Microsoft tells users how to prevent IE zero day attacks

Fire in the Vole!

By Sylvie Barak

Friday, 12 December 2008, 15:01

TO COMBAT a recent zero-day flaw in Internet Explorer, Microsoft has decided to release a security advisory to protect its vulnerable users.

News of the flaw surfaced a couple of days ago, when it was originally assumed the problem was being caused by XML processing. Reports also indicated the flaw was unique to IE 7, something which Microsoft has since updated to included IE6 and IE 5.01.

In fact, rather than the problem simply affecting the XML parsing engine of IE 7, it’s more directly linked to data binding and the library MSHTML.DLL. And it affects IE on several Windows platforms, including Windows XP SP2 and SP3, Windows Server 2003 SP1 and SP2, Windows Vista, Windows Vista SP1 and Windows Server 2008.

The Vole is still furrowing its furry brow about trying to get to the bottom of the issue, but has, in the meanwhile, drawn up some tips for users to try and avoid getting attacked while they wait for a patch.

The Redmond Giant has recommended all IE users have a fumble with their Internet and local intranet security settings, ensuring that they are set to ‘High’ so that IE will prompt before running any ActiveX controls or active scripting.

Additionally, Microsoft is recommending that active scripting be disabled altogether in the Internet and local intranet security zone and that DEP (Data Execution Prevention) should be enabled.

But Internet security blog, Secunia, having tested the flaw thoroughly, reckons that setting the security level to ‘High’ for the Internet security zone or disabling Active Scripting won’t necessarily ensure complete protection, claiming that it is still possible to trigger the vulnerability, despite making that harder for attackers to do.

Now, far be it from us to try and improve on Microsoft’s advice, but shurely, if the preventative measures recommended by Microsoft aren’t going to protect users 100 per cent anyway, and are a hassle, why not just switch to Firefox to avoid these Volish vulnerabilities altogether and be done with it? µ

I’m Nothing

Kemaren disela waktu santai bersama teman setalah makan siang, seorang teman asyik bercerita masalah kasus yang dihadapi oleh saudaranya. Mengenai pengurusan kendaraan bermotor yang sedang bermasalah di kantor polisi. Panjang cerita yang dia utarakan, tak ketinggalan dengan detil setiap kejadian yang dihadapi saudaranya.

Masalah akhirnya dapat dipecahkan karena pertolongan seorang saudaranya yang lain. Saudaranya tersebut juga seorang polisi yang mempunyai kedudukan lumayan tinggi. Sehingga persoalan yang sebelumnya harus menjalani proses panjang dan melelahkan dapat diselesaikan dengan cepat.

Seketika itu aku sampai pada titik pertanyaan, jika aku menghadapi hal yang sama dengan cara apa aku dapat menyelesaikan persoalan tersebut. Masalah akan dengan leluasa melumat dan menghajarku tanpa ampun, tanpa memberikan kesempatan bagiku untuk bernafas sedetikpun.

Hatiku saat itu mengaduh pada YAHWEH, siapakah aku ini diantaran kerumunan orang banyak, dengan apakah aku dapat lepas dari semua persoalan seperti itu. Jiwaku merana di dalamku merintih pertolonganMU. Hanya Kaulah sumber kelepasan dan pengharapan bagiku.

Tak sekali dua kali persoalan sperti itu menghampiriku, namun ajarku memahami KAU selalu sertaku. Hingga kuyakin KAU selalu ada dalam setiap hidupku.