bugtraq - EEYE: Temporary workaround for IE createTextRange vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <A641CEADDBAEAE4C96FC5BF854695268E3A5B4@av-mail01.corp.int-eeye.com>
Date: Mon, 27 Mar 2006 16:41:38 -0800
From: "Marc Maiffret" <mmaiffret@...e.com>
To: <BUGTRAQ@...URITYFOCUS.COM>
Subject: EEYE: Temporary workaround for IE createTextRange vulnerability

eEye Digital Security has created a temporary work around for the
current Internet Explorer zero day vulnerability within the IE
createTextRange functionality. 

This workaround has been created because currently there is no solution
from Microsoft other than the workaround to disable Active Scripting. We
have personally had requests from various customers and the community to
help provide a free solution in the case that companies and users are
not able to disable Active Scripting. The workaround we have created,
like ones before it, is experimental in a sense and should only be
installed if you are not able to use the safer mitigation of disabling
Active Scripting. 

The workaround is obviously free, and we do not require any registration
information to download it from the eEye website. 

Should you encounter any problems with the workaround or bugs please
send email to alerts@...e.com with detailed information on the problem
you experienced and we will work to fix any bugs in a timely fashion. We
will post updates to the website with version numbers and bug fixes
should they arise.

Obviously these things are experimental in nature but considering the
options of being vulnerable or at least having a fighting chance... Well
I think you get the point. Again this is just another mitigation option
until Microsoft releases their patch, which last was scheduled for April
11th or 16 days from now. 

For more information on the vulnerability and a link to download the
workaround please visit:
http://www.eeye.com/html/research/alerts/AL20060324.html

Signed,
Marc Maiffret
Chief Hacking Officer
eEye Digital Security
T.949.349.9062
F.949.349.9329
http://eEye.com/Blink - End-Point Vulnerability Prevention
http://eEye.com/Retina - Network Security Scanner
http://eEye.com/Iris - Network Traffic Analyzer
http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities 

Download attachment "winmail.dat" of type "application/ms-tnef" (3140 bytes)