full-disclosure - EEYE: Temporary workaround for IE createTextRange vulnerab

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Tue Mar 28 03:52:38 2006
From: a059d8e0a9s8d0 at hotmail.com (s89df987 s9f87s987f)
Subject: EEYE: Temporary workaround for IE
	createTextRange vulnerab

no work around is needed, there has been a solution all along..
one word.. firefox

On 3/27/06, Marc Maiffret <mmaiffret@...e.com> wrote:
>eEye Digital Security has created a temporary work around for the
>current Internet Explorer zero day vulnerability within the IE
>createTextRange functionality.
>
>This workaround has been created because currently there is no solution
>from Microsoft other than the workaround to disable Active Scripting. We
>have personally had requests from various customers and the community to
>help provide a free solution in the case that companies and users are
>not able to disable Active Scripting. The workaround we have created,
>like ones before it, is experimental in a sense and should only be
>installed if you are not able to use the safer mitigation of disabling
>Active Scripting.
>
>The workaround is obviously free, and we do not require any registration
>information to download it from the eEye website.
>
>Should you encounter any problems with the workaround or bugs please
>send email to alerts@...e.com with detailed information on the problem
>you experienced and we will work to fix any bugs in a timely fashion. We
>will post updates to the website with version numbers and bug fixes
>should they arise.
>
>Obviously these things are experimental in nature but considering the
>options of being vulnerable or at least having a fighting chance... Well
>I think you get the point. Again this is just another mitigation option
>until Microsoft releases their patch, which last was scheduled for April
>11th or 16 days from now.
>
>For more information on the vulnerability and a link to download the
>workaround please visit:
>http://www.eeye.com/html/research/alerts/AL20060324.html
>
>Signed,
>Marc Maiffret
>Chief Hacking Officer
>eEye Digital Security
>T.949.349.9062
>F.949.349.9329
>http://eEye.com/Blink - End-Point Vulnerability Prevention
>http://eEye.com/Retina - Network Security Scanner
>http://eEye.com/Iris - Network Traffic Analyzer
>http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities
>
>_______________________________________________
>Full-Disclosure - We believe in it.
>Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>Hosted and sponsored by Secunia - http://secunia.com/
>

_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! 
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/