Another day, another problem with IE.
Secunia recommends users drop IE and use an alternative browser. "Although hundreds of millions of dollars have been spent on securing SP2, perfection is impossible," the security firm said in a statement.
Millions of Internet Explorer 6 users are at risk from three "extremely critical" security Relevant Products/Services from Verisign -- Free E-Commerce Start-up Kit holes that give hackers open access to PCs running the browser -- even if Windows XP Service Pack Two has been installed.
The first issue centers on the browser's drag-and-drop capability, which does not validate new files correctly. This means that, potentially, a document downloaded from a Web page using drag and drop may contain malicious code.
The other problems affect all Windows systems, including those protected by Local Computer zone lockdown, which comes with SP2. The first allows specially designed (.hhk) files to be used to include malicious code on systems, and the second stems from a zone restriction error that could allow code to be downloaded from Web sites involuntarily.
At least one of the flaws was reported to Microsoft (Nasdaq: MSFT) Latest News about Microsoft last year, but no patches have so far been made available. Security firm Secunia has released an advisory warning that the holes are "extremely critical" and recommends users dump IE and use an alternative browser.
Of course, the problem with everyone dropping IE and moving to a new browser -- aside from all the IE specific sites out there -- is that should such a thing happen, the hackers and crackers will merely turn their attention to the new browser du jour. All browsers are large, complex programs; it's impossible to get all of the flaws out of them. The sort of people who write these things will then just turn their attention to whatever the new hot thing is, if it achieves enough market share. (These days, it looks like Firefox would be the target of opportunity.) What's really needed is a large, diversified market with several products, doing the same sorts of things, but with different behind-the-scenes architecture, and no one dominant product.
That, of course, will not happen any time soon.
Posted by iain at January 11, 2005 11:09 AM
