0 Members and 3 Guests are viewing this topic.
Thousands of websites have been hit by fast-moving exploit code that installs a cocktail of nasty malware on visitors' computers by targeting a previously unknown vulnerability in some versions of Internet Explorer.The compromised websites link to a series of servers that exploit a zero-day vulnerability in an IE component that processes media. The vulnerability affects those using the XP and 2003 versions of Windows, Microsoft warned in this advisory."An attacker who successfully exploited this vulnerability could gain the same user rights as the local user," company security representatives wrote. "When using Internet Explorer, code execution is remote and may not require any user intervention."More than 1,000 websites have been compromised so they include links that redirect users to sites that exploit the vulnerability, according to this translation of an advisory from CSIS. The warning said Windows 2000 was also vulnerable to the attacks, contrary to Microsoft's write-up, which explicitly said 2000 was not affected.What isn't in dispute is that IE 7 on Vista is not vulnerable, presumably because ActiveX objects are blocked by default, according to this blog entry from McAfee researchers Haowei Ren and Geok Meng Ong.The compromised websites are largely located in China and are operated by local schools and community centers. They point to a series of links that ultimately redirect users to a server at 8oy4t.8 866.org, according to CSIS. The site includes a JPG file that exploits a variety of vulnerabilities, "including an unprecedented stack overflow in DirectShow MPEG2TuneRequest," according to CSIS. Secunia rates the vulnerability "extremely critical," the highest rating on its five-tier severity scale.Other vulnerabilities that are exploited are known as XMLhttp.d, RealPlay.a, BBar, and the MS06-014, according to McAfee.The new vulnerability in DirectShow is different than a DirectShow security bug Microsoft warned of in late May, a spokesman said.Today's Microsoft advisory offers a workaround users can take to safeguard against the vulnerability until a patch is released. It involves making changes to the Windows registry, a risky undertaking for those who aren't sure what they're doing. The easier fix is to stop using IE until there's a fix, at least for those who don't use apps that are dependent on the Microsoft browser
Only difference is IE is always the blame and the bad guy because it comes with windows as a standard
With IE7 the "Windows Explorer" and "Internet Explorer" integration isgone. WHy have they done that? In the XP "Windows Explorer" one couldenter an URL inside the "file mangager" and get the web-page to theright (the same way as the file list), still keeping the folder-treeto the left. With IE7 installed it just opens up a new IE7
Internet Explorer removal has changed over its version history, but the nature of many of its upgrades and installation methods has been source of public interest. The first version to be included was version 2 with Windows 95 in late 1996. Later, users who upgraded to IE3 (which came out in 1996), could still use the last IE, because the installation converted the previous version to separate directory.[1]However, Internet Explorer 4 created a controversy with its shell integration with Windows Explorer, and with later versions removal (or inability to do so) became more complicated. The idea of removing Internet Explorer from a Microsoft Windows operating system was proposed during the United States v. Microsoft case. Later, some security advocates took up the idea as a way to protect Windows systems from attack via IE vulnerabilities. By the release of Internet Explorer 7, some of the shell integration began being reduced, such as changing ActiveX hosting and a different look than Windows Explorer.As of build 7048 of Windows 7, Microsoft added the ability to safely remove Internet Explorer 8 from Windows.[2] Microsoft does not allow the dependencies to be removed through this process, but the Internet Explorer executable (iexplore.exe) is removed without harming any other Windows components.Internet Explorer removal has changed over its version history, but the nature of many of its upgrades and installation methods has been source of public interest. The first version to be included was version 2 with Windows 95 in late 1996. Later, users who upgraded to IE3 (which came out in 1996), could still use the last IE, because the installation converted the previous version to separate directory.[1]However, Internet Explorer 4 created a controversy with its shell integration with Windows Explorer, and with later versions removal (or inability to do so) became more complicated. The idea of removing Internet Explorer from a Microsoft Windows operating system was proposed during the United States v. Microsoft case. Later, some security advocates took up the idea as a way to protect Windows systems from attack via IE vulnerabilities. By the release of Internet Explorer 7, some of the shell integration began being reduced, such as changing ActiveX hosting and a different look than Windows Explorer.As of build 7048 of Windows 7, Microsoft added the ability to safely remove Internet Explorer 8 from Windows.[2] Microsoft does not allow the dependencies to be removed through this process, but the Internet Explorer executable (iexplore.exe) is removed without harming any other Windows components.
RemovingIt is unclear what it means to "remove IE" because such a removal depends on being able to determine which files or functions on an installed Windows system are part of IE — that is, to draw a line between IE and the rest of Windows. Microsoft has held that this is not meaningful; that in Windows 98 and newer versions, "Internet Explorer" is not a separate piece of software but simply a brand name for the Web-browsing and HTML-displaying capacities of the Windows operating system. In this view, the result of removing IE is simply a damaged Windows system; to have a working system without IE one must replace Windows entirely.It is possible to remove Internet Explorer from Windows 95 after installing, as well as before install time. Removing Internet Explorer from Windows 2000, Windows XP and Windows Server 2003 is also possible at installation time.In contrast, some programmers and security writers have held that it is possible to have a useful and working Windows system with IE excised, that is, without Microsoft's implementation of web browsing and HTML viewing. These people include consultant Fred Vorck, who advocates that consumers should have the choice to remove "integrated" features of Microsoft Window and participates in the HFSLIP project; Dino Nuhagic, who is the creator of nLite — a product that allows users to remove Windows components like Internet Explorer and Windows Media Player, amongst others; and Shane Brooks, who created 98lite and XPLite to remove and manage Windows components after the installation of the operating system. Some people have suggested the use of alternative browsers instead of Internet Explorer, to try reduce the risk of vulnerabilities.
Microsoft does not allow the dependencies to be removed through this process
In contrast, some programmers and security writers have held that it is possible to have a useful and working Windows system with IE excised, that is, without Microsoft's implementation of web browsing and HTML viewing.
only thing you can realistically do to IE (and not kill half the apps on your system.. including winmx...) is hide the IE shortcut button....
Don't forget blocking it with your firewall.
