full-disclosure - IE exploit runs code from graphics?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20040627055440.GA2269@comcast.net>
From: st3ng4h at comcast.net (st3ng4h)
Subject: IE exploit runs code from graphics?

On Sat, Jun 26, 2004 at 07:12:36PM -0700, Jimmy Mitchener wrote:
> Why would you assume Mozilla is any less vulnerable? Perhaps not
> publicly, it is simply not as large of a target as IE. You should
> really not be browsing on an "important" system no matter what. Unless
> perhaps you have systrace or SELinux guarding it (which even then is
> not 100%).

Agreed. Any browser that isn't IE is safer, just because it's not a
target. Classic security through obscurity.

It can be argued it really is more secure because it's not embedded
into the OS like IE. But again, this applies to any browser that 
isn't IE. It'll be interesting to see, as it gains popularity, how
it will hold up when it starts becoming a worthwhile target.

Isn't this the same software that 'celebrated' its 200,000th bug a 
couple years ago? uh oh...

st3ng4h