full-disclosure - How big is the danger of IE?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <1089586019.21081.54.camel@localhost>
From: dan at losangelescomputerhelp.com (Daniel H. Renner)
Subject: How big is the danger of IE?

> Message: 3
> Date: Fri, 09 Jul 2004 13:03:22 +1200
> From: Nick FitzGerald <nick@...us-l.demon.co.uk>
> Subject: RE: [Full-Disclosure] How big is the danger of IE?
> To: full-disclosure@...ts.netsys.com
> Reply-to: nick@...us-l.demon.co.uk
> Organization: Personal account
> 

<snip>
>    http://www.kb.cert.org/vuls/id/713878
> 
>    ...
> 
>    Use a different web browser
> 
</snip>

Admittedly number 6 of 6 solutions, but the fact that CERT suggests it 
at all makes it big news in these circles.  However, I've see people  
debate the use of such an action where IE is built into the operating 
system and will conitue to operate regards of another brower being 
installed.

I thought I might mention to you that there is an easy handling for
using another browser and disabling IE.

After downloading and installing another browser, open IE, go to Tools,
Options (or Internet Options in the Control Panel) Connections, LAN
Settings.  Check the Use a proxy (Auto detect must be unchecked) and set
the addressas "0.0.0.0" and the port as "1".

IE and any program, script, etc. that wants to use it has now been
effectively sent into a black hole, and any sane program that can be
configured to access the Internet on it's own will do fine.  This
technique works especially well if you have a LAN proxy for your
Internet access, and can be auto-configured so that the workstations on
the company Intranet use it, but don't use the black hole proxy address
for the internal company website(s).

Note though, that this will also disable Outlook or Outlook Express from
displaying web-based HTML email, but will not stop similar internal
company emails from displaying correctly.
-- 

Cheers,

Dan Renner
President
Los Angeles Computerhelp
http://losangelescomputerhelp.com
818.352.8700