Why the latest IE flaw proves Linux got it right from the start

David M Williams
Sunday, 21 December 2008 09:59

Opinion and Analysis

You've all heard a major new flaw has been found affecting Internet Explorer all the way back to version 5. Microsoft pushed out a fix out of their regular "patch Tuesday" monthly schedule. The flaw has prompted some commentators to call for the replacement of IE with alternate browsers like Firefox. Just what was so serious? And what do Microsoft say that show Linux has the superior design?

This security update is rated Critical for Internet Explorer 5.01, Internet Explorer 6, Internet Explorer 6 Service Pack 1, and Internet Explorer 7.

It could be critical for previous versions of Internet Explorer too but Microsoft didn't test them because they're no longer supported.

Being a curious type when I saw all the hubbub about a new major critical vulnerability in Internet Explorer I wanted to know just what it was about.

First, the best way to get the fix for your Windows operating system, irrespective of flavour, is Windows Update. Yet, the text accompanying the update is typically brief:

Security Update for Internet Explorer 7 in Windows Vista (KB960714)
Published 18th December 2008
Update type: Important

Security issues have been identified that could allow an attacker to compromise a system running Microsoft Internet Explorer and gain control over it. You can help protect your system by installing this update from Microsoft.

While that doesn’t tell us much, the knowledge base article (or “KB”) 960714 referenced does spill the beans.

Fundamentally, it was discovered that program code – of a malicious person’s construction – be executed on your computer, if a user views a specially crafted web page with IE.

In particular, a rogue script can allocate a block of memory (an array) then apparently release it without updating the array’s length, meaning that the block of memory still remains preserved.

Then, if data binding is enabled (which it is, by default), a rogue web page can take advantage of an incorrect handling of certain XML tags within IE to cause the browser to pass control to the supposedly free memory location.

If the script had pre-filled that memory with actual executable instructions then the author has effectively been able to cause your computer to do something of their bidding, under your user credentials.

You can find a harmless code example over the page which will make calc.exe (ie Windows Calculator) display itself. The code is merely presented in a readable format; it will not actually run.

CONTINUED