Frontpage
Forums
Tutorials
Members
Calendar
Subscription
Donate
Links
Contact 
Help
Latest Software News
Latest Hardware News
Latest Mobile
Latest Security News
Latest Forum Posts
Latest News Comments
-
Microsoft rebrands itself
By j7n, Apr 30 2013 05:00 AM
-
Microsoft rebrands itself
By j7n, Apr 30 2013 05:00 AM
-
Google releases Metro-style...
By gelapir, Apr 29 2013 04:59 AM
-
Microsoft rebrands itself
By bizzybody, Apr 27 2013 04:17 PM
-
Android 4.1 Jelly Bean Comi...
By famas, Apr 02 2013 11:27 PM
MSFN Statistics
Recommended Sites
900 million Internet Explorer users hit by bug - You're probably one of them!
Are you a Windows user that still surfs the web with Internet Explorer? Well, if you are one of the 900 million who do, you need to to sit up and pay attention to a new vulnerability that affects you. Details here:Microsoft is investigating new public reports of a vulnerability in all supported editions of Microsoft Windows. The vulnerability could allow an attacker to cause a victim to run malicious scripts when visiting various Web sites, resulting in information disclosure. This impact is similar to server-side cross-site scripting (XSS) vulnerabilities. Microsoft is aware of published information and proof-of-concept code that attempts to exploit this vulnerability. At this time, Microsoft has not seen any indications of active exploitation of the vulnerability.
The vulnerability exists due to the way MHTML interprets MIME-formatted requests for content blocks within a document. It is possible under certain conditions for this vulnerability to allow an attacker to inject a client-side script in the response of a Web request run in the context of the victim’s Internet Explorer. The script could spoof content, disclose information, or take any action that the user could take on the affected Web site on behalf of the targeted user.
This issue affects ALL versions of Windows, from XP SP3 all the way to Windows 7 and Windows Server 2008 R2 (Server Core installations are unaffected).
Microsoft has published a one-click “Fix it” workaround for the bug that involved locking down MHTML. This will prevent the launch of script in all zones within an MHTML document. Any application that uses MHTML will be affected by this workaround.
Source: ZDNet
2 Comments
Page 1 of 1
cantoris
01 February 2011 - 04:40 PM
Yawn yawn yawn.
Why the silly alarmist IE-bashing tone about a vulnerability for which no attack yet exists and for which MS have provided a workaround already?
Anyone who's read Secunia's stuff in the past will know Firefox et al are not sweetness and light when it comes to security vulnerabilities.
Why the silly alarmist IE-bashing tone about a vulnerability for which no attack yet exists and for which MS have provided a workaround already?
Anyone who's read Secunia's stuff in the past will know Firefox et al are not sweetness and light when it comes to security vulnerabilities.
Maxfutur
03 February 2011 - 12:19 AM
@cantoris
I think, the problem is very clear:
When bugs or 'vulnerabilities' doesn't get disclosed meaning where is the risk, they keep it like "security risk in IE" or so.
I think, the problem is very clear:
Quote
published information and proof-of-concept code that attempts to exploit this vulnerability.
When bugs or 'vulnerabilities' doesn't get disclosed meaning where is the risk, they keep it like "security risk in IE" or so.
Page 1 of 1