Internet Explorer is proven very fragile and not secure finally Microsoft admit it all version of the IE is affected. Internet Explorer just cannot catch a break these days. The German Federal Office for Security in Information Technology has officially advised people to stop using Internet Explorer, all versions, until Microsoft releases a new patch for the latest gaping security hole. we advice you the same use other browser not the IE.
Microsoft is investigating reports of limited, targeted attacks against customers of Internet Explorer 6, using a vulnerability in Internet Explorer. This advisory contains information about which versions of Internet Explorer are vulnerable as well as workarounds and mitigations for this issue.
MS investigation so far has shown that Internet Explorer 5.01 Service Pack 4 on Microsoft Windows 2000 Service Pack 4 is not affected, and that Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4, and Internet Explorer 6, Internet Explorer 7 and Internet Explorer 8 on supported editions of Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2 are vulnerable.
The vulnerability exists as an invalid pointer reference within Internet Explorer. It is possible under certain conditions for the invalid pointer to be accessed after an object is deleted. In a specially-crafted attack, in attempting to access a freed object, Internet Explorer can be caused to allow remote code execution.
At this time, we are aware of limited, targeted attacks attempting to use this vulnerability against Internet Explorer 6. We have not seen attacks against other versions of Internet Explorer. We will continue to monitor the threat environment and update this advisory if the situation changes. On completion of this investigation, Microsoft will take appropriate action to protect our customers, which may include providing a solution through our monthly security update release process, or an out-of-cycle security update.
We are actively working with partners in our Microsoft Active Protections Program (MAPP) and our Microsoft Security Response Alliance (MSRA) programs to provide information that they can use to provide broader protections to customers. In addition, we’re actively working with partners to monitor the threat landscape and take action against malicious sites that attempt to exploit this vulnerability.
Microsoft continues to encourage customers to follow the "Protect Your Computer" guidance of enabling a firewall, applying all software updates and installing anti-virus and anti-spyware software. Additional information can be found at Security at home.
Mitigating Factors:
| • | Data Execution Protection (DEP) is enabled by default in Internet Explorer 8 on the following Windows operating systems: Windows XP Service Pack 3, Windows Vista Service Pack 1, Windows Vista Service Pack 2, and Windows 7. |
| • | Protected Mode in Internet Explorer on Windows Vista and later Windows operating systems limits the impact of the vulnerability. |
| • | In a Web-based attack scenario, an attacker could host a Web site that contains a Web page that is used to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content or advertisements could contain specially crafted content that could exploit this vulnerability. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker’s Web site. |
| • | An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less affected than users who operate with administrative user rights. |
| • | By default, Internet Explorer on Windows Server 2003 and Windows Server 2008 runs in a restricted mode that is known as Enhanced Security Configuration. This mode sets the security level for the Internet zone to High. This is a mitigating factor for Web sites that you have not added to the Internet Explorer Trusted sites zone. |
| • | By default, all supported versions of Microsoft Outlook, Microsoft Outlook Express, and Windows Mail open HTML e-mail messages in the Restricted sites zone. The Restricted sites zone helps mitigate attacks that could try to exploit this vulnerability by preventing Active Scripting and ActiveX controls from being used when reading HTML e-mail messages. However, if a user clicks a link in an e-mail message, the user could still be vulnerable to exploitation of this vulnerability through the Web-based attack scenario. |
If you were not aware, in Internet Explorer there is a current security problem that allows a webpage to maliciously inject code onto the machine running the browser. This bug was used by “Operation Aurora,” which hacked Google and other companies in recent days.
Consider this…if it is a large enough problem to hack Google, your site is not safe.
In a statement, the BSI (German Federal Office for Information Security) recommends that until a full patch is released for this “zero day” flaw, that Internet Explorer is not safe, even if users run IE in protected mode.
Given that the majority of the world still runs on Internet Explorer, it seems unlikely that any major impact will be made to IE market share, but at least in Germany the powers that be are making direct moves to protect their citizens.
Affected and Non-Affected Software
This advisory discusses the following software.
| Affected Software |
| Microsoft Windows 2000 Service Pack 4 |
| Windows XP Service Pack 2 and Windows XP Service Pack 3 |
| Windows XP Professional x64 Edition Service Pack 2 |
| Windows Server 2003 Service Pack 2 |
| Windows Server 2003 x64 Edition Service Pack 2 |
| Windows Server 2003 with SP2 for Itanium-based Systems |
| Windows Vista, Windows Vista Service Pack 1, and Windows Vista Service Pack 2 |
| Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2 |
| Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 |
| Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service pack 2 |
| Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2 |
| Windows 7 |
| Windows 7 for x64-based Systems |
| Windows Server 2008 R2 for x64-based Systems |
| Windows Server 2008 R2 for Itanium-based Systems |
| Internet Explorer 6 Service Pack 1 on Microsoft Windows 2000 Service Pack 4 |
| Internet Explorer 6 for Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2 |
| Internet Explorer 6 for Windows Server 2003 Service Pack 2, Windows Server 2003 with SP2 for Itanium-based Systems, and Windows Server 2003 x64 Edition Service Pack 2 |
| Internet Explorer 7 for Windows XP Service Pack 2 and Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2 |
| Internet Explorer 7 for Windows Server 2003 Service Pack 2, Windows Server 2003 with SP2 for Itanium-based Systems, and Windows Server 2003 x64 Edition Service Pack 2 |
| Internet Explorer 7 in Windows Vista, Windows Vista Service Pack 1, Windows Vista Service Pack 2, Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2 |
| Internet Explorer 7 in Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 |
| Internet Explorer 7 in Windows Server 2008 for Itanium-based Systems and Windows Server 2008 for Itanium-based Systems Service Pack 2 |
| Internet Explorer 7 in Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 |
| Internet Explorer 8 for Windows XP Service Pack 2, Windows XP Service Pack 3, and Windows XP Professional x64 Edition Service Pack 2 |
| Internet Explorer 8 for Windows Server 2003 Service Pack 2, and Windows Server 2003 x64 Edition Service Pack 2 |
| Internet Explorer 8 in Windows Vista, Windows Vista Service Pack 1, Windows Vista Service Pack 2, Windows Vista x64 Edition, Windows Vista x64 Edition Service Pack 1, and Windows Vista x64 Edition Service Pack 2 |
| Internet Explorer 8 in Windows Server 2008 for 32-bit Systems and Windows Server 2008 for 32-bit Systems Service Pack 2 |
| Internet Explorer 8 in Windows Server 2008 for x64-based Systems and Windows Server 2008 for x64-based Systems Service Pack 2 |
| Internet Explorer 8 in Windows 7 for 32-bit Systems |
| Internet Explorer 8 in Windows 7 for x64-based Systems |
| Internet Explorer 8 in Windows Server 2008 R2 for x64-based Systems |
| Internet Explorer 8 in Windows Server 2008 R2 for Itanium-based Systems Almost every release affected by it :( |
| Non-Affected Software |
| Internet Explorer 5.01 Service Pack 4 for Microsoft Windows 2000 Service Pack 4 <---<< Ha ha ha ha ha Poor Microsoft! In practice, no one use this may be billgets use that At least Germany is doing something about it. What we are doing ? when international time server is not even know even our local time like Google, Apple and others counting our time as GMT+7 & NO DTS |
No comments:
Post a Comment