Shocking vulnerability in MSIE

Tristan · 10-01-2005, 02:00

Don't know if this has been discussed already, but I saw this link on another site:

http://jmcardle.com/

If you're running IE and don't want to click the test link, then what happens is that it opens a command window, allowing it to execute any command it likes. To prove it, the link creates a new folder in the root of your C: drive.

When you consider that this is with SP2 and all subsequent patches applied, it's pretty serious and scary stuff.

Of course, Firefox and Opera are out there and available...

**Paul** · 10-01-2005, 02:23

The test fails here (IE6) - it just says "error on page" at the bottom, no sign of a folder being created.

punky · 10-01-2005, 03:14

You need SP2 for it to work. Apparently some

[This page explains it quite nicely. Apparently some people get error messages but it is still supposed to work.

Shaun · 10-01-2005, 05:24

Quote:

Originally Posted by punky

You need SP2 for it to work. Apparently some

[This page explains it quite nicely. Apparently some people get error messages but it is still supposed to work.

Well that page you linked to Punky caused my AV to spit its dummy out and quarantine the copy in the cache!

Richard M · 10-01-2005, 06:16

Worked here on fully patched IE.

Basically this means that important files can be deleted just by visiting some webpage, any command that can be entered on the command line will be executed.

You'd have to be very brave to continue using IE until this hole is patched.

punky · 10-01-2005, 07:20

Quote:

Originally Posted by dellwear

Well that page you linked to Punky caused my AV to spit its dummy out and quarantine the copy in the cache!

Probably because of the heuristics. It has source code in it, which the AV thinks is a virus (which it is)

10-01-2005, 07:57

Let's hope it is patched in tomorrow's MS updates!

bopdude · 10-01-2005, 08:37

Well I might have to look seriously at FF as an alternative but, can we ever be 'safe' on the net, answer is probably, no, not 100%

10-01-2005, 08:42

Test doesn't work here since ActiveX is disabled (IE Sp1)

iadom · 10-01-2005, 09:55

Dynamic virus protection in my AV, Command, fired up as soon as I clicked the link in first post, reported virus VBS/Phel.D@dll as infected which it then deleted.
IE SP2

Raistlin · 10-01-2005, 10:29

Doesn't work here on FF or on IE (with SP2 installed).

Probably something to do with the way that my system is set up

bopdude · 10-01-2005, 10:50

I can't try out my home puter coz I'm stuck in Southampton 'till at Wednesday, and I've not installed any AV software on my xda yet, *slaps own wrist, will do when I get back though.

Nikko · 10-01-2005, 11:50

Quote:

Originally Posted by iadom

Dynamic virus protection in my AV, Command, fired up as soon as I clicked the link in first post, reported virus VBS/Phel.D@dll as infected which it then deleted.
IE SP2

Norton did the same for me - flagged then deleted.

IE6 SP2

Now where's that link to Firefox?

jtwn · 10-01-2005, 16:33

IE6 SP2

No protection other than my router (if you could count that..)

= nothing

NEXT

Ramrod · 10-01-2005, 19:40

Setting the IE default security level to 'high' prevents the download of that file/script.....