Free Republic
Browse · Search
News/Activism
Topics · Post Article

Skip to comments.

Microsoft Plugs IE; Warns All Browsers At Risk (Test Your Browser Here)
TechWeb ^ | July 2, 2004 | Gregg Keizer

Posted on 07/03/2004 9:46:15 PM PDT by Eagle9

As if to prove the point that security is like the Dutch boy at the dike, Microsoft on Friday released a stop-gap fix for one of several vulnerabilities that have plagued its Internet Explorer just as a security firm warned that virtually every browser -- not just IE -- can be spoofed by hackers.

The update, which Microsoft tagged as “Critical,” isn't a patch per se, but rather an change to Windows that disables the ADODB.Stream object within the operating system's Data Access Components (DAC).

Last week, an innovative attack launched by a Russian hacker group from previously-infected Microsoft Internet Information Services (IIS) servers compromised a large number of PCs with identity- and financial information-thieving Trojan horses and key loggers. The attack exploited a pair of vulnerabilities in Internet Explorer, one of which -- ADODB -- had not been patched by Microsoft.

While the Russian Web site that hosted the malicious code -- which was surreptitiously downloaded to the compromised computers -- was taken down last Friday to remove the immediate danger, Microsoft has still not released a patch. The ADODB disabler is meant only as a temporary fix, said Microsoft, until it can permanently fix IE.

“In addition to this configuration change, Microsoft is working to provide a series of security updates to Internet Explorer in coming weeks that will provide additional protections,” said Microsoft in a statement. Microsoft did not offer up a timeline for any future IE patches, saying only that “a comprehensive update will be released once it has been thoroughly tested.”

The update to disable ADODB should be downloaded and installed by all users of Windows NT, Windows 2000, Windows XP, and Windows Server 2003, Microsoft said. It's available on the Windows Download site, or via the Windows Update

service. Windows XP Service Pack 2 (SP2), which is expected to release in final form this summer, is not susceptible to the ADODB vulnerability.

Friday's update is one of the few pieces of good news IE users have heard in the last week.

After a rash of exploits against IE vulnerabilities -- including the Web attack of last week, password-stealing Trojans, and a new way for hackers to spoof, or fake, Web sites -- some security analysts questioned whether Internet Explorer was safe enough to use.

Even the U.S. Computer Emergency Response Team (US-CERT), part of the federal government's Department of Homeland Security, recommended that users consider ditching IE for an alternate such as Mozilla or Opera.

“We're recommending one of two things,” said Thomas Kristensen, the chief technology officer at Danish security firm Secunia. “Either use Internet Explorer under very restricted security settings -- which may not be possible for all companies -- or install a different browser.”

Wednesday, Secunia issued a warning saying it had discovered a vulnerability within IE that allowed scammers to spoof, or fake, the content of a site displayed in the browser.

On Friday, however, the security vendor modified the alert to claim that virtually every browser, from Internet Explorer and Mozilla to Opera and Netscape -- including browsers for both Windows and the Mac OS -- has this flaw.

“It's not a code vulnerability,” said Secunia's Kristensen, “but a design flaw.”

The problem stems from how browsers handle frames. “Some time ago, browser designers decided that one site needed to be able to manipulate the content of another, and the functionality was adopted by everyone,” said Kristensen. But hackers can use this to inject phony content -- say their own credit card-stealing form -- into a frame of an actual trusted Web site, such as a user's online bank.

“In these times of phishing attacks and other scams, this is a problem,” said Kristensen. “You're visiting a bank or an e-commerce site, and you're certain of that site, but meanwhile, it's [actually] open in the background to content change by hackers.”

Internet Explorer users can stymie such spoofing attacks by disabling the “Navigate sub-frames across different domains” setting under Tools/Internet Options/Security.

Secunia offered up a quick test that users can run to see if their current browser is vulnerable to this problem.


TOPICS: Business/Economy; Front Page News; Technical
KEYWORDS: browser; getamac; ie; internetexploiter; lowqualitycrap; microsoft; patch; security; securityflaw; technology; vulnerability; vulnerable; windows
Navigation: use the links below to view more comments.
first 1-2021-4041-6061-80 ... 201-207 next last
I'm using Mozilla FireFox 0.9.1 as my browser. I took the browser test in the last paragraph. My browser passed the test with no problem. That leads me to believe that this version of FireFox was not vulnerable to this particular attack.

I have downloaded and installed the latest critical update from Microsoft for IE 6.0. My IE 6.0 browser did not pass this test.

Test your browser.

1 posted on 07/03/2004 9:46:15 PM PDT by Eagle9
[ Post Reply | Private Reply | View Replies]

To: Eagle9

Makes me glad I have a Mac-


2 posted on 07/03/2004 9:50:00 PM PDT by mean lunch lady ("There is a light at the end of the tunnel - Oh, no, it's a train.")
[ Post Reply | Private Reply | To 1 | View Replies]

To: Eagle9

Mozilla 1.7 under Windows does not seem to be vulnerable.


3 posted on 07/03/2004 9:52:55 PM PDT by Arkinsaw
[ Post Reply | Private Reply | To 1 | View Replies]

To: rdb3; chance33_98; Calvinist_Dark_Lord; Bush2000; PenguinWry; GodGunsandGuts; CyberCowboy777; ...

Browser Ping


4 posted on 07/03/2004 9:55:10 PM PDT by ShadowAce (Linux -- The Ultimate Windows Service Pack)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Eagle9

Hmm, even the previous Netscape Browser (7.1) is vulnerable...that is surprising.


5 posted on 07/03/2004 9:55:56 PM PDT by swilhelm73 (We always have been, we are, and I hope that we always shall be detested in France.")
[ Post Reply | Private Reply | To 1 | View Replies]

To: Eagle9
As if to prove the point that security is like the Dutch boy at the dike,

Thank God I have taken more effective measures to alleviate my system from such concerns. (without giving up the usability given by IE)

6 posted on 07/03/2004 9:56:18 PM PDT by EGPWS
[ Post Reply | Private Reply | To 1 | View Replies]

To: Eagle9
I tried it with Opera 7.51 identifying itself as Mozilla. It failed.

However, when I try to open my bank account with Opera, it won't work if Opera identifies itself as Opera, only as Mozilla. Weird.
7 posted on 07/03/2004 9:56:41 PM PDT by DeFault User
[ Post Reply | Private Reply | To 1 | View Replies]

To: mean lunch lady
Makes me glad I have a Mac-

I know how you feel, for the other day I purchased a "Big" Mac and it sated me for hours.

8 posted on 07/03/2004 9:59:23 PM PDT by EGPWS
[ Post Reply | Private Reply | To 2 | View Replies]

To: mean lunch lady

No problems on linux either


9 posted on 07/03/2004 9:59:59 PM PDT by P8riot (A gun is just a substitute for a penis, so when attacked by a mugger one should pull out a..........)
[ Post Reply | Private Reply | To 2 | View Replies]

To: Eagle9

How do we know that "checking" our browser is safe?

I'm not the most computer savvy guy around..


10 posted on 07/03/2004 10:00:43 PM PDT by Ethrane ("semper consolar")
[ Post Reply | Private Reply | To 1 | View Replies]

To: DeFault User

Well, I do use Incompetent Explorer but so far haven't had any problems I'm aware of. Norton seems to keep me safe. Of course, this doesn't mean that I don't think that Microsoft are a bunch of greedy incompetents.


11 posted on 07/03/2004 10:02:08 PM PDT by WestVirginiaRebel (If Bush wins, our enemies will glow in the dark. If Kerry wins, we will.)
[ Post Reply | Private Reply | To 7 | View Replies]

To: WestVirginiaRebel

Yeah...about Norton...

I use Norton Internet security...

Should this cover the vulnerability??


12 posted on 07/03/2004 10:03:23 PM PDT by Ethrane ("semper consolar")
[ Post Reply | Private Reply | To 11 | View Replies]

To: Ernest_at_the_Beach; ShadowAce; backhoe; TechJunkYard; Golden Eagle; Bush2000; Nick Danger
Updated info Ping.

It seems to me that there is a contradiction in this article, or it's addressing two separate issues.

13 posted on 07/03/2004 10:03:52 PM PDT by Eagle9
[ Post Reply | Private Reply | To 1 | View Replies]

To: Eagle9
"Test your browser."

Internet Explorer failed. Firefox passed.
14 posted on 07/03/2004 10:04:39 PM PDT by octobersky
[ Post Reply | Private Reply | To 1 | View Replies]

To: Eagle9

Bump.


15 posted on 07/03/2004 10:05:08 PM PDT by First_Salute (May God save our democratic-republican government, from a government by judiciary.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: EGPWS

Better you than me, I haven't eaten at Mickey D's for over 5 years and I am not planning to. Not only do I believe their food is bad for people, I resent the way they target kids in their advertising.
Oh,yeah, and I'm real mad at them for forcing fat people to eat there and get health problems for which they have to sue for lots of money. I haven't figured out yet how the money heals them, but it must do something, right?


16 posted on 07/03/2004 10:06:55 PM PDT by mean lunch lady ("There is a light at the end of the tunnel - Oh, no, it's a train.")
[ Post Reply | Private Reply | To 8 | View Replies]

To: Eagle9

Iam using mozilla 1.7 after dumping IE last week. I took the test and mozilla passed.


17 posted on 07/03/2004 10:08:13 PM PDT by suzyq5558 (Slicks bracelet is a secret mood ring when its red he's fondly remembering the KSNAP of the thong)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Ethrane

There is a link in the last paragraph. Click that link and follow the instructions. This test is for one vulnerability only.


18 posted on 07/03/2004 10:09:23 PM PDT by Eagle9
[ Post Reply | Private Reply | To 10 | View Replies]

To: Eagle9; All

Freepers how do I get rid of this spyware crap that is on my computer?
Worm and Virus Wars- the August Edition

19 posted on 07/03/2004 10:10:47 PM PDT by backhoe (Just an old Keyboard Cowboy, ridin' the Trackball into the Sunset...)
[ Post Reply | Private Reply | To 1 | View Replies]

To: mean lunch lady; Swordmaker

ALERT

This vulnerability is in Microsoft Internet Explorer v.5.2.x for the Mac, too!


20 posted on 07/03/2004 10:18:31 PM PDT by First_Salute (May God save our democratic-republican government, from a government by judiciary.)
[ Post Reply | Private Reply | To 2 | View Replies]


Navigation: use the links below to view more comments.
first 1-2021-4041-6061-80 ... 201-207 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
News/Activism
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson