IE 7 Beta 2 (and matching DoS attack) released

Amazing, so today Microsoft releases Beta 2 of IE 7, and almost simultaneously comes a tailor made DoS attack! ”Overview: A denial of service vulnerability exists within Microsoft Internet Explorer 7.0 Beta 2 which allows for an attacker to cause the browser to crash, and or to execute arbitrary code on the targeted host. Technical Details: When running a specially crafted .html file, urlmon.dll inproperly parsers the ‘BGSOUND xsrc=file://—’ (approx. 344 dashes) and causes the crash. … Vendor Status: Microsoft was notified. Workaround: Mozilla Firefox.” If you are running IE 7 Beta 2 and want to give it a go, go to that link and construct the code, or simply click here for the proof of concept. I like how this comes up just after the zero day WMF flaw, and how it nicely dovetails into their “Trustworthy Computing” effort (emphasis on effort). ”Trustworthy Computing is a long-term, collaborative effort to provide more secure, private, and reliable computing experiences for everyone. This is a core company tenet at Microsoft and guides virtually everything we do. Trustworthy Computing is built on four pillars: Security, Privacy, and Reliability in our software, services, and products; and integrity in our Business Practices.” Sure, sounds like a game plan.

Related posts

• Firefox buffer overflow (0)
• This is a picture (3)
• Security researcher Dan Kaminsky (1)
• Panic on the streets of Uniontown! (3)
• New phisher site to fight! (0)