full-disclosure - EEYE: Temporary workaround for IE createTextRange vulnerab

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200603280705.k2S75i5n015777@turing-police.cc.vt.edu>
Date: Tue Mar 28 08:05:53 2006
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: EEYE: Temporary workaround for IE
	createTextRange vulnerab 

On Tue, 28 Mar 2006 00:18:24 CST, s89df987 s9f87s987f said:
> >Somebody has to make sure that *all* the bookmarks and configuration 
> >settings
> >migrated correctly, and to help the users who have issues.
> when firefox is first ran it will ask the user if they would like to import 
> bookmarks and settings from IE

And it's never in recorded history screwed up, or gotten some obscure
setting wrong? ;)

Remember - it doesn't take much to make the help desk phone ring.

> >Somebody has to handle all the odd support calls that converting to Firefox
> >will cause.
> such calls could also occur while using the said patch or worse when a 
> system becomes compromised

Installing a patched IE will probably not result in many "How do I do XYZ
in this new PoS you stuck on my machine?" calls.  Moving them to Firefox will.

> >Somebody gets to retrain all the users who memorized things by rote.  If 
> >'print'
> >moves from the 3rd entry on the second from the left menu to the 7th entry
> >on the leftmost menu, that will ruin their day.
> you're overplaying that situation

Have you ever spent a full day or more doing first level end-user support? ;)

There *are* users that will freak out on that.

Hell, *I* kept opening Gimp by accident for a week after I reorganized some
menus - was very disconcerting the first time. ;)

> I would say this is far less as serious than a BSOD and/or Remote Code 
> Execution
> M$ took their time on the oversized img dim crash while Mozilla put out a 
> patch shortly of the discovery about the title bug
> 
> FF is a viable solution

I didn't say it wasn't viable.  I said it wasn't the totally free slam dunk
that "one word: Firefox" makes it out to be.

It's *not* a free upgrade, especially in a corporate environment.

(I didn't even *mention* the cost of beating the snot out of the web developers
who coded IE-specific extensions into a corporate webpage, did I?   It's
usually not the actual install cost that gets you, it's the ripple effect that
providing the support generates...)

-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 228 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20060328/d904d9ed/attachment.bin