02-01-2005, 11:50
|
#16
|
|
cf.mega poster
Join Date: Jun 2003
Posts: 4,952
|
Re: Browser Security Check
During the full test firefox is prompting me with various things. I assume I'm suppose to say no to each?
__________________
"Knowledge is Power. Power Corrupts. Study Hard. Be Evil."
|
|
|
|
02-01-2005, 11:53
|
#17
|
|
Inactive
Join Date: Jul 2003
Posts: 733
|
Re: Browser Security Check
I got the following with IE6SP2
Medium Risk Vulnerabilities
Microsoft Internet Explorer file:javascript: Cross Domain Scripting Vulnerability (ldy20030910-01)
Description
This bug allows a web site to read the contents of any file on your computer. The web site has to know the exact path and name of the file. A malicious website may also be able to exploit this vulnerability to delete mail from your webmail account or to spoof trusted websites.
Note: Opera browser is not vulnerable to this problem. If you are running Opera you don't need to patch.
Technical Details
It is possible to inject JavaScript code into Search bar and Media bar in Internet Explorer using "file:javascript:.." URL. The code will be execurted in the domain context of the document that was loaded in the bar.
A malicious web site can first open a document from any domain in Search bar and then execute JavaScript code getting access to the document.
There is a technique that allows injecting JavaScript code into Local Computer zone using this vulnerability. This allows a malicious web site to get access to local files and even execute arbitrary code. See "Additional Information" for details.
Recommendations
We recommend using Windows Update to correct this problem.
Update shows no downloads available...any ideas on how to rectify this?
|
|
|
|
|
02-01-2005, 12:26
|
#18
|
|
Inactive
Join Date: Jun 2003
Location: Los Angeles, CA
Age: 47
Posts: 6,343
|
Re: Browser Security Check
That was posted earlier in the thread, there is no patch.
|
|
|
|
|
02-01-2005, 12:29
|
#19
|
|
Dr Pepper Addict
Cable Forum Admin
Join Date: Oct 2003
Location: Nottingham
Age: 63
Services: Zen & YouFibre FTTP, Sky Q TV, Sky Mobile, Flextel SIP
Posts: 31,384
|
Re: Browser Security Check
Sooo - if there is no patch, then why do a lot of the people with IE6SP2 pass ?
__________________
 Baby, I was born this way.
|
|
|
|
|
02-01-2005, 12:59
|
#20
|
|
Inactive
Join Date: Jul 2003
Location: Eglinton, Co. Derry
Posts: 7,640
|
Re: Browser Security Check
Quote:
|
Originally Posted by Richard M
That was posted earlier in the thread, there is no patch.
|
What's this then? (first result on Google ....)
http://www.microsoft.com/technet/sec.../MS03-048.mspx
Look under technical details
Quote:
|
Three vulnerabilities that involve the cross-domain security model of Internet Explorer, which keeps windows of different domains from sharing information. These vulnerabilities could result in the execution of script in the My Computer zone
|
The download links are listed just above it.
|
|
|
|
|
02-01-2005, 14:04
|
#21
|
|
Inactive
Join Date: Jun 2003
Services: Virgin Media
Posts: 9,163
|
Re: Browser Security Check
When I googled it, I got a lot of other forum discussions about that message and they said there was no patch. I guess I used a slightly different search...
They said to turn javascript off.
On that microsoft bulletin that Bifta provided, there's no IE6 SP2 option.
|
|
|
|
|
02-01-2005, 14:51
|
#22
|
|
Guest
|
Re: Browser Security Check
Thanks for that Richard....... haven't been online much recently so neglected to update Java..... which was the only issue for me on IE6 
And to think i've never been brave enough to update to SP2....... but i still live 
Going to try it on Firefox now 
|
|
|
|
|
02-01-2005, 14:52
|
#23
|
|
In the corner, sulking.
Join Date: Jun 2003
Location: Shaw, Oldham, Lancashire.
Services: 2 TV 360 boxes. 500mb BB, Phone line.
Posts: 8,041
|
Re: Browser Security Check
Quote:
|
Originally Posted by Richard M
Mozilla Firefox passed with flying colours of course.
|
high risks 0
medium risks 1
low risks 0
Medium Risk Vulnerabilities
Mozilla Windows shell: protocol handler vulnerability (moz250180)
Description
This bug allows to open local files and folders from a web page using the shell: protocol URLs. For example "shell:windows" URL will open the Windows directory. On Windows XP it is also possible to start local programs, for example "shell:windows\system32\calc.exe" will start Calculator. It might be also possible to download and run remote programs using this vulnerability. The bug only affects Windows installations of Mozilla, Firefox and Thunderbird. If you are not running Windows your browser is not vulnerable.
But as I have never used Bifta's favourite browser, I guess there is no need to worry. 
IE.6 SP2 here. 
|
|
|
|
|
02-01-2005, 17:35
|
#24
|
|
cf.mega poster
Join Date: Jun 2003
Location: Croydon
Age: 40
Services: Sky Q and Hyperoptic
Posts: 1,310
|
Re: Browser Security Check
Passed with IE6SP2!
|
|
|
|
|
02-01-2005, 20:21
|
#25
|
|
Inactive
Join Date: Jun 2003
Location: Cambridge
Posts: 16,760
|
Re: Browser Security Check
Quote:
High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0
|
Passed, using both Firefox 1 & IE6 on Win XP Pro SP2.
|
|
|
|
|
02-01-2005, 21:27
|
#26
|
|
Inactive
Join Date: Jun 2003
Location: Teesside
Posts: 8,315
|
Re: Browser Security Check
So, as a forever pessimistic person, and doubter to boot, i guess nobody is /or will ever be totally safe shrug:
|
|
|
|
|
04-01-2005, 02:46
|
#27
|
|
Inactive
Join Date: Jun 2003
Services: Weddings, christenings, barmitzvahs and funerals.
Posts: 860
|
Re: Browser Security Check
Running IE6 on XP Pro with SP1
Quote:
High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0
|
Shows that IE isn't as bad as people make it out to be.
|
|
|
|
|
06-01-2005, 22:00
|
#28
|
|
Inactive
Join Date: Jun 2003
Services: Virgin Media
Posts: 9,163
|
Re: Browser Security Check
Strange. I disabled my firewall and now I pass with flying colours... 
|
|
|
|
Posting Rules
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
HTML code is Off
|
|
|
All times are GMT. The time now is 11:58.
|
Join CF
You are here: 
