Re: [Full-disclosure] EEYE: Temporary workaround for IE createTextRange vulnerability

["PERFECT.MATERIAL" <perfect.material@xxxxxxxxx>]

Dear Chameleon,

You misspelled 'untrusted third party patch from US based terrorist cell'.
Actually, 'temporary workaround' is WAY off from the preferred spelling!

PERFECT.MATERIAL


On 3/27/06, Marc Maiffret <mmaiffret@xxxxxxxx> wrote:
>
> eEye Digital Security has created a temporary work around for the
> current Internet Explorer zero day vulnerability within the IE
> createTextRange functionality.
>
> This workaround has been created because currently there is no solution
> from Microsoft other than the workaround to disable Active Scripting. We
> have personally had requests from various customers and the community to
> help provide a free solution in the case that companies and users are
> not able to disable Active Scripting. The workaround we have created,
> like ones before it, is experimental in a sense and should only be
> installed if you are not able to use the safer mitigation of disabling
> Active Scripting.
>
> The workaround is obviously free, and we do not require any registration
> information to download it from the eEye website.
>
> Should you encounter any problems with the workaround or bugs please
> send email to alerts@xxxxxxxx with detailed information on the problem
> you experienced and we will work to fix any bugs in a timely fashion. We
> will post updates to the website with version numbers and bug fixes
> should they arise.
>
> Obviously these things are experimental in nature but considering the
> options of being vulnerable or at least having a fighting chance... Well
> I think you get the point. Again this is just another mitigation option
> until Microsoft releases their patch, which last was scheduled for April
> 11th or 16 days from now.
>
> For more information on the vulnerability and a link to download the
> workaround please visit:
> http://www.eeye.com/html/research/alerts/AL20060324.html
>
> Signed,
> Marc Maiffret
> Chief Hacking Officer
> eEye Digital Security
> T.949.349.9062
> F.949.349.9329
> http://eEye.com/Blink - End-Point Vulnerability Prevention
> http://eEye.com/Retina - Network Security Scanner
> http://eEye.com/Iris - Network Traffic Analyzer
> http://eEye.com/SecureIIS - Stop known and unknown IIS vulnerabilities
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/