Microsoft explains how it missed critical IE bug

[VinDSL]

Microsoft explains how it missed critical IE bug

http://www.computerworld.com/a...asic&articleId=9124174

Programmers and testing tools overlooked years-old bug, admits company's secure code expert, but Vista's 'Protected Mode' worked.

 

[VirtualLarry]

"Even though Windows Vista and Windows Server 2008 have both ASLR and NX enabled by default, Internet Explorer 7 does not opt-in to these defenses owing to compatibility issues with many common applications," Howard noted.

Interesting. You would think that IE7's "protected mode" under Vista would enable as many security defense layers as possible. But apparently not so.

"The data binding bug was present in all still-supported versions of IE, including IE5.01, which was released in November 1999."

So how many different versions of IE were patched? Only 7.0? Kind of leaves Win98se and W2K users in the dust, doesn't it? (Is there a way to upgrade W2K to support IE7?)

 

[Puffnstuff]

Well the ie7 patch crashes my pc so I had to remove it. It also crashes my other 780i machine in the same way, randomly locking it up.

 

[mechBgon]

Originally posted by: VirtualLarry
"Even though Windows Vista and Windows Server 2008 have both ASLR and NX enabled by default, Internet Explorer 7 does not opt-in to these defenses owing to compatibility issues with many common applications," Howard noted.

Interesting. You would think that IE7's "protected mode" under Vista would enable as many security defense layers as possible. But apparently not so.

Would you want to field 100,000 phone calls a day because third-party browser plug-ins crash when DEP/NX is enabled? Sun's Java plug-ins are a case in point; in fact, I filed a detailed bug report with Sun myself to bring it to their attention. And eventually it got fixed. But in the meanwhile... yeah. Feel free to enable DEP on IE7 if you want, instructions listed here. You can also enable SEHOP while you're at it.

So how many different versions of IE were patched? Only 7.0? Kind of leaves Win98se and W2K users in the dust, doesn't it? (Is there a way to upgrade W2K to support IE7?)

IE5, 6, 7 and 8 beta. Win98 is beyond end-of-life. Win2000 and its components, including IE5, will be supported with security updates until August 31, 2011 if I recall correctly.

 

[Chiefcrowe]

As far as I know you cannot get IE7 on W2k. that's one of the incentives that people had to get XP.

Originally posted by: VirtualLarry


So how many different versions of IE were patched? Only 7.0? Kind of leaves Win98se and W2K users in the dust, doesn't it? (Is there a way to upgrade W2K to support IE7?)