Major Internet Explorer vulnerability

[JoeTomasone]

If you are using Internet Explorer, you may not want to for a while...

http://news.bbc.co.uk/1/hi/technology/7784908.stm

This is a pretty serious one, folks.   

[Stonewall]

Yes, thank you.  Just got your email via flwg.us.

[Eclipse]

Kidding aside, if you're reading this right now in IE, you owe it to yourself to at least try Firefox or Opera...

A good browser and AVG are all I've ever needed to keep my machines clean and secure.

The challenge her is that some ecommerce sites don't work and play well with anything other than IE, including a lot of banks, though that has been easing since people have started getting on the connected phone bandwagon.

http://www.mozilla.com/en-US/firefox/
Get the Adblock Plus add-on and disable pop-ups and Java script and you're golden.
(I personally still use and prefer FF2, but that is because a couple of my add-ons aren't supported in FF3)
Note: there are one or two advanced features on eServices that require IE - mostly report generation where its couting
on an active server page that fails to execute in FF, otherwise, no issue. (just light up IE for that function, or get the
FF add-on called "IE Tab" that renders pages with the IE engine in an FF tab)

http://www.opera.com/
I used to be a paying Opera customer before it was free, fast and secure, I just prefer the FF experience now.

I am no longer surprised, but still disappointed when I sit down at a users desk and IE comes up with 7 pops ups and
ads all over the place - the user experience between a secured, clean install of FF versus IE is literally night and day.
No wonder people are frustrated.

[JC004]

Security flaw in Internet Explorer?  That's odd...

www.getfirefox.com

[pixelwonk]

Please don't get firefox.
I'd love to have FF have a micro market share of browsers while maintaining it's great addon developer community so that it's just not worth the hassle for spyware, malware and virus developers.  To think of all you IE people peeing in my pristine Firefox pool makes me sob tiny salty packets.

Keep using IE.  Please.

[_]

Please don't get firefox.
I'd love to have FF have a micro market share of browsers while maintaining it's great addon developer community so that it's just not worth the hassle for spyware, malware and virus developers.  To think of all you IE people peeing in my pristine Firefox pool makes me sob tiny salty packets.

Keep using IE.  Please.

And stay away from Macs too.

[Eclipse]

To think of all you IE people peeing in my pristine Firefox pool makes me sob tiny salty packets.

Keep using IE.  Please.

Nertz...forgot about that..ignore what I said above and keep using IE!

[Eeyore]

As long as all of you are using IE or FF I'm happy. I'll stick with my Mac.

[pixelwonk]

Well, yeah, that too, but I didn't want to add my Mac snobbery in addition to my Firefox snobbery. 

[AvroArrow]

So that's why my AVG firewall has been down... 

Hmm... (it's been "disabled" and when I've been trying to fix it, the program fails/locks up and won't let me back in unless I restart)

[Timbo]

IE will eat your soul.    

[shorning]

People still use Macs?  How...quaint...

[♠SARKID♠]

Please don't get firefox.
I'd love to have FF have a micro market share of browsers while maintaining it's great addon developer community so that it's just not worth the hassle for spyware, malware and virus developers.  To think of all you IE people peeing in my pristine Firefox pool makes me sob tiny salty packets.

Keep using IE.  Please.

Agreed.  Lets keep FF on the downlow.  IE users, want to mess something up?  Go switch to google chrome.

[JAFO78]

I have used Firefox on 3 different computers and I love it, Just as soon as I set up my new computer the first thing I download is the FOX!!  :angel: :clap:

[Ricochet13]

Please don't get firefox.
I'd love to have FF have a micro market share of browsers while maintaining it's great addon developer community so that it's just not worth the hassle for spyware, malware and virus developers.  To think of all you IE people peeing in my pristine Firefox pool makes me sob tiny salty packets.

Keep using IE.  Please.

And stay away from Macs too.

Too late!  Have a MAC . . . have always had a MAC . . . will always have a MAC . . . you can have my MAC when you pry it from my cold dead hands!   

[Pylon]

Agreed with Tedda.  Switch to Opera or Netscape or something,  and keep buying PC towers and bulky laptops!   

[EXArmySFinIowa]

Once again a article misleading and/or outright lying to the public concerning Microsoft, and then spead by those who do not like MS for one reason or another.

Microsoft has posted work arounds for the flaw, see http://blogs.technet.com/swi/archive/2008/12/12/Clarification-on-the-various-workarounds-from-the-recent-IE-advisory.aspx .

Also for those of you who like FireFox, 3.0.5 has been release because of Security Flaws, see http://isc.sans.org/diary.html.


For a complete listing of Security Flaws for the week see http://www.us-cert.gov or http://sans.org.

[JoeTomasone]

Once again a article misleading and/or outright lying to the public concerning Microsoft, and then spead by those who do not like MS for one reason or another.

Assumption on your part.  I've been a Windows users since the beginning, and a DOS user before that.

Microsoft has posted work arounds for the flaw, see http://blogs.technet.com/swi/archive/2008/12/12/Clarification-on-the-various-workarounds-from-the-recent-IE-advisory.aspx .

Hoookey, let's look at the workaround....

Enabling the Workaround (only applies to Windows Vista and later operating systems)

To use this workaround you must first create a temporary directory and then copy an inf file from the attached zip file to it. Use the BlockAccess_x86.inf file if the underlying operating system is 32 bit and the BlockAccess_x64.inf file if the underlying operating system is 64 bit. If you are unsure which operating system you are using, you can figure it out by opening the Control Panel and selecting System. Look for the following output in the resulting window.

Once you have the appropriate file copied over, start an elevated Administrator command prompt, navigate the prompt to the temporary directory, and run the following command where <inf> is the name of the file you copied to the directory.

    SecEdit /configure /db BlockAccess.sdb /cfg <inf>

After running the command, you should see the following output.

    The task has completed successfully.
    See log %windir%\security\logs\scesrv.log for detail info.

SecEdit will also create a file called BlockAccess.sdb in the directory it was run from. You can safely delete it and the inf file.

Validating the Workaround

It is possible to use the icacls command to quickly determine whether or not the workaround has been applied. If you are using a 32 bit operating system, you just need to run the following command:

    icacls "%ProgramFiles%\Common Files\System\Ole DB\oledb32.dll"

On the other hand if you are using a 64 bit operating system, you will need to run icacls twice; once for the 32 bit version of OLEDB32.DLL and once for the 64 bit version. The two commands are as follows:

    icacls "%ProgramFiles%\Common Files\System\Ole DB\oledb32.dll"
    icacls "%ProgramFiles(x86)%\Common Files\System\Ole DB\oledb32.dll"

<<snipped for brevity>>

*I* can do it, but I am an IT security type - how many others are up for it?   Yeah, I thought so.


- Joe (A Windows, Firefox, and iPhone user - Dogma free!)

[Always Ready]

Ok lets just forget about Windows and Mac and all the associated problem causing programs...switch to Ubuntu Linux

http://www.ubuntulinux.org/

[LtCol Hooligan]

FYI- Microsoft will be releasing an out of band hot fix today to address this issue.  It should be pushed out through automatic updates and applied to your machines.  As long as you have your firewalls on and your virus scanners up to date, you will be fine.  The BBC article is a lot of smoke being blown and Microsoft is doing something about it.