New (M$ IE) Explorer hole could be devastating

[Wonk]

28 January 2004

New Explorer hole could be devastating
A little imagination could undermine browser

By Kieren McCarthy, Techworld

A security hole in Microsoft’s Internet Explorer could prove devastating.

Following the exposure of a vulnerability in Windows XP earlier this week, “http-equiv” of Malware has revealed that Explorer 6 users (and possibly users of earlier versions) could be fooled into downloading what look like safe files but are in fact whatever the author wishes them to be - including executables.

A demonstration of the hole is currently on security company Secunia’s website and demonstrates that if you click on a link, and select “Open” it purports to be downloading a pdf file whereas in fact it is an HTML executable file.

It is therefore only a matter of imagination in getting people to freely download what could be an extremely dangerous worm - like, for instance, the Doom worm currently reeking havoc across the globe.

However what is more worrying is that this hole could easily be combined with another Explorer spoofing problem discovered in December.

more...
http://www.techworld.com/news/index.cfm?fuseaction=displaynews&NewsID=944




Security firm warns of new IE flaw

Last modified: January 28, 2004, 2:20 PM PST

By David Becker
Staff Writer, CNET News.com

A security services company warned of a new vulnerability in Microsoft's Internet Explorer Web browser that could allow Web surfers to be tricked into downloading malicious files.

Danish company Secunia posted details of the alleged flaw, which could be used in combination with an earlier "spoofing" flaw reported by the company.

Microsoft representatives did not immediately respond to a request for comment.

The new flaw could allow the owner of a malicious Web site to deliberately misidentify a downloadable file, so a malicious program file could be made to appear as if it were a secure file. Visitors might think they were downloading a document based on Adobe's portable document format (PDF), for instance, but actually receive a malicious, self-executing program such as the new MyDoom worm.

more...
http://news.com.com/2100-1002_3-5149583.html

[SoCalDem]

1. Could this impact on the Diebold Voting thing???

:)

[TomNickell]

13. Probably not.

The voting machines certainly don't run IE.

If they are connected to the Internet, it ought to be in a very limited way.

[ixion]

2. ironic... I came across a similar issue

within the context of a web application. You can set a mime type to whatever, and pump any type of file into the servlet stream.

Yet another demonstration of MS 'innovation' :eyes:

[raifield]

3. Brought to you by Microcrap

I know it's the largest software corporation ever, so why is it so much trouble for them to make sure their browser, which is embedded in their own operating system, acts like a piece of MODERN software?

Bah. That's why I use Opera.

[mouse7]

7. Take a look at the new Mozilla Firebird browser.

It's very nice. Not bloated like regular Mozilla.

http://www.mozilla.org/products/firebird/

[Don_G]

4. Everytiing Can Be Devestating

So why isn't it from anyone that pays attention to "security" concerns or anyone that buys anything at "Wal-Mart?."

[mouse7]

5. Ooops... close IE 6... Open Mozilla Firebird...

...log back into DU...

Okay. I'm back.

[htuttle]

6. Is this new?

I thought that this was basically the same problem that has been around forever in Outlook/Exchange, etc... Where an email attachment can be an executable file, yet use a filename extension of 'jpg', whereby the stupid email program executes the file thinking it is an image, and infects your computer?

What I don't get, is why does the email program try to 'execute' an IMAGE? Maybe it's cause I'm a Mac/Unix guy, but it makes no sense. If you label an executable as a jpeg on OSX, and you try to open it or view it, it just looks like a garbled mess. It's not actually 'executed'. The data is read by image viewing program or QuickTime.

Anyway, this sounds like a ridiculously stupid bug. I've been getting spam for ages that has executable attachments labeled as JPEGs, so it should have been no surprise that someone could also do it via a webserver.

[Cronus Protagonist]

8. You're not seeing the whole file extension

The file is usually labelled something like this:

image.jpg.jpeg.exe

and due to a windows setting, you don't see the file extensions of "known" file types, so the ".exe" part is not shown, and the file *looks* like a jpeg. And when you double click on it to view the file, it's really got an .exe extension so it executes as a program.

That's how they do it.

"FUCK Bush" Buttons, Stickers & Magnets

[htuttle]

10. Ah. I see. Do you have to click on it, though?

I thought I'd heard that some viruses got around by having the email program attempt to display the image 'inline' inside the email message. In other words, getting executed when the just message is opened in Exchange, not the attachment. Maybe that's just 'Office-macro' type viruses... Heck. I'm not sure. I don't use Windows very often.

[burrowowl]

9. This 'hole' has been around

since Word 5 or so where executables can be put in a document.
Or, we are surprised these people are surprised!

[Voltaire99]

11. Could be? They always are. Try this instead

If you are unhappily stuck on MS Windows, get thee to this nunnery:

www.mozilla.org

...and replace IE with a free, secure, stable browser with built-in pop-up ad suppression. You can download the latest Mozilla, but I recommend you try out Firebird there first. Easier to set up and use. Secondly, get rid of that virus breeding Outlook or Outlook Express you're running and replace it with a safe (non-Microsoft) email client.

Then again, if you're not stuck and can afford an Apple, what are you waiting for? For about $1,000, you can be done with this MS bullshit forever.

[Poiuyt]

14. Apple computers are great

There is very little that a Mac can't do that a PC can and it's MUCH less prone to viruses and other security problems.

[Rooktoven]

12. Get Mozilla Firebird--

And then if you switch to Linux or MacOSX there won't be as much of a learning curve.

Microsoft and their products suck.