New hacker peril for older IE versions
New species of unpatched bug bites IE6 and 7
Customer Success Testimonial: Recovery is Everything
Internet Explorer users are at risk from a newly discovered and unpatched vulnerability in older versions of Microsoft's browser.
A security flaw involving a dangling pointer in Microsoft's HTML Viewer (mshtml.dll) creates a possible mechanism for hackers to crash the browser and inject malware, providing they can trick marks into visiting maliciously constructed sites designed to exploit the vulnerability. Poor reliability exploits targeting the flaw were posted on underground websites late last week. Better quality attacks are more than likely to follow.
Tests by Symantec have confirmed the 0-day flaw affects Internet Explorer 6 and 7. IE8 users are reckoned to be in the clear.
Surfers using older versions of IE (why the heck is anyone still using IE6 anyway?) are advised to disable JavaScript and to stay away from untrusted websites. Alternatively they could upgrade to IE8 or use an alternative browser instead.
More on the threat can be found in a write-up by the SAN Institute's Internet Storm Centre here. ®
COMMENTS
@Al fazed
I'm not trying to advocate _constantly_ upgrading. I am trying to point out that there have been significant improvements in hardware and software in the past decade--both in areas of performance and security--which the user I was responding to would likely find to his advantage.
While I agree that attempting to stay on the bleeding edge of technology is a frustrating and ultimately fruitless exercise, it is my humble opinion that the benefits of updating outweigh the disadvantages for the person in question at this time, and that there are several negative aspects with such an outdated configuration that even further argue for an upgrade. Perhaps my original tone was off-putting, for which I apologize -- I was reacting to the IE5.5 subject line, which is one of the banes of my existence and some of that came through in my post.
Spotted
I smell another NHS worker here!
we've the same issue, 4-5 different applications just don't work or are not supported on IE7-8 or alterntives.
Lumbered with I.E. 6
How right you are. I have two machines, one running XP, the other 2000 pro. Both machines carry Sea Monkey and Firefox, but some software, such as Power Producer for my video camera, insists on access to I.E. Worse still, it wants IE 6, or later but Windows 2000 came with IE5. This I could upgrade to 6, but no higher, as Microsoft says it isn't compatible. So how come the very latest versions of Firefox and Sea Monkey don't have "compatibility" issues? Ah well. My 2000 machine is getting ready to retire, after seven years of reliable service and countless hardware upgrades, so I guess I'll be joining the ranks of those who have jumped right over Vista - twice. And my first priority will be to over-ride I.E 8, 9 (or quintillion) with Mozilla - and over-ride any pre-installed copies of office with good old OpenOffice.org
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Enabling efficient data center monitoring
