New IE exploit out, url to patch included.

[extreme]

A new variant of the last IE bug is out using Shell.Application instead, once again making code execution possible just by surfing a bad page. This has been out for a couple of days but just now I got to test that it really worked.

Simple test here (executes "cmd.exe /c pause"), worked for me (IE6 fully patched):
http://62.131.86.111/security/idiots.../installer.htm

No patch from microsoft out yet but EEYE wipped something up that should fix it:
http://www.eeye.com/html/research/al...L20040610.html

[extreme]

alt. patch:
http://www.mozilla.org/products/firefox/

[Evil1]

i got my patch a year before the last ie exploit came out @ opera.com

[Phoenix]

yeah screw it...i dont think ill ever open ie again

[KRL]

[extreme]

Originally posted by Evil1
i got my patch a year before the last ie exploit came out @ opera.com

Opera seems good, but it's not free right, either you pay or you get ads?

nice sig btw but seems like you're missing some, feel free to click around in mine

[Rep]

might want to turn directory listing off or throw up an index page on the directories.

[extreme]

Originally posted by Rep
might want to turn directory listing off or throw up an index page on the directories.

uh?

[Rep]

Originally posted by extreme
uh?

Instead of giving away neatly packaged zip files of the exploit to the most reputable bunch of people on the internet.

http://62.131.86.111/security/idiots/

[extreme]

Originally posted by Rep
Instead of giving away neatly packaged zip files of the exploit to the most reputable bunch of people on the internet.

http://62.131.86.111/security/idiots/

Missed that, not my site, found the url on a security mailling list. Theese exploitexamples are all over the place though... and clicking "view page source" isn't so hard right?

[Rep]

Originally posted by extreme
Missed that, not my site, found the url on a security mailling list. Theese exploitexamples are all over the place though... and clicking "view page source" isn't so hard right?

I don't think jsp is client side processed, my apologies i thought it was your site.

[Wilber]

Chicken Little screams again.

First of all the "patch" your pointing to at http://www.eeye.com is dated June 10 2004. That's
a friggin' month ago.

Second the patch for ADODB.Stream exploit has been out for a friggin' week.
http://support.microsoft.com/?id=870669

And don't say ADODB.Stream fix isn't part of that crap your linking to because it is.
You can't run a friggin' ShellExecute() from a Web page.

For christ's sake you have a piece of fact from here and a tidbit of info from there
and you try and tie it all in to come to a conclusion.

I'm patched and your link doesn't do shit but popup an errored alert box. I'd screen-cap
it but what's the friggin' point.

I use IE exclusively
I don't run a virus checker
I don't run a firewall
all I have is a router
I don't click "Yes" on Security Warning popups
I don't click on bullshit "OK" alerts
I surf all over hell and back in all the warez and porn areas
I never get anything on my system

Go get patched and quit screamin' the sky is falling on IE for fuck sake.

[Lane]

I said this before but,

If you are looking for an IE alternative, I would recommend Mozilla or derivatives like Firefox instead of Opera. I find that Opera has compatibility issues with pages using a lot of java.script. For example you cant even login to Gmail with Opera.

[extreme]

Originally posted by Wilber
Chicken Little screams again.

First of all the "patch" your pointing to at http://www.eeye.com is dated June 10 2004. That's
a friggin' month ago.

Second the patch for ADODB.Stream exploit has been out for a friggin' week.
http://support.microsoft.com/?id=870669

And don't say ADODB.Stream fix isn't part of that crap your linking to because it is.
You can't run a friggin' ShellExecute() from a Web page.

For christ's sake you have a piece of fact from here and a tidbit of info from there
and you try and tie it all in to come to a conclusion.

I'm patched and your link doesn't do shit but popup an errored alert box. I'd screen-cap
it but what's the friggin' point.

I use IE exclusively
I don't run a virus checker
I don't run a firewall
all I have is a router
I don't click "Yes" on Security Warning popups
I don't click on bullshit "OK" alerts
I surf all over hell and back in all the warez and porn areas
I never get anything on my system

Go get patched and quit screamin' the sky is falling on IE for fuck sake.

Who pissed in your serials this morning?

This isn't ADODB.Stream.

More info @ http://seclists.org/lists/bugtraq/2004/Jul/0024.html

Get a clue.

[BlueQuartz]

move along - nothing to see here

[extreme]

.. the actual pissing of course took place into your cereals and not your serials .

[BVF]

Originally posted by Wilber
That's
a friggin' month ago.

Second the patch for ADODB.Stream exploit has been out for a friggin' week.
http://support.microsoft.com/?id=870669

And don't say ADODB.Stream fix isn't part of that crap your linking to because it is.

You can't run a friggin' ShellExecute() from a Web page.

I'd screen-cap
it but what's the friggin' point.


Go get patched and quit screamin' the sky is falling on IE for fuck sake.

You say "friggin" throughout the whole post and then end with "fuck"?

[Wilber]

Originally posted by BVF
You say "friggin" throughout the whole post and then end with "fuck"?

You can read, congrats.

[KRL]

Originally posted by extreme
Opera seems good, but it's not free right, either you pay or you get ads?

nice sig btw but seems like you're missing some, feel free to click around in mine

$39 about the cost of one tank of gasoline.

Trust me its worth every single penny.

[Wilber]

Originally posted by extreme
This isn't ADODB.Stream

What are you a broken record?

Get patched and quite makin' shit up.

[extreme]

Originally posted by Wilber
What are you a broken record?

Get patched and quite makin' shit up.

I am fully patched. The exploit worked.

Microsoft killed ADODB.Stream with their latest patch (which you seem to be refering to).

Maybe this clears it up for you:
http://www.securityfocus.com/archive/1/367882

[iwantchixx]

Make the switch and never have to worry about exploits and patches and all that gay MS shit.

Opera Browser

[MickeyG]

you guys are funny with all this switch browsers crap. Its like the netscape revolution all over again. 99% of the web uses IE and if you design sites you should too.

[ModelBuffet]

Originally posted by extreme
alt. patch:
http://www.mozilla.org/products/firefox/

Already installed that patch

[KRL]

Originally posted by MickeyG
you guys are funny with all this switch browsers crap. Its like the netscape revolution all over again. 99% of the web uses IE and if you design sites you should too.

Lame rebuttal.

Opera has tons more cool and productive features than IE.

1 out of every 27 surfers is using Opera now.

I still keep IE and have Firefox also. But I'm using Opera 99% of the time now and I wouldn't unless it was a better browser and it is.

[KRL]

Originally posted by Wilber
Chicken Little screams again.

First of all the "patch" your pointing to at http://www.eeye.com is dated June 10 2004. That's
a friggin' month ago.

Second the patch for ADODB.Stream exploit has been out for a friggin' week.
http://support.microsoft.com/?id=870669

And don't say ADODB.Stream fix isn't part of that crap your linking to because it is.
You can't run a friggin' ShellExecute() from a Web page.

For christ's sake you have a piece of fact from here and a tidbit of info from there
and you try and tie it all in to come to a conclusion.

I'm patched and your link doesn't do shit but popup an errored alert box. I'd screen-cap
it but what's the friggin' point.

I use IE exclusively
I don't run a virus checker
I don't run a firewall
all I have is a router
I don't click "Yes" on Security Warning popups
I don't click on bullshit "OK" alerts
I surf all over hell and back in all the warez and porn areas
I never get anything on my system

Go get patched and quit screamin' the sky is falling on IE for fuck sake.

You don't use Virus protection software. OK. That's smart. LOL. It's not a question of if, just when you will get nailed by one.

[MickeyG]

Originally posted by KRL
Lame rebuttal.

Opera has tons more cool and productive features than IE.

1 out of every 27 surfers is using Opera now.

I still keep IE and have Firefox also. But I'm using Opera 99% of the time now and I wouldn't unless it was a better browser and it is.

I guess you dont remember the good old days of having to design sites for both netscape and IE... Pushing people to use other browsers is only going to create more work for us in the end.

[Jakke PNG]

Originally posted by MickeyG
if you design sites you should too.

What drugs are you on? IE is not w3c compatible.. meaning that a site can look ok in IE but is totally fucked on opera and firefox. So... if you're designing sites you SHOULD NOT use IE.. as sites that work on firefox and opera work on IE as well.

[MickeyG]

Originally posted by TeenGodFather
What drugs are you on? IE is not w3c compatible.. meaning that a site can look ok in IE but is totally fucked on opera and firefox. So... if you're designing sites you SHOULD NOT use IE.. as sites that work on firefox and opera work on IE as well.

If 90% of the world is using IE what do I care what it looks like on other browsers.

[raymor]

Originally posted by Wilber
[
First of all the "patch" your pointing to at http://www.eeye.com is dated .

I use IE exclusively
I don't run a virus checker
I don't run a firewall
all I have is a router
I don't click "Yes" on Security Warning popups
I don't click on bullshit "OK" alerts
I surf all over hell and back in all the warez and porn areas
I never get anything on my system
[/B]

You forgot two lines:
I have no idea how many dozens of viruses, worms, and other crap and running rampant on my system.
I'm totally unaware that right now 3 of the people reading this post are running Back Orifice on my machine.