Internet Explorer susceptible to new market share vulnerability
88321
Jim Barksdale is probably laughing his fool head off. Microsoft&#39;s Internet Explorer, the Web browser with which Microsoft crushed Barksdale&#39;s Netscape Navigator, is slipping in popularity and it&#39;s Microsoft&#39;s own damn fault.
599385
Opinion: Internet Explorer is insecure junk, and it&#39;s time for Windows users to move to Firefox if they want to protect their systems.
676055
Three more vulnerabilities in Microsoft&#39;s Internet Explorer 6.0 browser were disclosed by Danish security vendor Secunia. By Gregg Keizer, TechWeb News.
753365
(InfoWorld) - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update. No, that's not a typo, just the strange fall-out from an unusual bug that had security researchers debating the question this week, "Who's to blame? Microsoft or Mozilla?" Security researcher Thor LarholmÂ kicked off the controversy on Tuesday, claiming that he had discovered a flaw that would let an attacker run commands on a victim's PC. In his blog posting, Larholm said the bug was similar to a flaw he'd discovered last month in Apple's Safari 3.0 beta software, and he called it an an "input validation flaw in Internet Explorer." The problem is with a URL protocol handler component of Internet Explorer, he said. This software allows Internet Explorer users to launch applications such as Excel or Firefox by clicking on specially written links on Web pages. When Internet Explorer clicks on a link that launches the Firefox browser, however, the software does not properly check its syntax, and that, Larholm said, lets an attacker create a malicious link, that could be used in an attack. Security vendor Secunia ApS rates the flaw as "highly critical." So while the flaw affects Internet Explorer users, it appears to be a risk only to those who already have Firefox installed. And to make matters more complicated, if a Firefox user were to click on one of the specially written links, he would not be affected. Still, Microsoft Security Program Manager Mark Griesi said that the bug was not his company's problem. "We don't feel that there's an issue in IE and therefore there's nothing to be fixed," he said Tuesday. With Microsoft saying it won't fix the vulnerability, Mozilla said it would change the way its Firefox URL protocol handler worked in its next Firefox update. That will fix Larholm's bug, but Mozilla security strategist Window Snyder wouldn't say whether or not she considered the vulnerability to be an IE or Firefox problem. She did, however, point out that without Microsoft making changes to IE, other Windows programs may be at risk. Noted browser bug-hunter Aviv Raff wrote in his blog that he thought both Microsoft and Mozilla were to blame. But another security expert said that the responsibility to fix the problem lies with the open-source browser developers. "This is an oversight in how Mozilla decided to construct their protocol registration, and how they do input validation between this handler and their application," said Eric Schultze, chief security architect with Shavlik Technologies, via e-mail. "I think Mozilla needs to write and release a patch for this issue and Microsoft can take the week off."
509354
Not for the first time does Internet Explorer users got a warning from a government organization. US-CERT released similar warnings in June this year, following a malware attack, which affected Internet Explorer
42547
(InfoWorld) - Hackers have discovered a new vulnerability in Internet Explorer, and they've released code that could be used to attack users of Microsoft Corp.'s popular browser. The vulnerability is similar to a bug thatÂ Microsoft patched last month in a multimedia component of Internet Explorer, according to Vincent Hwang, a group product manager with Symantec's Security Response team. Though a sample exploit of the vulnerability was posted Wednesday by hackers on the xsec.org Web site, Symantec has yet to see the code used in any attacks, according to Hwang. To take advantage of the exploit code, attackers would first need to trick users into viewing a maliciously encoded Web page, but they could then run unauthorized code on a victim's computer. It is unclear right now which versions of Windows and Internet Explorer are affected by the vulnerability. Researchers at Secunia said they were able to create a "fully working" exploit for the latest version of Windows XP running Internet Explorer 6. Windows 2000 users are also vulnerable, Secunia said. Microsoft security researchers were unavailable to comment on the issue, but a spokesman for the company's public relations agency said that the matter was under investigation. Symantec calls the bug "critical," andÂ Secunia rates the issue as "highly critical," its most severe rating. The xsec.org hackers referred to their code as a 0day, meaning an exploit for a previously undisclosed vulnerability. But one well-known hacker said the flaw was not difficult to find using publicly available security tools, such as the AxMan ActiveX fuzzing software. "Calling it 0day is a stretch," said HD Moore, the head of the Metasploit project, via e-mail. Moore wrote an automated ActiveX testing tool called AxMan that uncovered a handful of IE bugs, including the one exploited by on xsec.org. Although Moore recently launched a project called the Month of Browser Bugs, in which he disclosed a new browser vulnerability every day for the month of July, he said he had refrained from disclosing this particular vulnerability. "This is one of the many exploitable bugs that can be discovered using AxMan and one of the few that I didn't include in Month of Browser bugs due to the ease of exploitation," he said. "I still have three or four left in IE that have similar impact." This is the second unpatched flaw that Microsoft is looking at patching right now. Earlier this month, attackers began exploiting a vulnerability in the company's Word software.
166415
Microsoft has released an update to Internet Explorer to fix a security flaw that was discovered a month ago and has since been exploited to attack users.
314789
Recent updates to IE contain a serious regression that leaves systems once more vulnerable to a flaw fixed more than two years ago, according to security researchers.
520483
New computer code that exploits a recently disclosed hole in Microsoft&#39;s Internet Explorer Web browser is circulating on the Internet and could allow remote attackers to take full control of vulnerable Windows machines, according to warnings from
281798
Before the sun set on Microsoft&#39;s Patch Tuesday this month, security firm Secunia discovered a vulnerability in Firefox that malicious hackers could exploit to compromise a user&#39;s system. Here&#39;s the catch: Exploiting the bug depends on interaction between Mozilla&#39;s browser and Microsoft&#39;s Internet Explorer.
637378
Microsoft Internet Explorer is continuing to lose share in the browser market, as its much-smaller competitors chisel at its dominant position, new Web site visitor data shows.
213499
Update to "critical" Internet Explorer patch repairs a serious security flaw introduced by the original version.
106450
The &quot;highly criticial&quot; vulnerability affects Internet Explorer 5.01, 5.5, and 6 on fully patched PCs running either Windows XP SP1 or the newer SP2.
86025
An Internet Explorer vulnerability first reported yesterday is already getting a workout. Malware utilizing the hole for installation is turning up on various Russian porn sites, with more trouble expected.
217347
Stop us if you've heard this before Security experts warn a new, unpatched vulnerability in Internet Explorer might be used to spread malware. A flaw in Microsoft's Direct Animation Path (daxctle.ocx) ActiveX control, rated as critical by Secunia and other security watchers, has spawned proof of concept code but has not yet become the subject of widespread, hostile attack. Memory corruption is possible even on a fully patched Windows XP system.â¦
448507
An independent researcher finds an Internet Explorer vulnerability that could turn drag-and-drop into drag-and-infect.
290860
Security researchers can't decide whether it's in IE or Firefox A serious vulnerability that causes Internet Explorer to launch Firefox and execute a malicious payload is sparking debate about exactly who is responsible for the flaw.â¦