|
Posted by Imhotep on May 30, 2006, 1:55 am
If you were Registered and logged in, you could reply and use other advanced thread options
Sebastian Gottschalk wrote:
> Karl Levinson wrote:
>
>>>> Just restart IE. Worst case scenario, you just reboot.
>>>
>>> ...best way to midagate a Denial of Service code flaw is to fix the code
>>> that allows it! Not reboot, over and over and over again! Enough with
>>> "Microsoft catch all solution to problems"...this too was invented by
>>> Microsoft...
>>
>> Actually, the author of the mangleme malformed HTML fuzzer tool found
>> that IE 6 coded in 2000 was far far better coded to be far more resistant
>> to this kind of attack than every other browser out there bar none,
>> including Firefox coded in 2004.
>
> And later refined this statement when he found some more DoS problems in
> IE and once more when he implemented CSS content as well, making IE the
> worst of all browsers.
>
>> While IE 6 has had some serious security problems in
>> the past, locking up or executing arbitrary code due to malformed HTML is
>> not generally one of those problem areas.
>
> Have you been sleeping the last months? Did you even take a look at
> unpatched vulnerabilities? Certainly code execution through malformed
> HTML is one of MSIE's biggest problems.
>
>> Having said that, every browser on the planet is vulnerable to denial of
>> service and lockups requiring some sort of restart from properly formed
>> HTML trickery.
>
> Huh? So you suggest you've found a general DoS condition that applies to
> currently fully fixed webbrowsers? Details please. I only know about
> HTTP 1.1 Deflate encoding decompression bombs, and whereas Windows'
> preference of IE takes down the entire system with endless swapping, any
> real webbrowsers just swaps a lot and then recovers to normal operation,
> can also be killed to stop the swapping right-out.
>
>> And every OS on the planet requires restarting a service, process
>> or application of some sort to fix various problems, although some of the
>> newer ones allow restarting various components without a total reboot
>> better than current Windows does.
>
> Fine, but what if you can't create the problems by malicious intent?
>
> BTW, the microsoft.public.internetexplorer.security is a joke, isn't it?
...well said.
-- Imhotep
| 
XML site map