Re: [Full-disclosure] EEYE: Temporary workaround for IE createTextRange vulnerab



no work around is needed, there has been a solution all along..
one word.. firefox

On 3/27/06, Marc Maiffret <mmaiffret@xxxxxxxx> wrote:
eEye Digital Security has created a temporary work around for the
current Internet Explorer zero day vulnerability within the IE
createTextRange functionality.

This workaround has been created because currently there is no solution
from Microsoft other than the workaround to disable Active Scripting. We
have personally had requests from various customers and the community to
help provide a free solution in the case that companies and users are
not able to disable Active Scripting. The workaround we have created,
like ones before it, is experimental in a sense and should only be
installed if you are not able to use the safer mitigation of disabling
Active Scripting.

The workaround is obviously free, and we do not require any registration
information to download it from the eEye website.

Should you encounter any problems with the workaround or bugs please
send email to alerts@xxxxxxxx with detailed information on the problem
you experienced and we will work to fix any bugs in a timely fashion. We
will post updates to the website with version numbers and bug fixes
should they arise.

Obviously these things are experimental in nature but considering the
options of being vulnerable or at least having a fighting chance... Well
I think you get the point. Again this is just another mitigation option
until Microsoft releases their patch, which last was scheduled for April
11th or 16 days from now.

For more information on the vulnerability and a link to download the
workaround please visit:
http://www.eeye.com/html/research/alerts/AL20060324.html

Signed,
Marc Maiffret
Chief Hacking Officer
eEye Digital Security
T.949.349.9062
F.949.349.9329
http://eEye.com/Blink - End-Point Vulnerability Prevention
http://eEye.com/Retina - Network Security Scanner
http://eEye.com/Iris - Network Traffic Analyzer
http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/


_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/



Relevant Pages

  • MS released a patch today - MS06-001
    ... Microsoft released a patch for the WMF vulnerability this afternoon. ... Microsoft has tested the following workaround. ... * Unregister the Windows Picture and Fax Viewer on Windows XP ...
    (Bugtraq)
  • Re: Installing 835732 causes my server to crash
    ... > The FAQ section of the technical bulletin: ... > has workaround information for many of the vulnerabilities in this patch. ... It looks like the LSASS Vulnerability - CAN-2003-0533 ... -- torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway Administration scripting examples and an ONLINE version of the 1328 page Scripting Guide: ...
    (microsoft.public.security)
  • [Full-disclosure] EEYE: Temporary workaround for IE createTextRange vulnerability
    ... eEye Digital Security has created a temporary work around for the ... This workaround has been created because currently there is no solution ... For more information on the vulnerability and a link to download the ...
    (Full-Disclosure)
  • [Full-disclosure] -Advisory- - =Thu Mar 16 03:47:35 EST 2006= - Buffer Overflow
    ... It is possible to make Microsoft Office crash or run arbitrary code by the use of malformed input. ... Workaround ... This vulnerability has no identified workarounds on the issue at hand. ... CVE Information ...
    (Full-Disclosure)
  • EEYE: Temporary workaround for IE createTextRange vulnerability
    ... eEye Digital Security has created a temporary work around for the ... This workaround has been created because currently there is no solution ... For more information on the vulnerability and a link to download the ...
    (Bugtraq)