GreyMagic Security wrote: <<snip>> > Solution: > ========= > > Microsoft was first informed on 18 Feb 2002, a patch was finally released on > 22 Aug 2002 after a long investigation and testing period. > > The patch may be downloaded from: > http://www.microsoft.com/technet/security/bulletin/ms02-047.asp. > > ** Update - 9 Oct 2004 ** > > There has been a regression in Internet Explorer that causes it to be > vulnerable to this issue once again. The regression was spotted by Georgi > Guninski in an advisory from 7-Oct-2004 > (http://www.guninski.com/where_do_you_want_billg_to_go_today_1.html). > > Interestingly enough, the regression is only visible when the <script> block > is introduced as static HTML in the page, dynamic blocks (via > document.write) are protected. > > Disable Active Scripting in order to protect yourself from this > vulnerability. This is far from the first time that MS has "fixed" a vulnerability by addressing the specific form presented in a PoC or used in some "in the wild" exploit, rather than by looking into the true underlying problem. I'd be very surprised if many more such regressions are not present in IE, but it's be a rather dull job testing for them all. Of course, one of the reasons folk pay the "Windows tax" is for MS to do that dull, largely thankless and unseen (if done properly) work, on their behalf... -- Nick FitzGerald Computer Virus Consulting Ltd. Ph/FAX: +64 3 3529854
