If you surf the web during the upcoming holidays, you might want to be especially careful. An exploit recently went into circulation for a critical security flaw in Internet Explorer (IE), so you could infect your computer if you visit a specially crafted malicious website. In an advisory, Microsoft warns of the danger, confirming reports claiming that Internet Explorer versions 6 to 8 are vulnerable in all Windows editions.
The exploit takes advantage of a vulnerability in the handling of the [at]import tag in Cascading Style Sheets (CSS) to overcome Data Execution Prevention (DEP) and Address Space Layout Randomisation (ASLR). As a workaround, the vendor recommends toughening up iexplore.exe with the free security tool called EMET. For a detailed background article, see “Damage limitation - Mitigating exploits with Microsoft’s EMET” from The H Security. A patch is currently being worked on, but Microsoft has not yet said whether it will be released separately or on the next patch Tuesday.
According to Microsoft, the malicious code only runs with limited rights under Windows Vista and Windows 7 because IE handles webpages in the Protected Mode by default on those operating systems. Otherwise, the exploit starts off with the registered user’s rights, which is a particular problem with Windows XP as users often constantly work with admin rights there. Under Windows Server 2003 and 2008, websites are loaded with the highest security level in the standard configuration, which Microsoft says at least reduces the extent of the attack.
Such email clients as Outlook, Outlook Express and Windows Mail use IE to display HTML email but do not initially execute JavaScript and ActiveX controls in order to make it harder for attackers to execute malicious code on a local system. But because this vulnerability is exploited via CSS, the question arises whether this information does not lull users into a false sense of security. Other programs that also use the IE component will probably also be vulnerable to these attacks.
Yer Comodo is weaker on 64 bit but it is the way Microsoft does the 64 bit operating systems not Comodo’s fault. There is a thread on this forum that tells you all about it.
PS Internet Explorer as far as security is a joke. Even the USA government wont use it and has Microsoft remove it from any operating system that they get for there computers. Firefox will always have better security than Internet Explorer and one reason that is they don’t use Active X and Internet Explorer does and that is one of Internet Explorer’s problems.
LOL the US government is so stupid with some of their decisions. Firefox also most likely is less secure than IE but because more people use IE the hackers target it more. IE is actually quite a secure browser.
Let me guess you or someone you know has worked or is working at Microsoft or you are just a foolish person who thinks everything from Microsoft is safe and secure. Not sure what but get a reality check look at there own forum about security issues with Internet Explorer. It is only good for getting manual updates from there update center because they use Active X on there web sight and Firefox realize a long time ago that is a big security hole and Microsoft is either to stubborn or stupid to realize the same thing not sure what it is only they know for certain why they keep using Active X on there web sight and in there browser. And just to let you know I have a friend who has a friend that works at Microsoft and he doesn’t use Internet Explorer when he is at home and he told my friend that Microsoft is concern about how many people are realizing the short comings of Internet Explorer and switching to Firefox . Plus in just in speed alone Firefox beats Internet Explorer hands down. It like most things from Microsoft is a bloated piece of software that takes way to long to boot up and uses to much ram when it is booted up.
No, I am using opera and I believe that windows is one of the least secure operating systems in general.
However Internet Explorer 8 is quite a secure browser. It just so happens that even the strongest fortress would be broken if attacked in the millions where a tiny cottage would prevail if only attacked in small amounts.
Microsoft can’t even get there own employees to use there browser in there off time so what does that say about Internet Explorer if there own programmers wont use it on there home personal computers. And you can’t say Internet Explorer is fast because it is not. Even Opera Browser beats Internet Explorer on speed not sure on security don’t know how secure Opera browser is. And the reason not to many people attack Firefox is there is only a few holes and they try to fix them as soon as possible where Internet Explorer there are so many ways to exploit it’s weaknesses where to begin.
It’s because not as many people use it as use IE. If Firefox became the most used browser it would have more exploits than users. That’s the problem with having code that anyone can view.
It would be better if Microsft would spend the money that is over after paying employees,rent and other things to improve their software, just like Comodo does. But Comodo puts this money in producing CIS and other wonderful software.
In fact most of the world don’t use windows operating system and the ones that do over seas meaning Europe uses something other than Internet Explorer. Internet Explorer is mostly a North America used software with a few scatted in other parts of the world. But the figures show over 89 percent of Internet Explorer users are of the North American continent. and about 7 percent in South America the other 4 percent spread out over the rest of the world.
It's because not as many people use it as use IE. If Firefox became the most used browser it would have more exploits than users. That's the problem with having code that anyone can view.
Non sense.
Mozilla code, i don’t remember if it abides by GNU or other standards, is public and amendable by everybody whereas IE is not.
I am not sure that the still little, but growing market share of Opera and FF derivatives (not speaking here of various Linux and Mac OS flavors) remains an argument to pretend that they would be safer only on a statistical point of view.
On another side, there most certainly are experts using, including in corporate Networks, latter versions of IE (anything before IE8 is total junk whatever you do with it) in a safe way: the question is then to know how the Network is protected by hardware or software means, we are here not speaking anymore of the browser itself, and how, a contrario, Mister Smith with his personnal computer, no professionnal third-party security, deals with Active X, P2P, “social networks” (why are they supposed to be “social”?) and whatever utterly dangerous junk.
That’s a good thing, because with more people to check the code, more vulnerabilities can be discovered and fixed. Security through obscurity is never a good thing. Take encryption algorithms for example - you would think that exposing them to the public would make them less safe to use, right? Well no one trusts encryption algorithms which haven’t been thoroughly reviewed by other experts and the public, because you can’t trust one person or company to do all the testing. Same thing applies to software.
The figures I quoted were from Microsoft own pole about a year or year and half ago. So answer me this why does IE can use Active X and Microsoft own update web page uses it that is why Firefox can’t be use on Microsoft update page because Firefox don’t use Active X and Microsoft does.
