Shocking vulnerability in MSIE
 

Don't know if this has been discussed already, but I saw this link on another site:

http://jmcardle.com/

If you're running IE and don't want to click the test link, then what happens is that it opens a command window, allowing it to execute any command it likes. To prove it, the link creates a new folder in the root of your C: drive.

When you consider that this is with SP2 and all subsequent patches applied, it's pretty serious and scary stuff.

Of course, Firefox and Opera are out there and available...

Re: Shocking vulnerability in MSIE
 

The test fails here (IE6) - it just says "error on page" at the bottom, no sign of a folder being created.

Re: Shocking vulnerability in MSIE
 

You need SP2 for it to work. Apparently some

[This page explains it quite nicely. Apparently some people get error messages but it is still supposed to work.

Re: Shocking vulnerability in MSIE
 

Well that page you linked to Punky caused my AV to spit its dummy out and quarantine the copy in the cache!

Re: Shocking vulnerability in MSIE
 

Worked here on fully patched IE. :eek:
Basically this means that important files can be deleted just by visiting some webpage, any command that can be entered on the command line will be executed. :disturbd:
You'd have to be very brave to continue using IE until this hole is patched.

Re: Shocking vulnerability in MSIE
 

Probably because of the heuristics. It has source code in it, which the AV thinks is a virus (which it is)

Re: Shocking vulnerability in MSIE
 

Let's hope it is patched in tomorrow's MS updates!

Re: Shocking vulnerability in MSIE
 

Well I might have to look seriously at FF as an alternative but, can we ever be 'safe' on the net, answer is probably, no, not 100% :(

Re: Shocking vulnerability in MSIE
 

Test doesn't work here since ActiveX is disabled (IE Sp1)

Re: Shocking vulnerability in MSIE
 

Dynamic virus protection in my AV, Command, fired up as soon as I clicked the link in first post, reported virus VBS/Phel.D@dll as infected which it then deleted.
IE SP2;)

Re: Shocking vulnerability in MSIE
 

Doesn't work here on FF or on IE (with SP2 installed).

Probably something to do with the way that my system is set up :D

Re: Shocking vulnerability in MSIE
 

I can't try out my home puter coz I'm stuck in Southampton 'till at Wednesday, and I've not installed any AV software on my xda yet, *slaps own wrist, will do when I get back though.

Re: Shocking vulnerability in MSIE
 

Norton did the same for me - flagged then deleted.

IE6 SP2

Now where's that link to Firefox? :Yikes:

Re: Shocking vulnerability in MSIE
 

IE6 SP2

No protection other than my router (if you could count that..)

= nothing

NEXT :p:

Re: Shocking vulnerability in MSIE
 

Setting the IE default security level to 'high' prevents the download of that file/script.....