RE: [Full-disclosure] EEYE: Temporary workaround for IEcreateTextRange vulnerab

["William Lefkovics" <william@xxxxxxxxxxxxx>]

Firefox is not a solution.  
It is an alternative with its own set of issues, especially in the corporate
world.
 

-----Original Message-----
From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx
[mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of s89df987
s9f87s987f
Sent: Monday, March 27, 2006 6:44 PM
To: full-disclosure@xxxxxxxxxxxxxxxxx
Subject: Re: [Full-disclosure] EEYE: Temporary workaround for
IEcreateTextRange vulnerab

no work around is needed, there has been a solution all along..
one word.. firefox

On 3/27/06, Marc Maiffret <mmaiffret@xxxxxxxx> wrote:
>eEye Digital Security has created a temporary work around for the 
>current Internet Explorer zero day vulnerability within the IE 
>createTextRange functionality.
>
>This workaround has been created because currently there is no solution 
>from Microsoft other than the workaround to disable Active Scripting. 
>We have personally had requests from various customers and the 
>community to help provide a free solution in the case that companies 
>and users are not able to disable Active Scripting. The workaround we 
>have created, like ones before it, is experimental in a sense and 
>should only be installed if you are not able to use the safer 
>mitigation of disabling Active Scripting.
>
>The workaround is obviously free, and we do not require any 
>registration information to download it from the eEye website.
>
>Should you encounter any problems with the workaround or bugs please 
>send email to alerts@xxxxxxxx with detailed information on the problem 
>you experienced and we will work to fix any bugs in a timely fashion. 
>We will post updates to the website with version numbers and bug fixes 
>should they arise.
>
>Obviously these things are experimental in nature but considering the 
>options of being vulnerable or at least having a fighting chance... 
>Well I think you get the point. Again this is just another mitigation 
>option until Microsoft releases their patch, which last was scheduled 
>for April 11th or 16 days from now.
>
>For more information on the vulnerability and a link to download the 
>workaround please visit:
>http://www.eeye.com/html/research/alerts/AL20060324.html
>
>Signed,
>Marc Maiffret
>Chief Hacking Officer
>eEye Digital Security
>T.949.349.9062
>F.949.349.9329
>http://eEye.com/Blink - End-Point Vulnerability Prevention 
>http://eEye.com/Retina - Network Security Scanner http://eEye.com/Iris 
>- Network Traffic Analyzer http://eEye.com/SecureIIS - Stop known and 
>unknown IIS vulnerabilities
>
>_______________

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/