RSSYet another cross-site scripting vulnerability affects IE7 on XP
By Scott M. Fulton, III | Published May 16, 2008, 2:11 PM
A private security researcher well known for turning up cross-site scripting vulnerabilities in Web browsers has discovered another one, and is trumpeting the find as another milestone in Web history.
Truth is, it sounds like a trumpet we've all heard too many times before. On Wednesday, researcher Aviv Raff posted on his Web site the discovery of a vulnerability so open and easy to exploit, that merely mentioning what it is could be enough of an instruction manual for malicious exploiters to try it for themselves.
Mainly, it involves Internet Explorer 7 running on all versions of Windows XP; however, BetaNews was able to trigger the vulnerability using proof-of-concept code on the latest public beta of IE8 running in Windows Vista (not SP1), though with Protected Mode turned off intentionally.
Simply put, when printing a Web page onto paper, IE gives the user an option to print a separate page showing a table of hyperlinks inside the page. Typically, processes related to the printer are run with a security level set to "Local Machine Zone," whose security is usually more lax. So as Raff discovered, jobs sent to the printer from IE run with the more lax security. Thus embedded script within the hyperlinks is capable of being run unchecked, even though it's IE itself that's re-embedding those hyperlinks into the user-generated table.
The proof-of-concept Raff provides embeds code that runs the Calculator, though conceivably any script code could have run in that space unchecked. In BetaNews tests, the exploit was successfully triggered using IE7 in Windows XP SP2 and Windows XP SP3.
On his Web post from Wednesday, Raff states he contacted Microsoft the day before, but "their last response was that they are looking at an appropriate fix." Microsoft has yet to issue any official response to the matter.
Vista is NOT affected because UAC is enabled by default and so IE7 runs in Protected mode: NO code exection!
Score: 0
|I do not believe IE7 runs in protected mode by default.
Score: 0
|Who uses IE anyways? Anyone with more than one brain call uses FF. LOL@noobsusingIE
Score: 0
|I suspect I have more than one brain cell and FF doesn't support what I do for a living. IE does.
Score: 0
|Who uses IE anyways?
75% of the market...?
Score: 0
|This IE7 is a mess. For testing our Web apps, I need the AutoComplete feature. IE7 remembers the login / pwd in a chaotic way. Sometimes it works, sometimes it doesn't. Autocomplete works OK on an application, then stops working on the SAME application under a different URL.
Firefox 2 works perfectly. I have read MS tech support and didn't find yet the solution. There are of course softwares that could fill in the inputs. But for a few inputs I need, AutoComplete would be enough.
May be there are other strengths in IE7 but I feel more comfortable with FF, AdBlock Plus and like better the way FF handles bookmarks.
Score: 0
|There is a simple way to resolve this, DON'T INSTALL IE7!
Granted, IE6 has had the same types of issues, but IE7 is still a huge work in progress and until IE8 (Which is in BETA) is out and proven, IE 6 is still the most Stable Browser that M$ has produced.
Score: 0
|avoid all the IE bugs by simply installing: http://www.ubuntu.com/
Score: 0
|What a strange statement. I don't use IE7 very much, but it is vastly superior to version 6 and its hundreds of patches.
Score: 0
|or for those that Linux is not the answer for just don't use IE.
Score: 0
|If Ubuntu came out as it is when Win95/98 came out, it might have been a different story. But with Vista and XP in its current state, there is little Ubuntu offers apart from hosting that makes it appealing.
Score: 0
|I think you meant Firefox.
*shrug*
To each his own, I guess. ;)
Score: 0
|Ubuntu is more stable than XP or Vista and it runs much faster. Ubuntu also has startup and shutdown times comparable to the x86 version of Mac OS X. Under Vista SP 1 my computers hard disk constantly grinds away even though I have 2GB of memory and an Intel Core 2 E6420 CPU. This only affects performance when shutting down Vista (sometimes it takes 5 minutes to shutdown even after a clean install of Vista and SP 1). The best part about Ubuntu is nearly all hardware works out of the box. On Windows XP and Vista you have to install drivers separately.
Score: 0
|Well, Ubuntu doesn't provide a solution because you can just install the IE7 engine on it.
:-D
http://www.tatanka.com.br/ies4linux/page/Beta
Score: 0
|That's a bad argument. No OS is more stable than the other. I know of many drivers that reduce the stability of Ubuntu, and some that will lock it solid (they bend Linux over so badly that you can't use kernel magic to reboot it forcing you to hold the power button for 5-8 seconds).
Score: 0
|I dunno about that..after installing Ubuntu a week ago my machine has been more stable and responsive than it has been in a year of running Vista. I like the things Microsoft have done with the UI and can appreciate the hardening of security in Vista but I am just not impressed with the performance.
Score: 0
|I do, I've been a full time Ubuntu user since 4.x :-D.
It absolutely can be stable and responsive, but it's IMHO no more so than any other OS.
Score: 0
|Why??
*shudders*
Score: 0
|Ubuntu is more stable than XP or Vista and it runs much faster.
Perhaps in your experience. Not in mine.
Score: 0
|It's mostly useful to test that web code displays properly in IE, when your primary development platform is Linux.
It's not really useful for anything else.
Score: 0
|I'd still think one would rather boot into Windows to test it....
Score: 0
|That's because you've never loaded it, liar.
Score: 0
|That, or boot a Windows VM.
Score: 0
|Wouldn't that qualify as booting into windows? ;)
Score: 0
|*laughs*
Like you would know *anything*.
Really.
Anything.
I have Ubuntu 8.04 installed as the third OS on my system (accessed via Acronis OS Selector) along with Windows XP (TinyXP Rev08) and Windows Vista Ultimate.
I have used all three. Though, to be honest, I only really use Ubuntu so that I know what I am talking about when I rip your, El Dingo's, and sjc001's lies regarding Linux to shreds. :)
Note: Linux ain't bad, I just have no real use for it when it comes to personal PC use.
Score: 0
|Can you tell I'm only 1/2 paying attention today? :-D
Score: 0
|Wouldn't want you paying full attention. Lord only knows what *else* you are *supposed* to be paying attention to.
(In other words, you boss called....get back to work!)
Score: 0
|"you" boss called?
Heh, couldn't resist :)
Score: 0
|Heh...
My "" key is missing. I can't type anything with the lette "" in it.
See?
;)
Score: 0
|meh, I'm 3K miles away from the office today :-D
Score: 0
|:-D I think I'm gonna be a full time Ubuntu user (well not sure on the Ubuntu, but some kind of Linux) from now on. It may not be any more stable than any other OS but in my personal case I had lag times in loading programs on Vista that just were not there in XP and aren't there in Ubuntu.
Score: 0
|To each their own I guess. It's just like my experience with Vista over that past year wasn't all sunshine and roses as most of you have described.
Score: 0
|Ah.
The farther the better.
You aren't chained by one of those crackberries, are you?
Score: 0
|and a laptop and a tether cable for world wide network access.
Yep.
Score: 0
|Wow.
They've got you three ways from Sunday, don't they?
I suppose it's still better than being stuck at the office, eh?
Score: 0
|Absolutely, I don't do "production" or "operations" work, so I don't care.
My phone never rings. :-D
Score: 0
|