Secunia warns of flaws in IE

Earthtimes.org ^ | 2005-01-08 | Chaney. R

[holymoly]

Disable Internet Explorer Active X support, turn off the "drag-and-drop" or "copy-and-paste files" option across a domain, or switch to another Web browser unless you want to face a Hack attack on your PC, warns the security firm Secunia. They have discovered three very critical flaws in the IE and have issued security notice on its website.

The company has rated the flaw as of a very high risk nature and has said that this is their last warning for people to secure their data. “The flaw affects IE 6, and can enable hackers to run pornographic dialers to be dialed from the user’s computer without their knowledge” said Thomas Kristensen, Secunia's chief technology officer. He said that only those flaws that can let someone manipulate user’s machine without user’s intervention get such high rating.

Even PCs with Microsoft's Service Pack 2 patch are vulnerable to be attacked.

The company has also said that Microsoft has been aware of this flaw for at least two months now but they have not yet come up with a security patch. The exploit code for one of the three vulnerabilities, a flaw in an HTML Help control, was already published on the Internet on Dec. 21.

Commenting on this Microsoft officials said that an incomplete patch can at times be worse than no patch at all. They want to thoroughly test the patch and it should be well engineered. This will take sometime

These flaws have made a big dent in Microsoft’s already battered image when it comes to security.

[holymoly]

One thing I forgot - if your primary browser is not MSIE (you use Firefox, Opera, etc.), you may want to double-check that it is set as your "default" browser (if you haven't already). Other than that, I can't think of anything.

But I'm also wathing the NFL playoffs, so I'm a bit distracted. ;)

[Temple Owl]

Listen to Mom! Be careful.

[Malesherbes]

This is exactly the reason I'm reading this using Mozilla Firefox.

[xrp]

Yes, it is free.

http://www.mozilla.org/

[xrp]

You disable IE by simply not using it.

[NoCmpromiz]

You disable IE by simply not using it.

That is true as far as it goes, but if you don't change your default browser, IE will launch whenever you click on a hot link. Download Firefox and install it. When you launch it for the first time you will get a notice that asks if you want to set Firefox as your default browser. Check the box, and you have for the most part throttled Microsoft's Insecure Explorer...

And while you're there, download Thunderbird for a better email client than Outlook Distressed ever dreamed of being...

[Annie03]

Thanks for the Thunderbird link. I'll try working with Firefox some more....

[Annie03]

Ping. Maybe we should give Firefox/mozilla another try.

[NoCmpromiz]

it didn't seem to work as well with the accelerator on my ISP

This possibly is due to a default setting in Mozilla/Firefox/Netscape 7.2. Accelerators (some anyway, not sure what Earthlink's does) typically work by caching web pages and then pumping the information your way in multiple streams. Mozilla for some reason chose to have pipelining turned off by default. Normally the browser will make one request to a web page at a time. When you enable pipelining it will make several at once, which really speeds up page loading. (This reallly makes a difference when you have DSL/Cable access!)

Try this:

Mozilla/Firefox pipeline settings
1.Type "about:config" into the address bar and hit return. Scroll down and look for the following entries:
network.http.pipelining, network.http.proxy.pipelining,
network.http.pipelining.maxrequests

2. Alter the entries as follows (right click the setting and select 'modify'):
Set "network.http.pipelining" to "true"
Set "network.http.proxy.pipelining" to "true"
Set "network.http.pipelining.maxrequests" to some number like 30. (This means it will make 30 requests at once.)

Here's what I use (your mileage may vary - try other settings to find optimum..)(With your dial-up you might just want to try turning on pipelining and keep the default settings for connections at first, my settings work well with my DSL connection)

SETTING NAME: New Value (default setting)
network.http.max-connections: 48 (24)
network.http.max-connections-per-server: 24 (8)
network.http.max-persistent-connections-per-proxy: 12 (4)
network.http.max-persistent-connections-per-server: 6 (2)
network.http.pipelining: true (false)
network.http.pipelining.maxrequests: 32 (4)
network.http.proxy.pipelining: true (false)

To return any setting back to the default setting, right click the setting and select 'reset'.

Hope this helps. (Let me know how this works for you...)

[Annie03]

I will give it a try and let you know. It's strange, but I went on Firefox today, and it seems to be working better and faster. I have no clue as to why....lol. I am saving your message so I can take a look. Thank you so much for helping me out! You have no idea how much I appreciate it.

[NoCmpromiz]

One thing to keep in mind: Microsoft in its effort to become king of everything has pushed what they call 'active content' in web pages, notably those authored using Microsoft Frontpage. This questionable 'technology' uses their proprietary "Active-X Controls". Since this is a non-standard function, most non-Microsoft browsers (meaning anything except Internet Exploder, er, Explorer) will have difficulty rendering pages with that content, or may not display them at all... (Active-X is what happens to a standard thng like Java after Microsoft 'extends its capabilities' thus making it something only THEY control. The Borg on Star Treck come to mind... It's also the biggest reason that IE is so insecure.)

My personal opinion is that if someone creates a web page that will not load in all browsers, they must not want me to view it, so I don't try. Some companies have lost a sale because of that, but that's their choice! < /rant>

It's possible that the last time you tried Firefox you were trying to view a page or site that was created using some of Microsoft's stuff and wouldn't come up. This means that you still have to keep IE hanging around just in case you want to see some of these sites...

One other item that I don't know for sure if Mozilla's site makes clear. Java is not included with the download for Mozilla or Firefox. If you don't have a Java plug-in already on your machine, you must get the plug-in separately. Here is the link to Sun's Java Download page. You want to click the "Download J2SE JRE" link. Read the install instructions and Read Me on that page before you install. And you'll need the usual plug-ins like QuickTime, Shockwave and Flashplayer when you run into pages that use that content.

Hope all this hasn't confused you too much!