This has kept me busy today!
The beeb, as normal, have blown it all out of proportion from what little I can glean.
Been on the blower to Microsoft, they are unsure of the exact ramifications, and what the worse case is. They seem unsure of what browsers are affected - we run IE6 on some of the Citrix servers I look after, and I wanted to know if they were vulnerable. Additionally, not entirely sure if its an IE issue, a database dll issue, or blended vulnerability - MS are hinting at blended. They are also unsure if non-IE browsers could be affected. Sounds like they either do not yet fully understand the attack, or are unable to reliably repeat it to debug whats happening.
But at least they were more helpful that Firefox, who do not offer any proper support. So who knows. At this stage, I am unable to work out if FF will do similar if feed the same page - probably depends on the XML decoder installed on the PC to be honest.
As always, not logging on to Windows as an Administrator will cure most of these type attacks, but many users consider administritive rights as some kind of penile extension, so I guess that falls on deaf ears.
Whatever browser is used, I would recommend disabling the dll thats used in the attack if you don't need it.
Author
Topic: Quick! Stop using Internet Explorer! (Read 3793 times)