New Exploit Rocks IE, Downloads Scores Of Spyware, Adware

TechWeb ^ | September 19, 2006 | Gregg Keizer

[Eagle9]

US-CERT Vulnerability Note #416092

(excerpt)

III. Solution

We are currently unaware of a practical solution to this problem. Until a patch or update is available consider the following workarounds:

Refer to the following workarounds listed in Microsoft Security Advisory (925568):

• Un-register Vgx.dll on Windows XP Service Pack 1; Windows XP Service Pack 2; Windows Server 2003 and Windows Server 2003 Service Pack 1

• Modify the Access Control List on Vgx.dll to be more restrictive
• Configure Internet Explorer 6 for Microsoft Windows XP Service Pack 2 to disable Binary and Script Behaviors in the Internet and Local Intranet security zone

Do not follow unsolicited links

In order to convince users to visit their sites, attackers often use URL encoding, IP address variations, long URLs, intentional misspellings, and other techniques to create misleading links. Do not click on unsolicited links received in email, instant messages, web forums, or internet relay chat (IRC) channels. Type URLs directly into the browser to avoid these misleading links. While these are generally good security practices, following these behaviors will not prevent exploitation of this vulnerability in all cases, particularly if a trusted site has been compromised or allows cross-site scripting.

______________________________________________________________________

I choose to use an alternative solution: Firefox or Opera as my browser.

[IncPen]

So... you wanna ping Bush2k?

: )

[bigdcaldavis]

Only idiots or masochists still use IE. Smart, sane people use Firefox, Mozilla/Seamonkey, and/or Opera 9.

[Wuli]

I'm with you. Not only is Firefox minus the MS security bugs, it was faster than IE from the first day. Now, I have converted many friends and relatives to Mozilla's browser and their Email client (Thundebird) as well. And, the Mozilla community has new extension and plug-ins for both apps all th e time.

[rocksblues]

As many on line applications only accept IE as their default I would like to know how you would allow them to accept Fire fox.

[EGPWS]

As many on line applications only accept IE as their default I would like to know how you would allow them to accept Fire fox.

I used it for quite some time after a friend recommended it and went back to IE for it is more user friendly.

[MineralMan]

"So far, said Eric Sites, vice president of research and development at Sunbelt, the exploit has shown up on hardcore porn sites, which are serving a buffet of badware to users who visit those sites. "

Oh, well. I guess I'm safe then, since I never go to porn sites. Porn sites have had nasty adware on them for years.

[HAL9000]

So... you wanna ping Bush2k?

The last time I heard from him, he was buying a Mac.

[Clara Lou]

As of this point in time, while I conduct various forms of business on line, I have found that none restrict me to the use of IE. Entities which formerly did require IE either have become compatible with Firefox or have created other means to work around limiting folk to IE. [Discover Card is an example.]

[EGPWS]

Smart, sane people use Firefox, Mozilla/Seamonkey, and/or Opera 9.

You must be a Dale Carnegie heir.

[rocksblues]

I use fire fox for all my on line use. But I have a few applications that won't recognize fire fox as my default browser.

[Vermonter]

My county clerkk's website refuses to do any financial transactions unless the user has IE.

[Principled]

Firefox. It's better anyway IMO. Lots better.

[IncPen]

So... you wanna ping Bush2k?

You gotta be kidding.

That guy is a True Believer®

[IncPen]

My county clerk's website refuses to do any financial transactions unless the user has IE.

Go to the next county board meeting and ask them why they're wasting taxpayer's dollars...

[GeorgiaDawg32]

if I'm online and have to go to a website that only accepts IE, I'll get their e-mail and send them a note telling them that until they accept firefox, I'll not be visiting..I don't use IE and will not under any circumstances unless work required..and fortunately, I have to use IE there but it's on a company network that's isolated..otherwise, it's firefox for me..

[mattdono]

Clearly...George Bush's fault.

[driftdiver]

"As many on line applications only accept IE as their default I would like to know how you would allow them to accept Fire fox."

easy, use firefox for your day to day sites, avoid the porn sites, and only use IE for the online application sites that require IE. Don't connect to any other site with IE except the application. This isn't foolproof but it does minimize the risk.

[Vermonter]

I'm a Mac user. If I was going to fight them it would be to get them to support Safari, but I'm not in the mood to beat my head against the wall ;-}

[EGPWS]

But I have a few applications that won't recognize fire fox as my default browser.

I never had any issues with applications using FireFox nor do I have anything against it, however I find IE to be more catering to me personally in allowing more time doing business and less time figuring.

FireFox IMO is a good browser, I just prefer IE and don't have the adverse issues using it that have been discussed.