http://blogs.zdnet.com/security/?p=1288
Quote:Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code, permitting the attacker to completely take over the vulnerable process, potentially allowing the machine running the process to be completely controlled by the attacker. TippingPoint researchers continue to see these types of “user-interaction required ” browser-based vulnerabilities - such as clicking on a link in email or inadvertently visiting a malicious web page.
Glad I don't use Firefox. that's one sick exploit.
Wow, that sucks I'm switching to using IE right now lol
If you look hard enough, there are holes in every application even I.E. and Opera. Only time will tell when a vulnerability like this will appear, and there probably already has in the past.
From the site, this has also been in all versions of Firefox 2.x as well; the fact that no-one found it to exploit must mean it's pretty well obscured.
Not to mention you still need to click on a rogue link to be exploited anyway.
Not that much of a big deal really. All browsers have flaws. Mozilla tends to deal with them pretty quickly though. Firefox 3.0.1 here we come.
How many people use Windows? How many patches do you see from Microsoft saying "... allows remote code execution ..." etc.
I had one of those updates for Windows this morning, and around 4 last week. All had "remote code execution" somewhere in their description.
(2008-06-20, 12:59 AM)DennisTT Wrote: [ -> ]How many people use Windows? How many patches do you see from Microsoft saying "... allows remote code execution ..." etc.
I assume that was a rhetorical question Dennis
Doesn't seem like many of you read the article very well.
A person KNEW about the exploit and waited till their huge launch day and sold the vulnerability.
Interesting that Firefox fans are dismissing this.
If windows XP SP3 was released and had the same problem on day one I am fairly certain there would be an outcry. Firefox certainly has it's fan base adequately appeased.
Oh and notice the exploit isn't patched?
You use Windows labrocca, how many patches have you installed since XP SP3?
And yes, I read the article in full. And some of the comments; thank you for asking.