Second flaw in IE7 ... is it really a flaw?
-
You can lead a horse to water; if he doesn't drink, shoot him. Hopefully, you won't run out of horses.
Software Zen:
delete this;You can lead a horse to water, but if you can get him to walk on it you have a whole new ball game.
Author of The Career Programmer and Unite the Tribes www.PracticalStrategyConsulting.com
-
I have found a far worse flaw. You can alter the RSS store without being seen. Details on my blog. The IE team could have added a checksum to avoid that, but they chose not to. I hope they get fired.
I hope the people who employ you don't have a similar draconian policy. :)
Author of The Career Programmer and Unite the Tribes www.PracticalStrategyConsulting.com
-
What you seem to forget (or fail to know) is that those responsible for IE7 are the old IE guys, whose team has been rebuilt. So it's a matter of getting rid of dead horses.
Mmmmm. Elmers...
Author of The Career Programmer and Unite the Tribes www.PracticalStrategyConsulting.com
-
You can lead a horse to water, but if you can get him to walk on it you have a whole new ball game.
Author of The Career Programmer and Unite the Tribes www.PracticalStrategyConsulting.com
Minnesota in January; no sweat (literally). After all, you didn't specify what state the water was in. :laugh:
Software Zen:
delete this; -
I hope the people who employ you don't have a similar draconian policy. :)
Author of The Career Programmer and Unite the Tribes www.PracticalStrategyConsulting.com
Don't worry, I am self-employed and fire myself from time to time ;) On a serious note though, when a team screws it by introducing new attack vectors, the best you can do is fire them. Or you are part of the problem. You like politics, don't you?
-
Minnesota in January; no sweat (literally). After all, you didn't specify what state the water was in. :laugh:
Software Zen:
delete this;:laugh:
Author of The Career Programmer and Unite the Tribes www.PracticalStrategyConsulting.com
-
Don't worry, I am self-employed and fire myself from time to time ;) On a serious note though, when a team screws it by introducing new attack vectors, the best you can do is fire them. Or you are part of the problem. You like politics, don't you?
I detest politics, which is why I've spent so much time and energy showing other people how to cope with them. Seems to me that if you're looking for a scapegoat it would be either the QA team who missed this or the manager who failed to allocate a sufficient budget for testing.
Author of The Career Programmer and Unite the Tribes www.PracticalStrategyConsulting.com
-
I detest politics, which is why I've spent so much time and energy showing other people how to cope with them. Seems to me that if you're looking for a scapegoat it would be either the QA team who missed this or the manager who failed to allocate a sufficient budget for testing.
Author of The Career Programmer and Unite the Tribes www.PracticalStrategyConsulting.com
Neither. Since BG announced the "trustworthy computing" initiative and the security threat models are mandatory part of every step of the dev cycle in Redmond, everyone in the team is responsible. Again, this is just bad : a data store without checksums. Even rookies don't make this mistake. IE is supposed to be used by hundred millions usersvictims.
-
I have found a far worse flaw. You can alter the RSS store without being seen. Details on my blog. The IE team could have added a checksum to avoid that, but they chose not to. I hope they get fired.
You mean this[^] link. Whoo, a program running under your credentials can modify a file in the RSS cache. Sorry, I really don't see that as a vulnerability. Also, you can only change a character. You can't arbitrarily add text as it screws up the file. I just tried overtyping a bunch of the HTML in a feed with a <script> tag which simply calls
window.alert. It didn't run.Stability. What an interesting concept. -- Chris Maunder
-
This was mentioned in the daily news e-mail. The flaw is described as: The bug allows hackers to place a fake Web address in one of the browser's pop-up Windows, and could be used to trick a victim into inadvertently downloading something from what appeared to be a trusted Web site. While the full URL of the Web page being displayed is present in the pop-up Window's address bar, the left part of this URL is not initially displayed, the [Secunia] spokesman said. Source: http://www.infoworld.com/article/06/10/25/HNie7flaw2_1.html[^] I've looked at their example, and can't see how this is unique to IE or really even a problem? Basically, by having a page on my site at:
'http://www.mysite.com/blah?http://www.codeproject.com/login.asp '
...with some carefully appended white space at the end to scroll the address to the left, people may think they are on CodeProject.com. Only, in IE7 the address bar is selected by default (presumably to prevent this sort of thing) so the moment I try and do anything in the new window it will imediately flash up and tell me I am really on mysite.com/blah. It seems to me that Secunia is just trying to get in the news, even if they have to make up problems to do so?
Ðavid Wulff Die Freiheit spielt auf allen Geigen (video)
10 PRINT 'HELLO MAINTAINER: GOTO HELLWhy You are emphasizing on the flaws on IE? I think people are de-emphasize the flaws of firefox. before 2-3 weeks ago, as per Secunia's report IE has less flaws compared to firefox. See the news posted just 2 hours ago Mozilla downplays Firefox 2.0 bugs[^]
-Sarath_._ "Great hopes make everything great possible" - Benjamin Franklin
My blog - Sharing My Thoughts, An Article - Understanding Statepattern
-
I have found a far worse flaw. You can alter the RSS store without being seen. Details on my blog. The IE team could have added a checksum to avoid that, but they chose not to. I hope they get fired.
...but please, don't use Internet Explorer.
-
I have found a far worse flaw. You can alter the RSS store without being seen. Details on my blog. The IE team could have added a checksum to avoid that, but they chose not to. I hope they get fired.
I see you are trying to get a rise out of people in order to react to your posts. Well you got my attention as far as a reaction this is it.
Ant. I'm hard, yet soft.
I'm coloured, yet clear.
I'm fruity and sweet.
I'm jelly, what am I? Muse on it further, I shall return! - David Walliams (Little Britain) -
Why You are emphasizing on the flaws on IE? I think people are de-emphasize the flaws of firefox. before 2-3 weeks ago, as per Secunia's report IE has less flaws compared to firefox. See the news posted just 2 hours ago Mozilla downplays Firefox 2.0 bugs[^]
-Sarath_._ "Great hopes make everything great possible" - Benjamin Franklin
My blog - Sharing My Thoughts, An Article - Understanding Statepattern
Sarath. wrote:
Why You are emphasizing on the flaws on IE?
I'm not - I'm emphasising the fact they are calling a carefully created presentation issue a flaw, when in fact the moment you try and do anything with it it immediately tells you it is on a spoofed site. That is even when you ignore IE7's spoof site warnings, which would get picked up within hours of it going live. The so-called flaw can't even be used in the real world because it requires script to open the window of an exact size in order to work - something that no e-mail client will allow to run. The only way to launch such a window would be from the spoof web site itself, defeating the whole thing. (Again, ignoring the built-in spoof filter.)
Ðavid Wulff Die Freiheit spielt auf allen Geigen (video)
10 PRINT 'HELLO MAINTAINER: GOTO HELL -
You mean this[^] link. Whoo, a program running under your credentials can modify a file in the RSS cache. Sorry, I really don't see that as a vulnerability. Also, you can only change a character. You can't arbitrarily add text as it screws up the file. I just tried overtyping a bunch of the HTML in a feed with a <script> tag which simply calls
window.alert. It didn't run.Stability. What an interesting concept. -- Chris Maunder
I really love his comparison between Firefox and Microsoft Word, which ends with the suggestion that Word is no longer needed because FF2 ships with an English spell checker. If you can bare to read any further into his blog, make sure you are sitting firmly in your chair or you may just fall out of it laughing. My god, it is rare to see such blatent bias - even Jeremy doesn't go quite that far when Macs get brought up in the Lounge! ;P I particularly like the half page of writing bitching about IE7's search providers, simply because he couldn't be bothered to read the one line of instructions on how to use them. :rolleyes:
Ðavid Wulff Die Freiheit spielt auf allen Geigen (video)
10 PRINT 'HELLO MAINTAINER: GOTO HELL -
...but please, don't use Internet Explorer.
I voted you a 1.0 on this message and the one where you mention criminals, because the content of those messages is utter drivel. And that is being polite to your other responses on this thread. Still, if it helps you to feel important, I promise not to waste time voting on future messages.
Ðavid Wulff Die Freiheit spielt auf allen Geigen (video)
10 PRINT 'HELLO MAINTAINER: GOTO HELL -
You mean this[^] link. Whoo, a program running under your credentials can modify a file in the RSS cache. Sorry, I really don't see that as a vulnerability. Also, you can only change a character. You can't arbitrarily add text as it screws up the file. I just tried overtyping a bunch of the HTML in a feed with a <script> tag which simply calls
window.alert. It didn't run.Stability. What an interesting concept. -- Chris Maunder
My god, I just hex-edited IE7's exe * and replaced it with the code of a virus, and now when I run it I've got a virus. Fire the lot of them, I say * Actually, I didn't
-- Help me! I'm turning into a grapefruit! Buzzwords!
-
I have found a far worse flaw. You can alter the RSS store without being seen. Details on my blog. The IE team could have added a checksum to avoid that, but they chose not to. I hope they get fired.
Stephane Rodriguez. wrote:
I hope they get fired.
:sigh:
"When I get a little money, I buy books and if any is left, I buy food and clothes." --Erasmus
-
I have found a far worse flaw. You can alter the RSS store without being seen. Details on my blog. The IE team could have added a checksum to avoid that, but they chose not to. I hope they get fired.
This is just like the Outlook bug where I can delete email I don't want to keep anymore. Come to think of it I can edit my Word files without any errors. And probably my Excel files and my PowerPoint presentations... The whole Office team should be fired. OMG I just tried changing my desktop background in Vista, and it let me... better fire the Vista team as well. Under even further research I discovered that I can change my code files without Visual Studio stopping me, and I encountered this bug on XP, 2003 Server AND Vista. I am begginning to believe the only way to keep my precious files safe from myself is to erase my harddrives... Everyone that has ever used a computer should be fired from their job! Seriously though altering the RSS Store is not a bug, its called editing files on your own computer. Furthermore the data store is documented in the Feeds API and is stored as such to allow for easy consumption by programs other than IE 7.
Matt Newman
Even the very best tools in the hands of an idiot will produce something of little or no value. - Chris Meech on Idiots -
This was mentioned in the daily news e-mail. The flaw is described as: The bug allows hackers to place a fake Web address in one of the browser's pop-up Windows, and could be used to trick a victim into inadvertently downloading something from what appeared to be a trusted Web site. While the full URL of the Web page being displayed is present in the pop-up Window's address bar, the left part of this URL is not initially displayed, the [Secunia] spokesman said. Source: http://www.infoworld.com/article/06/10/25/HNie7flaw2_1.html[^] I've looked at their example, and can't see how this is unique to IE or really even a problem? Basically, by having a page on my site at:
'http://www.mysite.com/blah?http://www.codeproject.com/login.asp '
...with some carefully appended white space at the end to scroll the address to the left, people may think they are on CodeProject.com. Only, in IE7 the address bar is selected by default (presumably to prevent this sort of thing) so the moment I try and do anything in the new window it will imediately flash up and tell me I am really on mysite.com/blah. It seems to me that Secunia is just trying to get in the news, even if they have to make up problems to do so?
Ðavid Wulff Die Freiheit spielt auf allen Geigen (video)
10 PRINT 'HELLO MAINTAINER: GOTO HELLOn the one hand, i don't think it's a big deal. On the other hand, Microsoft probably did, seeing as how one of the obvious changes between IE6 and IE7 was to force an address bar into popups, for the single stated reason of making it harder to spoof legit windows. If it's too easy to spoof a URL, then that effectively negates the whole reason for it to exist - so yeah, it's a flaw. Even if i used IE7, this wouldn't be the sort of thing that'd have me worried at all, but i can at least see why it'd be reported as a flaw.
every night, i kneel at the foot of my bed and thank the Great Overseeing Politicians for protecting my freedoms by reducing their number, as if they were deer in a state park. -- Chris Losinger, Online Poker Players?
-
You mean this[^] link. Whoo, a program running under your credentials can modify a file in the RSS cache. Sorry, I really don't see that as a vulnerability. Also, you can only change a character. You can't arbitrarily add text as it screws up the file. I just tried overtyping a bunch of the HTML in a feed with a <script> tag which simply calls
window.alert. It didn't run.Stability. What an interesting concept. -- Chris Maunder
You don't see the vulnerability? Don't worry, keep using Internet Explorer... An example of nefarious purpose is to rewrite urls. Don't see what it can be used for?