Internet Explorer Zero-Day Exploit

[dduardo]

http://www.eweek.com/article2/0,1759,1891749,00.asp?kc=EWRSS03119TX1K0000594

IE users should be aware of the websites they visit. There is yet another zero-day exploit that doesn't require any user intervention and can take over your system. Here is the proof of concept:

http://www.computerterrorism.com/research/ie/poc.htm

and here is the advisory:

http://www.computerterrorism.com/research/ie/ct21-11-2005

Even users with Windows XP SP2 are affected.

Solution(s):

1) Disable javascript in IE - If you do this many websites won't work
2) Use an alternate browser (Firefox - www.mozilla.org[/url] , Opera - [url]www.opera.com[/URL])

The sad part is that Microsoft has known about this bug since 05/31/2005 and they haven't done anything about it.

 

[cronxeh]

How much are you willing to bet they haven't known about this before 5/31/2005?

 

[dduardo]

Yes, it's possible Microsoft knew about it before that date, but May was the month that some 3rd party security researcher told Microsoft about it.

 

[franznietzsche]

The sad part is that Microsoft has known about this bug since 05/31/2005 and they haven't done anything about it.

Nothing new, there are dozens of bugs in IE that they flat out refuse to fix. Notice how there hasn't been a new version of it since 2001? And its a piece of crap.

 

[Math Is Hard]

Thanks for the heads up, dduardo!