Ok one more try with firefox. I installed it and it has > > crashed twice so far. I just wondered if I could post. So I [quoted text clipped - 3 lines] > is, Firefox has it's own Java engine & it may be conflicting with > another Java engine you have running. One thing I'm still hazy on, is why would a domestic user need a Java engine? It appears to me to be one of those things like HTML Email, a cute idea, but a massive security risk on an all but unsecurable OS like Windblows? (Prove me wrong people! ;) If you DO need to do external network interactions on this level, it would seem to me to be a better idea to set up some kind of VPN with the host you need to interact with, and I'd STILL not use an M$ OS for such a task. :( P.S. Maybe its the low barometric pressures and bad weather we've been having lately? Daft idea, but I had a poota like that once. Signature--------------------------- http://tinyurl.com/4872c Have a nice day, it really does do you good! :) Hi Mike, >> The only thing I can think of that could be causing your >> crashes is, Firefox has it's own Java engine & it may be >> conflicting with another Java engine you have running. > > One thing I'm still hazy on, is why would a domestic user need > a Java engine? Most windows programs (& possably some unix-linix) are written with visual c++ & can use java scripts to control them. A search on most computers for *.js will find many java script files that serve the same function as a dynamic link library (DLL) file. The advantage of a js file is that it can be edited with a text editor. > It appears to me to be one of those things like HTML Email, a > cute idea, but a massive security risk on an all but > unsecurable OS like Windblows? (Prove me wrong people! ;) Do you have a local search function on your non windows computer? Do a search for *.js & see what you find. > If you DO need to do external network interactions on this > level, it would seem to me to be a better idea to set up some > kind of VPN with the host you need to interact with, and I'd > STILL not use an M$ OS for such a task. :( Having a java engine usually has nothing to do with 'external network interactions'. A properly set up windows computer operated in a safe manner is just as secure as any other computer with any other operating system. > P.S. Maybe its the low barometric pressures and bad weather > we've been having lately? Daft idea, but I had a poota like > that once. GramPaHugs, Alex, -- Any information is included for informational or entertainment purposes only, is based on my personal experiences & is an expression of my opinion. No endorsement is implied or intended. **************************************************** * Love radiating from 45.10n x 93.30w M/SP Mn * <a href="http://home.mn.rr.com/apbiii">AOL Click</a> * <a href="http://grampahugs.ath.cx/">AOL Click</a> **************************************************** > Hi Mike, > [quoted text clipped - 10 lines] > serve the same function as a dynamic link library (DLL) file. The > advantage of a js file is that it can be edited with a text editor. ??? Are we talking about JavaScript here, or Java scripting, which is a completely different thing? > > It appears to me to be one of those things like HTML Email, a > > cute idea, but a massive security risk on an all but > > unsecurable OS like Windblows? (Prove me wrong people! ;) > > Do you have a local search function on your non windows computer? > Do a search for *.js & see what you find. Absolutely zip-diddley, coz I did not include it in my intall options. (Plus, I have a habit of ripping out anything and everything I don't need too, which you CAN'T DO with Windblows ;) > > If you DO need to do external network interactions on this > > level, it would seem to me to be a better idea to set up some [quoted text clipped - 3 lines] > Having a java engine usually has nothing to do with 'external > network interactions'. ??? Wha...? > A properly set up windows computer > operated in a safe manner is just as secure as any other computer > with any other operating system. Hmmm... Should I? ... Nope, too easy. Lets just say I disagree with this statement. A lot. I do think there might be a bit of confusion here about the difference between JavaScript (kinda useful), which is a Netscape originated extension tool for HTML functions, and Java (damn complicated!), which is nothing to do with JavaScript at all, is a full programming environment designed to be platform independant, and, apart from a few games, is very little use to the average domestic user, but can present a HUGE security risk. But you know that, right? ?:\ Signature--------------------------- http://tinyurl.com/4872c Have a nice day, it really does do you good! :) P.S. And I STILL don't have a clue as to why the average domestic web surfer would need a HUGE active bolt-on programming environment installed and running as if it was needed to collect Emails or something. :\ Signature--------------------------- http://tinyurl.com/4872c Have a nice day, it really does do you good! :) >> Hi Mike, >> Most windows programs (& possably some unix-linix) are >> written with visual c++ & can use java scripts to control [quoted text clipped - 5 lines] > ??? Are we talking about JavaScript here, or Java scripting, > which is a completely different thing? We aren't talking about the Java OS developed by Sun Microsystems which I do run now & then. >>> It appears to me to be one of those things like HTML >>> Email, a cute idea, but a massive security risk on an all >>> but unsecurable OS like Windblows? (Prove me wrong people! >>> ;) I've been (trying to) learning Sun Microsystems java programing & have had it installed on my last three computers & never had Any problems with it. Also I have never had a virus, worm, or any of that nasty stuff invade my windows systems which I've been running since 1989& I have run a web server on my windows systems since 1997. >> Do you have a local search function on your non windows >> computer? Do a search for *.js & see what you find. [quoted text clipped - 3 lines] > everything I don't need too, which you CAN'T DO with Windblows > ;) If you used any Mozilla based programs, Adobe Acrobat & many other common programs you would have found lots of files with .js extensions. > Hmmm... Should I? ... Nope, too easy. > > Lets just say I disagree with this statement. A lot. You have my IP, hack me. > I do think there might be a bit of confusion here about the > difference between JavaScript (kinda useful), which is a > Netscape originated extension tool for HTML functions, Which, as I've explained in previous messages, is what we're talking about. Is also a text based file system used with Visual C++ to customize program configurations. > and Java (damn complicated!), which is nothing to do with > JavaScript at all, is a full programming environment designed > to be platform independant, and, apart from a few games, is > very little use to the average domestic user, but can present > a HUGE security risk. & I doubt Mary is running unless the guy that built her computer installed it. > But you know that, right? ?:\ Know what? I know everything, I know so much I can't remember it all. ^_^ GramPaHugs, Alex, -- Any information is included for informational or entertainment purposes only, is based on my personal experiences & is an expression of my opinion. No endorsement is implied or intended. **************************************************** * Love radiating from 45.10n x 93.30w M/SP Mn * <a href="http://home.mn.rr.com/apbiii">AOL Click</a> * <a href="http://grampahugs.ath.cx/">AOL Click</a> **************************************************** >The only thing I can think of that could be causing your crashes >is, Firefox has it's own Java engine & it may be conflicting with > another Java engine you have running. > >Have you tried Thunderbird for Mail - News? I have not installed java in firefox I never got that far. I just installed it again and yesterday it was pretty good. After I rebooted the computer it only closed once. I was optimistic but today I used it for about 30 minutes and it crashed 2 or 3 times. Firefox simply shuts down sometimes it sends an error message and sometimes it just closes. I have not tried Thundebird for Mail- news. I use Forte agent and the full version of outlook. I downloaded Firefox and installed it with AV off and firewall off. I had a lot of the same trouble with Netscape 7 I finally took it off the system. I just ran scan disk so there should not be corrupt files all my other programs are stable. I don't' have spyware, I run regular scans with Ad aware, have most of the bad spyware sites in my restricted zone (I must have a couple hundred sites in restricted zone), ad muncher kills all advertising even embedded ads so no one can inadvertently click on a drive by download site. I think I will ask the local computer shop they built my machine and installed windows. I like buying computers locally I can talk with real people for free. -- MZ Visit my website: http://www.mzuschlag.com >> The only thing I can think of that could be causing your >> crashes is, Firefox has it's own Java engine & it may be [quoted text clipped - 4 lines] > I have not installed java in firefox I never got that far. I > just installed it again and yesterday it was pretty good. When you install Firefox you install the java engine, when you run Firefox you run the java engine. > I had a lot of the > same trouble with Netscape 7 I finally took it off the system. Netscape 7.x & Firefox use the same Mozilla core & both use java scripts. > I think I will ask the local computer shop > they built my machine and installed windows. I like buying > computers locally I can talk with real people for free. -- MZ Good idea. > Visit my website: http://www.mzuschlag.com GramPaHugs, Alex, -- Any information is included for informational or entertainment purposes only, is based on my personal experiences & is an expression of my opinion. No endorsement is implied or intended. **************************************************** * Love radiating from 45.10n x 93.30w M/SP Mn * <a href="http://home.mn.rr.com/apbiii">AOL Click</a> * <a href="http://grampahugs.ath.cx/">AOL Click</a> **************************************************** >When you install Firefox you install the java engine, when you >run Firefox you run the java engine. I thought you had to install Java on firefox? The faqs discuss it as a something that has to be added. I have a little Java script on my website and it does not run when I look at it in firefox. Interesting I thought it was an add on. -- MZ Visit my website: http://www.mzuschlag.com >> When you install Firefox you install the java engine, when >> you run Firefox you run the java engine. > > I thought you had to install Java on firefox? All Mozilla programs save each users custom settings in java script files on their computer. > The faqs > discuss it as a something that has to be added. I have a > little Java script on my website and it does not run when I > look at it in firefox. Interesting I thought it was an add on. > -- MZ What Firefox has to say about the java script on your website; Error: doc_els has no properties Source File: http://www.mzuschlag.com/animate.js Line: 105 Error : syntax error Source File: javascript:http://www.mzuschlag.com/ Line: 1 http://www.mzuschlag.com/ --------------------------^ This means you don't need the following / > Visit my website: http://www.mzuschlag.com HTH GramPaHugs, Alex, -- Any information is included for informational or entertainment purposes only, is based on my personal experiences & is an expression of my opinion. No endorsement is implied or intended. **************************************************** * Love radiating from 45.10n x 93.30w M/SP Mn * <a href="http://home.mn.rr.com/apbiii">AOL Click</a> * <a href="http://grampahugs.ath.cx/">AOL Click</a> **************************************************** I'm getting more and more convinced that there is a serious confusion about the difference between JavaScript, and Java here. You DON'T need a Java engine to run JavaScript. The two things are totally different, and not related, despite the similar name. > >> When you install Firefox you install the java engine, when > >> you run Firefox you run the java engine. [quoted text clipped - 40 lines] > * <a href="http://grampahugs.ath.cx/">AOL Click</a> > **************************************************** Signature--------------------------- http://tinyurl.com/4872c Have a nice day, it really does do you good! :) > I'm getting more and more convinced that there is a serious > confusion about the difference between JavaScript, and Java [quoted text clipped - 3 lines] > things are totally different, and not related, despite the > similar name. Don't worry about it. It's just a language problem. A software engine is part of a program that runs other code not included in the original compiled executable program. GramPaHugs, Alex, -- Any information is included for informational or entertainment purposes only, is based on my personal experiences & is an expression of my opinion. No endorsement is implied or intended. **************************************************** * Love radiating from 45.10n x 93.30w M/SP Mn * <a href="http://home.mn.rr.com/apbiii">AOL Click</a> * <a href="http://grampahugs.ath.cx/">AOL Click</a> **************************************************** >Don't worry about it. It's just a language problem. A software >engine is part of a program that runs other code not included in >the original compiled executable program. Obviously I don't know much about this! I will call the computer store and see what they suggest. I might never unravel this mystery. I sure wish Firefox would work, but in the meantime I have made IE as secure as possible. I have several gigs of music with more coming so I don't want to clutter up my hard drive with programs that don't work well. Linux will not work because of my speciality programs, and my ipod will not synch with Linux without some complex hacks. It is more than I want to tackle. I do slide shows with music and transitions I have superb program for the PC, and have no interest in changing to another program . -- mz Visit my website: http://www.mzuschlag.com > >Don't worry about it. It's just a language problem. A software > >engine is part of a program that runs other code not included in [quoted text clipped - 10 lines] > transitions I have superb program for the PC, and have no interest in > changing to another program . -- mz HTML is (simple text-based) code that your browser reads and presents you with the rendered version of, bold text instructions end up as bold text, and so on. JavaScript is an extension to the functions of HTML and adds a new layer of functionality to a webpage, including allowing those irritating popups to appear n'stuff etc. Java is a language all by itself, and needs an environment to run in, like your OS. In fact, its like an operating system, in fact, it IS an operating system of sorts, and can be run independant of what OS it is sitting on, and is "cross-platform" in nature. You could think of it as an OS sitting on another OS. There are various programs written to run in a Java environment. Unless you NEED these programs, its a good idea to not have a Java engine installed, as its just something else for a cracker/bot to recruit on your poota. And to finish... ;\ 1/ For almost any commercial program available for Windblows, there will be something that does the same job under UNIX/Linux, and probably better (and most likely already pre-installed in many distros). 2/ Installing Linux does NOT mean dumping your Windblows OS. You can install to some spare HDD space and dual-boot, chosing which OS you want to run at boot-time. This makes any transition a matter of being a leasure activity rather than a desperate panic to get the thing configured and working when you don't yet have a clue. :) 3/ Though any advice I'd offer would include an upgrade to at least Linux as you know my opinion of BillyBoy's tinker-toy by now, please don't feel pressured to "go there". Do be aware though that there are several things you can do to reduce the vunerabilities of Windblows, and those include getting rid of Active-X (SHUDDER!), uninstalling Java engines (unless absolutely required!) and using less insecure programs for interenet interactions, such as Opera for your default browser, and plain text-only Email and newsgroup proggies. A firewall would be good too. Whatever you do, all the best. Hope things get sorted soon. Signature--------------------------- http://tinyurl.com/4872c Have a nice day, it really does do you good! :) > > I'm getting more and more convinced that there is a serious > > confusion about the difference between JavaScript, and Java [quoted text clipped - 7 lines] > engine is part of a program that runs other code not included in > the original compiled executable program. Ok. :) Signature--------------------------- http://tinyurl.com/4872c Have a nice day, it really does do you good! :) > IE Flaw Exploited While on the subject, I've been looking into some hidden directories in windoze. Here's what I discovered in one such hidden directory and its subdirectories: Temporary Internet Files +H > Content.IE5 +H > leq5z8dd +H > 1,079 files > 6,.439,783 bytes > 49uv8en +H > 1,000 files > 2,039,347 bytes > yzi12lm1 +H > 1,329 files > 5,736,005 bytes > s1ajc11ez +H > 4,446 files > 36,599,137 bytes 50megabytes? Hidden to the eyes, except when the scumbag sites with cookies on the computer search the HD to see what other sites you have visited (or if you use a non-BillyBoy utility to view them). My first computer, in 1988, had a 30MB hard drive. <g> Also incuded was a triple-speed CPU - 6, 8, 10MHz. It cost 5 times what my current computer with a 50gigabyte hard drive and 500MHz CPU cost. It does pay to search your HD daily and remove all of the "temporary" files. |
Reply to this Message |
 Sign In
 Join
 My Latest Posts My Monitored Threads My Blog My Photo Gallery My Profile My Homepage Start New Thread Enable EMail Alerts Rate this Thread
|
©2009 Advenet LLC Privacy Policy - Terms of Use
This website includes both content owned or controlled by Advenet as well as content owned or controlled by third parties.