Internet Explorer on Omid Farhang

Internet Explorer 8 0-Day Update CVE-2013-1347

Mon, 06 May 2013 15:30:02 +0000

Microsoft has confirmed a bug in Internet Explorer 8, CVE-2013-1347, which exposes user machines to remote code execution.

In an advisory, Microsoft says the vulnerability “exists in the way that Internet Explorer [accesses] an object in memory that has been deleted or has not been properly allocated.”

That, in turn, opens the door to memory corruption and remote code execution in the current user context.

According to this blog post by Eric Roman: “A use-after-free condition occurs when a CGenericElement object is freed, but a reference is kept on the document and used again during rendering, an invalid memory that’s controllable is used, and allows arbitrary code execution under the context of the user.”

Internet Explorer 10 for Windows 7 [Download Links]

Tue, 26 Feb 2013 17:47:00 +0000

Internet Explorer 10 is available worldwide in 95 languages for download today.

Download Links:

x86: http://www.microsoft.com/en-us/download/details.aspx?id=36808
x64: http://www.microsoft.com/en-us/download/details.aspx?id=36806
Other (Non-English) Languages: http://windows.microsoft.com/en-us/internet-explorer/downloads/ie-10/worldwide-languages

Internet Explorer security hole: Use other browser

Tue, 18 Sep 2012 16:22:00 +0000

TheTelegraph: Internet Explorer users might want to consider upgrading or switching to another browser after a massive security hole was discovered in Windows’ native web browser.

According to security forum, Rapid7 , Internet Explorer 7, 8 and 9 operating on Windows XP, Vista and Seven contains what is known as a “zero day exploit” which allows attackers to gain access to your personal data while you browse.

The forum claimed the exploit would give cyber criminals “the same privileges as the current user”.

Microsoft to patch Flash hole in Windows 8 shortly

Wed, 12 Sep 2012 16:47:00 +0000

h-online: Microsoft has confirmed that it will deliver a security update for the bundled version of Flash Player used by Internet Explorer 10 (IE10) sooner than previously planned. In a statement sent to ZDNet, Yunsun Wee, Trustworthy Computing Director at Microsoft, said that the company is working closely with Adobe on an updated version of the Flash plugin which “will be available shortly”.

The forthcoming Windows 8 comes with Internet Explorer 10, which, in turn, includes its own version of Flash Player. This arrangement relies on Microsoft’s automatic updates system, Windows Update, for updating the version of Flash included in the web browser.

IE 9.0.9 Available via Windows Update

Thu, 16 Aug 2012 10:43:00 +0000

MSDN:

The August 2012 Cumulative Security Update for Internet Explorer is now available via Windows Update. This security update resolves four privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, and Internet Explorer 9 on Windows servers For more information, see the full bulletin.

Critical holes closed in Microsoft's June Patch Tuesday

Thu, 14 Jun 2012 08:00:00 +0000

The H-Online: Microsoft has released seven security bulletins fixing a total of 27 security holes, 13 of them in Internet Explorer. The rest of the patches affect all currently supported Windows versions, the .NET Framework, Remote Desktop, Lync and Dynamics AX. A patch that had been announced for Visual Basic for Applications has yet to be released.

The most important updates are bundled in the cumulative Internet Explorer patch (MS12-037), which includes fixes for the holes that were targeted by Pwn2Own exploits. Microsoft is the last of the companies to close the exposed holes that were targeted during the Pwn2Own competition; Google and Mozilla fixed their browsers in March. According to Michael Kranawetter, Microsoft’s Chief Security Advisor in Germany, the IE patch also affects the Windows 8 Consumer Preview, and therefore Internet Explorer 10.

Google also bypassed cookie settings in Internet Explorer

Tue, 21 Feb 2012 15:49:00 +0000

H-Online.com: Following the revelation that Google and other online marketing companies have been bypassing the mechanism for blocking third-party cookies in Safari, the Internet Explorer development team asked themselves whether Google might be doing the same thing in IE. As they detail on IEBlog, they discovered that this was the case – Google circumvents Internet Explorer’s cookie policy by subverting the browser’s P3P-based privacy protection mechanism.

P3P stands for Platform for Privacy Preferences Project and is an open W3C standard. It is intended to help both users and programs determine what sites do with personal data. The cookie management system in Internet Explorer blocks third party cookies from sites that do not supply a P3P policy statement telling it how cookies are used.

Browser Speed Tests: Chrome 17, Firefox 10, Internet Explorer 9, and Opera 11.61

Tue, 14 Feb 2012 18:38:00 +0000

LifeHacker:

Chrome 17 is out with a new pre-rendering feature designed to make your pages load faster, and both Firefox and Opera have also released speedy new versions since our last round of speed tests. So, we’ve once again pitted the four most popular web browsers against each other in a battle of startup times, tab loading times, and more, with more surprising results.

Continue Reading: http://lifehacker.com/5884941/browser-speed-tests-chrome-17-firefox-10-internet-explorer-9-and-opera-1161

(Hint: As always Chrome is winner, no doubt!)

Internet Explorer to upgrade automatically, unless you say no

Sat, 17 Dec 2011 19:36:00 +0000

SophosLabs: Microsoft’s Ryan Gavin announced a new strategy to keep the web safe… Keep your Internet Explorer up to date.

It is great news for Windows users who don’t appreciate the importance of staying up to date.

Microsoft has been struggling with browser stragglers for years. They even ran their own campaign comparing IE 6 to spoiled milk including shameful infopr0n.

Old versions of IE leave a considerable number of users vulnerable to old exploits, or in their parlance easy targets.

Internet Explorer’s Share of Web Traffic Drops Below 50%

Thu, 03 Nov 2011 12:45:00 +0000

Mashable: Internet Explorer can no longer claim more than half of the web’s traffic, as of October, ending more than a decade of the default Microsoft browser’s reign.

Safari’s hold on 62.17% of mobile traffic has reduced IE’s overall share of web browsing, despite still claiming 52.63% of desktop traffic, according to Netmarketshare.com.

The Microsoft browser’s diminishing share (49.6%) reflects its near absence from the realms of mobile and tablet, which now make up 6% of web traffic. However, chances are, you gave up on IE long enough ago that this milestone makes you more curious as to who actually still uses the browser.

Windows 8: The death of malware? The death of anti-malware?

Mon, 25 Jul 2011 15:53:00 +0000

BetaNews: There is a lot of buzz about a recent set of tests by NSS Labs that show the Smartscreen reputation system in Internet Explorer 9 head and shoulders and most of the rest of the body above the competition in blocking malware on the web.

I think the results of the test are even more important than they seem, considering previous reports that Microsoft plans to make Smartscreen a base part of Windows 8. This would extend parts of the protection to any executable hitting the file system. This would be big news.

Microsoft launches first Internet Explorer 10 preview

Wed, 13 Apr 2011 12:29:00 +0000

Fulfilling the hints Microsoft dropped back in March, the Redmond software company unveiled the first platform preview of Internet Explorer 10 at MIX 11 in Las Vegas on Tuesday.

This first preview of Internet Explorer 10 builds on the big HTML5 push that began with IE9, and adds support for more advanced Web standards, such as CSS3 Gradients as background images, and CSS3 Flexible Box and multi-column layout.

Microsoft said code refreshes will take place approximately every twelve weeks for IE10.

Installing an Application Using Internet Explorer 9

Sun, 20 Mar 2011 15:33:00 +0000

Google Operation System Blog: I tried to download the latest Chromium build using Internet Explorer 9 and it was one of the most painful downloading experiences. Microsoft tries to protect users from downloading malware and uses a feature called SmartScreen Filter that “checks software downloads against a dynamically updated list of reported malicious software sites”. This feature was available in IE8, but the latest version of IE tried to improve it by analyzing application reputation.

WebM Plugin for Internet Explorer 9

Tue, 15 Mar 2011 12:12:00 +0000

Google Operation System: Internet Explorer 9 will be released later today and one of the many new features is the native support for videos. Unfortunately for Google, Microsoft decided to only support H.264 videos by default, so you can’t watch WebM videos without installing additional software.

To solve this problem, Google developed a WebM plugin for IE9. “They said elephants couldn’t ride flying dolphins. They said that one of the world’s most popular browsers couldn’t play WebM video in HTML5. They were wrong,” mentions Google half-jokingly.

Internet Explorer 9 is out, includes new security features

Tue, 15 Mar 2011 10:36:00 +0000

isc.sans.edu: Microsoft released version 9 of its Internet Explorer web browser. You can download IE 9 from windows.microsoft.com.

Microsoft also set up a domain dedicated to the new browser: www.beautyoftheweb.com. Unfortunately, that site isn’t hosted under the microsoft.com domain, nor does it have an SSL certificate to confirm that it belongs to Microsoft. Using this site to distribute the browser goes against the advice of downloading software only from known vendor websites. Copycat malicious sites claiming to distribute IE 9 will probably appear shortly, if they aren’t around yet.

PWN2OWN – Apple v. Google v. Microsoft v. Mozilla v. BlackBerry!

Mon, 14 Mar 2011 13:06:00 +0000

Sophos Labs Blog: If you’re interested in computer security, you’ve probably heard of PWN2OWN. It’s a competition which has become an annual fixture at the annual CanSecWest conference in Vancouver, British Columbia.

The competition gets its name because, as the CanSecWest organizers explain, “If you can execute arbitrary code (PWN) on these [laptops or mobile phones] through a previously undisclosed browser (Firefox, IE, Safari) exploit, you can go home with one (OWN).”

Internet Explorer 9 hits RTM

Sat, 12 Mar 2011 23:13:00 +0000

TechSpot wrote: Microsoft this week reportedly signed off the Release to Manufacturing (RTM) build of Internet Explorer 9. The RTM build is 9.00.8112.16421.110308-0330, meaning it was compiled on March 8, 2011 at 3:30 AM, according to Windows 8 Beta.

A user by the name of sp3ciali5t has managed to post an image of the IE9 about screen for this build on Twitter. It’s in Turkish, but you can still the build number:

Internet Explorer 9 RC download link goes live

Fri, 11 Feb 2011 00:17:00 +0000

Before IE developers held a press conference in San Francisco to unveil the RC version of IE 9 this morning, Microsoft has released the RC for download here (x86) and here (x64).

As expected, the release candidate includes much improved tab functionality, from the new square-ish visual elements, and moveable tab bar elements to increase customization. It also includes features that enable a user to refuse tracking from advertisers.

It also promises to fix a number of remaining bugs and minor annoyances that plagued the Beta and developer previews of the browser. The newer, more stable version of the browser needs to be pretty picture perfect if MS wants to regain its market share lost to Chrome and Firefox since IE8 started faltering.

17 Security Updates on MS Patchday

Wed, 15 Dec 2010 16:01:00 +0000

As announced Friday last week, Microsoft delivers 17 security updates on the December 2010 Patchday. The Updates close 2 highly critical security holes which allow for remote code execution and several privilege escalation vulnerabilities that allow attackers to gain administrative rights on Windows PCs. Overall, the 17 Updates deal with 40 vulnerabilities.

Affected are the Windows operating Systems, Internet Explorer, Microsoft Office, SharePoint and Exchange. Users and administrators should apply the patches as soon as possible!

Internet Explorer 9 will feature "do not track" functionality

Wed, 08 Dec 2010 00:04:00 +0000

BetaNews: In light of the recent rash of “history sniffing” bugs and the Federal Trade Commission’s proposed “do not track” list, Microsoft today announced that release candidate of Internet Explorer 9 will feature a new tracking protection setting that will keep a user’s browsing habits private from sites looking to harvest browser histories.

The new feature of IE9 will let users opt out of sharing their browser information with sites they may not know or necessarily trust. It includes a Tracking Protection List of Web addresses that the browser will call only if the user specifically types the URL into the browser bar. That means any content from a URL that the user has blocked will also not show up in the browser.