swft
Needs a life
Full throttle!
Posts: One MEEEEEELLION
|
posted June 30, 2004 12:35 PM
Fed warns against Internet Explorer and Outlook
http://cbs.marketwatch.com/news/story.asp?guid=%7B7D91FC13-9FA9-4703-B000-10000DAA78DD%7D&siteid=google&dist=google
  
|
DaveInDaytona
Pro
Posts: 1696
|
posted June 30, 2004 01:38 PM
 Edited By: DaveInDaytona on 30 Jun 2004 14:39
CBS should stay away from computer stuff since they don't understand it. There are notices of that sort about Microsoft and others all the time. It doesn't say don't use it. That headline would equal one that said "Feds See Crashes and Warn Against Riding in Cars". Does Michael Moore work for CBS now ? Read it and make your own decision if you would come up with that story. I am on the CERT subscription list and here's what it really says in whole when it was issued on June 11th:
Date: Fri, 11 Jun 2004 16:53:54 -0400
From: CERT Advisory
To: cert-advisory@cert.org
Organization: CERT(R) Coordination Center - +1 412-268-7090
List-Help: ,
List-Unsubscribe:
List-Post: NO (posting not allowed on this list)
List-Owner:
List-Archive:
Subject: US-CERT Technical Cyber Security Alert TA04-163A -- Cross-Domain Redirect Vulnerability in Internet Explorer
X-ELNK-AV: 0
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Technical Cyber Security Alert TA04-163A
Cross-Domain Redirect Vulnerability in Internet Explorer
Original release date: June 11, 2004
Last revised: --
Source: US-CERT
Systems Affected
Microsoft Windows systems
Overview
A cross-domain vulnerability in Internet Explorer (IE) could allow an
attacker to execute arbitrary code with the privileges of the user
running IE.
I. Description
There is a cross-domain vulnerability in the way IE determines the
security zone of a browser frame that is opened in one domain then
redirected by a web server to a different domain. A complex set of
conditions is involved, including a delayed HTTP response (3xx status
code) to change the content of the frame to the new domain.
Vulnerability Note VU#713878 describes this vulnerability in more
technical detail and will be updated as further information becomes
available.
Other programs that host the WebBrowser ActiveX control or use the
MSHTML rendering engine, such as Outlook and Outlook Express, may also
be affected.
This issue has been assigned CVE CAN-2004-0549.
II. Impact
By convincing a victim to view an HTML document (web page, HTML
email), an attacker could execute script in a different security
domain than the one containing the attacker's document. By causing
script to be run in the Local Machine Zone, the attacker could execute
arbitrary code with the privileges of the user running IE.
Publicly available exploit code exists for this vulnerability, and
US-CERT has monitored incident reports that indicate that this
vulnerability is being actively exploited.
III. Solution
Until a complete solution is available from Microsoft, consider the
following workarounds.
Disable Active scripting and ActiveX controls
Disabling Active scripting and ActiveX controls in the Internet Zone
(or any zone used by an attacker) appears to prevent exploitation of
this vulnerability. Disabling Active scripting and ActiveX controls in
the Local Machine Zone will prevent widely used payload delivery
techniques from functioning. Instructions for disabling Active
scripting in the Internet Zone can be found in the Malicious Web
Scripts FAQ. See Microsoft Knowledge Base Article 833633 for
information about securing the Local Machine Zone. Also, Service Pack
2 for Windows XP (currently at RC1) includes these and other security
enhancements for IE.
Do not follow unsolicited links
Do not click on unsolicited URLs received in email, instant messages,
web forums, or internet relay chat (IRC) channels. While this is
generally good security practice, following this behavior will not
prevent exploitation of this vulnerability in all cases.
Maintain updated anti-virus software
Anti-virus software with updated virus definitions may identify and
prevent some exploit attempts. Variations of exploits or attack
vectors may not be detected. Do not rely solely on anti-virus software
to defend against this vulnerability. More information about viruses
and anti-virus vendors is available on the US-CERT Computer Virus
Resources page.
Appendix B. References
* Vulnerability Note VU#713878-
* Malicious Web Scripts FAQ -
* Computer Virus Resources -
* CVE CAN-2004-0549 -
* Microsoft Knowledge Base Article 833633 -
* Windows XP Service Pack 2 RC1 -
nxpsp2.mspx>
* Increase Your Browsing and E-Mail Safety -
* Working with Internet Explorer 6 Security Settings -
.mspx>
_________________________________________________________________
Public incidents related to this vulnerability were reported by Rafel
Ivgi. Thanks to Jelmer for further research and analysis.
_________________________________________________________________
Feedback can be directed to the author: Art Manion.
Send mail to .
Please include the Subject line "TA04-163A Feedback VU#713878".
_________________________________________________________________
Copyright 2004 Carnegie Mellon University.
Terms of use:
_________________________________________________________________
The most recent version of this document can be found at:
_________________________________________________________________
Revision History
June 11, 2004: Initial release
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQFAyhdcXlvNRxAkFWARAt2eAKCRDeqWLNgG+xXJtd0PyRGeN+S69ACfcXoi
GDMew8rDUjleel9OLMqs9W4=
=ZAyn
-----END PGP SIGNATURE-----
____________
DaytonaSportbikes Forum
|
swft
Needs a life
Full throttle!
Posts: One MEEEEEELLION
|
posted June 30, 2004 01:48 PM
Ah, nice to see someone's getting money from microsoft! 
|
deathpulse
Pro
Posts: 1688
|
posted June 30, 2004 02:05 PM
netscape here I come!!!
|
deathpulse
Pro
Posts: 1688
|
posted June 30, 2004 02:06 PM
ACK!! I downloaded Firefox into my pr0n directory.. now I can't find it... damnit... Its lost in all those titties!!
|
DaveInDaytona
Pro
Posts: 1696
|
posted June 30, 2004 04:57 PM
quote:
Ah, nice to see someone's getting money from microsoft!
Was this pointed at me ?
____________
DaytonaSportbikes Forum
|
swft
Needs a life
Full throttle!
Posts: One MEEEEEELLION
|
posted June 30, 2004 07:37 PM
Jesus, don't tell me you're that fooking sensitive...
|
DaveInDaytona
Pro
Posts: 1696
|
posted June 30, 2004 07:55 PM
You talkin' to me ? Yeah, you, you talkin' to me ?
No, I'm not that sensitive. Geez.
____________
DaytonaSportbikes Forum
|
swft
Needs a life
Full throttle!
Posts: One MEEEEEELLION
|
posted June 30, 2004 08:40 PM
*heh* We are all just a bunch a fookin senstive guys. Shit, I can't believe I ripped a fart while I was typing that. Chased the dog off the couch tho. 
|
Ninjaman12R
Needs a job
as a Deal's Gap tour guide.
Posts: 4767
|
posted July 01, 2004 03:04 AM
[quote Shit, I can't believe I ripped a fart while I was typing that. Chased the dog off the couch tho.
Just about spewed coffee on that one!!! LMFAO!!! That's just wrong!!!! 
____________
What we're dealin' with here is a complete lack of respect for the law.
Sheriff Buford T. Justice of TEXAS
|
jonwright
Needs a job
Posts: 2416
|
posted July 01, 2004 05:47 AM
Damn. Glad we don't have Smell O Vision for the PCs.
SWFT's Fart:
-->-->-->*click here*<--<--<--
Ew.
|
Ninjaman12R
Needs a job
as a Deal's Gap tour guide.
Posts: 4767
|
posted July 01, 2004 06:07 AM
No doubt jon, Otis will wear his mouse button out clicking on yer link!!!
____________
What we're dealin' with here is a complete lack of respect for the law.
Sheriff Buford T. Justice of TEXAS
|
Otis
Needs a job
Captain Kickstand
Posts: 3028
|
posted July 01, 2004 07:04 AM
Edited By: Otis on 1 Jul 2004 08:04
Fuck you bitch.
|
Hells Dark Lord
Needs a life
living life, and loving it.
Posts: 7981
|
posted July 01, 2004 07:46 AM
speaking of sensitive guys, you all see the Progressive commercial?
When you told your insurance company you had a sissy bar, is this what they thought?
*picture a bunch of bikers sitting around a bar watching tv, crying*
LMFAO@ that commercial...guess you just had to see it...
____________
When in doubt, lean farther and go faster....
|
Otis
Needs a job
Captain Kickstand
Posts: 3028
|
posted July 01, 2004 07:47 AM
I saw that commercial. It was funny.
|
swft
Needs a life
Full throttle!
Posts: One MEEEEEELLION
|
posted July 04, 2004 06:48 AM
http://www.syracuse.com/news/poststandard/index.ssf?/base/news-1/108867092795923.xml
|
swft
Needs a life
Full throttle!
Posts: One MEEEEEELLION
|
posted July 09, 2004 04:27 PM
http://www.infoworld.com/article/04/07/09/28enterwin_1.html
|
Hells Dark Lord
Needs a life
living life, and loving it.
Posts: 7981
|
posted July 10, 2004 04:33 AM
well shit is nothing safe anymore????????
____________
When in doubt, lean farther and go faster....
|
swft
Needs a life
Full throttle!
Posts: One MEEEEEELLION
|
posted July 10, 2004 05:23 AM
Sure! VAX/VMS...
|
Hells Dark Lord
Needs a life
living life, and loving it.
Posts: 7981
|
posted July 10, 2004 06:20 AM
speaking greek to me swft....lol
____________
When in doubt, lean farther and go faster....
|
swft
Needs a life
Full throttle!
Posts: One MEEEEEELLION
|
posted July 11, 2004 06:13 PM
Back before internet. Back when OA was the only thing you had, and you used a VT220 terminal. Anyone remember when submitting a print job was a big deal?
|
|
|
HOME
NEW TOPIC