Technology news and Jobs 
VIRTUALISATION Why the latest IE flaw proves Linux got it right from the start
VIRTUALISATION Why the latest IE flaw proves Linux got it right from the start | Why the latest IE flaw proves Linux got it right from the start |
|
| by David M Williams | |
| Sunday, 21 December 2008 | |
|
Page 1 of 3   
Featured Whitepaper
5 Best Practices for Smartphone Support
It could be critical for previous versions of Internet Explorer too but Microsoft didn't test them because they're no longer supported. Being a curious type when I saw all the hubbub about a new major critical vulnerability in Internet Explorer I wanted to know just what it was about. First, the best way to get the fix for your Windows operating system, irrespective of flavour, is Windows Update. Yet, the text accompanying the update is typically brief: Security Update for Internet Explorer 7 in Windows Vista (KB960714) Published 18th December 2008 Update type: Important Security issues have been identified that could allow an attacker to compromise a system running Microsoft Internet Explorer and gain control over it. You can help protect your system by installing this update from Microsoft. While that doesn’t tell us much, the knowledge base article (or “KB”) 960714 referenced does spill the beans. Fundamentally, it was discovered that program code – of a malicious person’s construction – be executed on your computer, if a user views a specially crafted web page with IE. In particular, a rogue script can allocate a block of memory (an array) then apparently release it without updating the array’s length, meaning that the block of memory still remains preserved. Then, if data binding is enabled (which it is, by default), a rogue web page can take advantage of an incorrect handling of certain XML tags within IE to cause the browser to pass control to the supposedly free memory location. If the script had pre-filled that memory with actual executable instructions then the author has effectively been able to cause your computer to do something of their bidding, under your user credentials. You can find a harmless code example over the page which will make calc.exe (ie Windows Calculator) display itself. The code is merely presented in a readable format; it will not actually run. CONTINUED |
| < Next story in category | Previous story in the category > |
|---|
