45 Comments(s). 1 Pages(s). Showing page 1. [ 1 ]

   #43. Posted at 09:32 AM on Jul 11th 2007 Edit   Reply
sigher
Analogy: Imagine you were a passenger on the titanic, it just sank and you are in the cold water, there are 2 life rafts near you, one is empty and one is commanded by the captain of the titanic, which one would you pick? The captain waves "come over here I'll keep you safe"
collapse
#43, I don't get it.  :  Shark  (#44)  «
#44, HALP A SHARK!  :  sigher  (#45)  «

   #23. Posted at 05:02 PM on Jul 10th 2007 Edit   Reply
stmok
Well, I've delibrately ran a demo vulernability with Firefox under Linux.
=> http://larholm.com/vuln/firefoxurl.html

I get a popup saying:
"Firefox doesn't know how to open this address, because the protocol (firefoxurl) isn't associated with any program."

Other than that, nothing happens.

This issue specifically requires a Windows system with both Firefox and IE installed. (I don't use Windows so its a non-issue for me).

If you are paranoid or scared, you can just use a Linux LiveCD to do your web surfing until a patch is released.
collapse
#23, I have IE and FF (with addons), when I try the exploit test ...  :  sigher  (#42)  «

   #17. Posted at 02:41 PM on Jul 10th 2007 Edit   Reply
ManAtVista
Meanwhile, protected mode IE7 on Vista continues to pay dividends with immunity to probably any hack that'll ever get made.
collapse
#17, "This can be exploited to execute arbitrary commands e.g. wh...  :  sigher  (#18)  «
#17, yeah IE7 is safe as houses (in new orleans), they had hotfix...  :  sigher  (#19)  «
#19, Yes, but they cannot be used to access a users files or s...  :  ManAtVista  (#31)  «
#31, You obviously did not read the details of the security...  :  sigher  (#32)  «
#32, Yea OK, sigher, why don't you show me an IE7 exploi...  :  ManAtVista  (#36)  «
#19, Are you one of those that also states that MS is slow to ...  :  SGT Lindy  (#39)  «
#39, I resisted FF a long time, but the viruses IE shoved d...  :  sigher  (#40)  «
#40, BTW, I acknowledge that MS took a new road in regar...  :  sigher  (#41)  «

   #9. Posted at 01:17 PM on Jul 10th 2007 Edit   Reply
alphaGulp
I got infected a few weeks ago by a pop-up add in Firefox. It has been a huge pain in the butt, since no virus checker has managed to remove it entirely, and only by running with my Active Desktop disabled am I able to disable the virus (otherwise it pops up adds and plays audio adds).

Anyhow, I've been putting off re-installing the OS, since it's such a pain having to do so, but I am practically certain the infection occurred when that pop-up was displayed in Firefox.

Hopefully this is the vulnerability those bums took advantage of, and it will be patched soon. I am starting to wonder if I shouldn't switch to Linux at home...
collapse
#9, I seem to remember fixing something similar. Start>Run>reged...  :  Kent_dieGo  (#16)  «
#16, Very helpful NOT  :  sigher  (#20)  «
#20, don't be rude!  :  eitje  (#28)  «
#28, laughing :)  :  sigher  (#33)  «
#9, Yeah, definitely go Linux at home. Or at least dual boot. I ...  :  DrCR  (#21)  «

   #29. Posted at 07:01 PM on Jul 10th 2007 Edit   Reply
Fighterpilot
Fireflop fanboys and XP dinosaurs get pwned.
Vista+IE7 FTW!
collapse
#29, No, fools that run as "Admin", are not behind a firewall and...  :  Krogoth  (#35)  «
#35, Visiting a web site with Vista/IE7 with security defaults...  :  ManAtVista  (#37)  «

   #34. Posted at 08:21 PM on Jul 10th 2007 Edit   Reply
2_tyma
ive noticed hangs in this version? anyone else
collapse

   #30. Posted at 07:04 PM on Jul 10th 2007, Edited at 07:07 PM on Jul 10th 2007 Edit   Reply
cAPS lOCK
This can be exploited to execute arbitrary commands e.g. when a user visits a malicious web site using Microsoft Internet Explorer.

So they're basically saying that if you use FF for your everyday browsing and only use IE for Windows Update (which I wouldn't classify as a malicious website) this bug has no importance whatsoever.
collapse

   #27. Posted at 05:37 PM on Jul 10th 2007 Edit   Reply
indeego
For those running as admin:
http://fileforum.betanews.com/detail/Sandboxie/1139521062/1
:)
collapse

   #11. Posted at 01:37 PM on Jul 10th 2007 Edit   Reply
Ryu Connor
Yet another exploit whose impact can be mitigated by not running Admin.
collapse
#11, indeego? ;-)  :  5150  (#13)  «
#13, Even I'm sick of saying it by now. ;)  :  indeego  (#26)  «

   #7. Posted at 12:54 PM on Jul 10th 2007 Edit   Reply
SGT Lindy
How is that different from IE or Safari?

They get bugs and based on the urgency they get patched. 50% of MS patches prior to IE7 were IE6 patches.
collapse
#7, I don't think you understand the issue. Its different because...  :  stmok  (#25)  «

   #24. Posted at 05:12 PM on Jul 10th 2007 Edit   Reply
albundy
I'd rather sleep in the bottom bunk bed while Rosie and her fat friends jump up and down on the top bunk; I'd rather bait crocodiles with my manhood, before i ever use IE again.
collapse

   #10. Posted at 01:25 PM on Jul 10th 2007, Edited at 01:50 PM on Jul 10th 2007 Edit   Reply
eloj
Hmm.. when I try to open a firefoxurl://<whatever> the first thing I get is a warning.

Disabling

HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\FIREFOX.EXE\Capabilities\URLAssociations

Didn't seem to do anything either (maybe cached?), but the location looks more informational than declarative..

Seems to be based on this: http://sla.ckers.org/forum/read.php?3,12752
collapse
#10, Hmm.. when I try to open a firefoxurl://<whatever> the first...  :  Contingency  (#22)  «

   #1. Posted at 11:34 AM on Jul 10th 2007 Edit   Reply
shank15217
time for 2.0.0.5 anyways, i was getting tired of 2.0.0.4 with its even numbers..
collapse
#1, 2.0.0.4 was so 2004 =/  :  nagashi  (#3)  «
#3, Was that a joke? I don't get it. 2.0.0.4 just came out on ...  :  crabjokeman  (#14)  «
#1, And that to me is the best part of Firefox' security model. ...  :  RyanVM  (#4)  «
#4, Patching is not a security model, unfortunately.  :  Shark  (#5)  «
#5, What? Its not the model, its how you KEEP things secur...  :  Corrado  (#6)  «
#6, RyanVM said patching was the best part of the model...  :  Shark  (#8)  «
#8, You're right, I misspoke.  :  RyanVM  (#15)  «

   #12. Posted at 01:38 PM on Jul 10th 2007 Edit   Reply
sativa
is there a way to unregister it via group policy?
collapse

   #2. Posted at 11:35 AM on Jul 10th 2007 Edit   Reply
mac_h8r1
oh n0es w3 are to get t3h f1r3h4x0rz
collapse
45 Comments(s). 1 Pages(s). Showing page 1. [ 1 ]
 
Name/Password: / Remember
Reply to:
[click to clear]

[RED] [GREEN]
[BOLD]
[ITALIC] [STRIKE]
[UNDERLINE]

Notice: All posts should abide by the rules, please.
Note: Ctrl-Enter submits the post. (In IE)
DThread keys: Click on a reply to position the blue bar. 'A'/'Z' move it up/down.
Jazztags: (they MUST be closed)
    r{ red }r     g{ green }g     /[ italic ]/     *[ bold ]*
    _[ underline ]_     -[ strike ]-     s[ sample ]s     o[ spoiler ]o  q[ (QUOTE) ]q