Channel 9 Forums - Coffeehouse - And so it begins. http://mschnlnine.vo.llnwd.net/d1/Dev/App_Themes/C9/images/feedimage.png Channel 9 Forums - Coffeehouse - And so it begins. http://channel9.msdn.com/Forums Channel 9 keeps you up to date with the latest news and behind the scenes info from Microsoft that developers love to keep up with. From LINQ to SilverLight – Watch videos and hear about all the cool technologies coming and the people behind them. http://channel9.msdn.com/Forums en Wed, 19 Jun 2013 22:19:24 GMT Wed, 19 Jun 2013 22:19:24 GMT Rev9 17 -17 -1 Coffeehouse - And so it begins. Turns out, that just as I thought, Firefox is just as full of security holes as any other software. 

Hopefully, we won't have to hear any more sanctimonious crap about how 'secure' it is.

http://illmob.org/files/0day/firefox-download-and-execute.html

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/64866#64866 Mon, 09 May 2005 01:31:52 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/64866#64866 ScanIAm 17 http://channel9.msdn.com/Niners/ScanIAm/Discussions/RSS Coffeehouse - And so it begins. You have a little schadenfreude on your chin.

It's not perfect. But it is still better than IE.


]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/c1d74cfa6f454b0f874c9dec00486b54#c1d74cfa6f454b0f874c9dec00486b54 Mon, 09 May 2005 01:41:46 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/c1d74cfa6f454b0f874c9dec00486b54#c1d74cfa6f454b0f874c9dec00486b54 Cairo 17 http://channel9.msdn.com/Niners/Cairo/Discussions/RSS Coffeehouse - And so it begins.
Cairo wrote:
You have a little schadenfreude on your chin.


Shhhhh...Nobody's noticed yet.

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/f1ab334e4c4a4202b9899dec00486b7a#f1ab334e4c4a4202b9899dec00486b7a Mon, 09 May 2005 01:46:59 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/f1ab334e4c4a4202b9899dec00486b7a#f1ab334e4c4a4202b9899dec00486b7a ScanIAm 17 http://channel9.msdn.com/Niners/ScanIAm/Discussions/RSS Coffeehouse - And so it begins. Um... ok, so a batch file is supposed to run, right? It looks like it's supposed to write out and maybe execute a batch file that tells me how it could've been a virus.

Not happening. I click and the page reloads or something, is there something I'm doing wrong?

Edit: Ok, looking a bit closer at the Javascript source, the .bat file is supposed to pause after writing some stuff to the console, so I don't imagine it would simply be closing before I have the chance to see it.

Edit 2: Upon clicking in the page the Javascript Console says that 'install' is not defined, so unless it's supposed to execute code by running illegal Javascript or something I don't think it works.

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/b19af925195d4d53b8569dec00486ba2#b19af925195d4d53b8569dec00486ba2 Mon, 09 May 2005 03:01:06 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/b19af925195d4d53b8569dec00486ba2#b19af925195d4d53b8569dec00486ba2 CyberGeek 17 http://channel9.msdn.com/Niners/CyberGeek/Discussions/RSS Coffeehouse - And so it begins. and don't forget that a massive hole in Apple Tiger OS was just exposed as well. Apparently the Safari web browser will happily download and run executables without prompting the user in any way.

OK, Mac and Linux apologists, start your excuse-making!

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/6b32e8d1be1c4c0fba249dec00486bc8#6b32e8d1be1c4c0fba249dec00486bc8 Mon, 09 May 2005 03:05:34 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/6b32e8d1be1c4c0fba249dec00486bc8#6b32e8d1be1c4c0fba249dec00486bc8 gman 17 http://channel9.msdn.com/Niners/gman/Discussions/RSS Coffeehouse - And so it begins.
gman wrote:
and don't forget that a massive hole in Apple Tiger OS was just exposed as well. Apparently the Safari web browser will happily download and run executables without prompting the user in any way.

OK, Mac and Linux apologists, start your excuse-making!



Of course since it's Apple, an excuse can easily be made saying "You can just turn this off and you wont be vulnerable".

Slashdot | Malicious Web Pages Can Install Dashboard Widgets

I'm just curious...has Apple been paying attention at all to the internet.  Come on, at least they could learn from Windows mistakes somewhat.. 

BTW, I clicked using IE. Nothing happened.

mVPstar

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/5c59d76fe6f740feafe39dec00486bf0#5c59d76fe6f740feafe39dec00486bf0 Mon, 09 May 2005 03:20:48 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/5c59d76fe6f740feafe39dec00486bf0#5c59d76fe6f740feafe39dec00486bf0 mVPstar 17 http://channel9.msdn.com/Niners/mVPstar/Discussions/RSS Coffeehouse - And so it begins. It's probably meant to exploit some flaw in Firefox's handling of Javascript. It outputs a .bat file, which would be windows-specific. On my Windows box here (and on a Windows laptop I tried it on) I was unable to notice anything being done. No .bat file being created (did a search of my whole hard drive.) No .bat file being run telling me it could've been a virus.

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/ef0b4375c62a4f38b2d39dec00486c18#ef0b4375c62a4f38b2d39dec00486c18 Mon, 09 May 2005 03:23:22 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/ef0b4375c62a4f38b2d39dec00486c18#ef0b4375c62a4f38b2d39dec00486c18 CyberGeek 17 http://channel9.msdn.com/Niners/CyberGeek/Discussions/RSS Coffeehouse - And so it begins. Hello, I just installed latest Firefox and ran it under a limited user account, latest XP security patches. No console box appeared on my machine.

Roger

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/e8ad8756523f4dd7a5cf9dec00486c3e#e8ad8756523f4dd7a5cf9dec00486c3e Mon, 09 May 2005 04:54:37 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/e8ad8756523f4dd7a5cf9dec00486c3e#e8ad8756523f4dd7a5cf9dec00486c3e mrservices 17 http://channel9.msdn.com/Niners/mrservices/Discussions/RSS Coffeehouse - And so it begins. Right now i'm using fluxbox on linux and firefox as browser, i anyway prefer internet explorer and its javascript interpreter is way faster than this one (I use to write AJAX web apps, trust me), btw i love the JavaScript console:).

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/6bcee9d5e35d4e12b5799dec00486c64#6bcee9d5e35d4e12b5799dec00486c64 Mon, 09 May 2005 08:02:31 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/6bcee9d5e35d4e12b5799dec00486c64#6bcee9d5e35d4e12b5799dec00486c64 maghis 17 http://channel9.msdn.com/Niners/geek2max/Discussions/RSS Coffeehouse - And so it begins.
Beer28 wrote:

It's not as good as FFox on linux. I'm thinking they should have released that IE for unix for real that mainsoft made so there would be a native version for linux.



They did, doesn't work on poor mans unix clones like Linux though...

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/f68e241d11e94a5b8b0f9dec00486c8b#f68e241d11e94a5b8b0f9dec00486c8b Mon, 09 May 2005 08:20:58 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/f68e241d11e94a5b8b0f9dec00486c8b#f68e241d11e94a5b8b0f9dec00486c8b AndyC 17 http://channel9.msdn.com/Niners/AndyC/Discussions/RSS Coffeehouse - And so it begins.
AndyC wrote:
Beer28 wrote:
It's not as good as FFox on linux. I'm thinking they should have released that IE for unix for real that mainsoft made so there would be a native version for linux.


They did, doesn't work on poor mans unix clones like Linux though...



touché! haha

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/47509fb23c634940a5e59dec00486cb2#47509fb23c634940a5e59dec00486cb2 Mon, 09 May 2005 14:08:18 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/47509fb23c634940a5e59dec00486cb2#47509fb23c634940a5e59dec00486cb2 otech 17 http://channel9.msdn.com/Niners/otech/Discussions/RSS Coffeehouse - And so it begins.
gman wrote:
and don't forget that a massive hole in Apple Tiger OS was just exposed as well. Apparently the Safari web browser will happily download and run executables without prompting the user in any way.

OK, Mac and Linux apologists, start your excuse-making!



We know it warms your heart, special ed. You always pop up in these types of threads.

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/7dcff6ec269f435999e19dec00486cd9#7dcff6ec269f435999e19dec00486cd9 Mon, 09 May 2005 15:40:02 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/7dcff6ec269f435999e19dec00486cd9#7dcff6ec269f435999e19dec00486cd9 Cairo 17 http://channel9.msdn.com/Niners/Cairo/Discussions/RSS Coffeehouse - And so it begins. The exploit may not work on your system, and in fact, I personally never installed FF, so I can't even guarantee that it is anything more than a broken demo.  That isn't why I posted this, I did so because this forum was chock full o' IE bashers no more than 4 months ago who extolled the virtues of FF's security. 

Perhaps, in the future, we can cut down on the "The sky is falling, IE Suxxor's" crap and stick to "There's a hole in software X, and here's the patch".

Of course, I'm sure that on Linux, the site would have never caused a problem.  In fact, I'm sure that on Linux, it would have washed my car and mowed my lawn.  Cuz linux is so coool.

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/e4ecdcb460ec40feae759dec00486d01#e4ecdcb460ec40feae759dec00486d01 Mon, 09 May 2005 17:47:31 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/e4ecdcb460ec40feae759dec00486d01#e4ecdcb460ec40feae759dec00486d01 ScanIAm 17 http://channel9.msdn.com/Niners/ScanIAm/Discussions/RSS Coffeehouse - And so it begins.
ScanIAm wrote:
Of course, I'm sure that on Linux, the site would have never caused a problem.  In fact, I'm sure that on Linux, it would have washed my car and mowed my lawn.  Cuz linux is so coool.


I'm not 100% sure, but I think that exploit is fixed in FF 1.0.3

And why always MS vs Mac vs Linux vs whatever. Isn't it nice if people find Linux perfect to their use? For example I do things in Linux which I can't do in Windows so Windows is not alternative for me. No, I don't hate Windows.
If people are saying Windows/Linux/etc. sucks, so what?! If you don't like, don't use it.
Thanks.

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/62275a51d1cd4d83a6d79dec00486d29#62275a51d1cd4d83a6d79dec00486d29 Mon, 09 May 2005 17:59:51 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/62275a51d1cd4d83a6d79dec00486d29#62275a51d1cd4d83a6d79dec00486d29 Bogusrabin 17 http://channel9.msdn.com/Niners/Bogusrabin/Discussions/RSS Coffeehouse - And so it begins.
Bogusrabin wrote:
ScanIAm wrote: Of course, I'm sure that on Linux, the site would have never caused a problem.  In fact, I'm sure that on Linux, it would have washed my car and mowed my lawn.  Cuz linux is so coool.


I'm not 100% sure, but I think that exploit is fixed in FF 1.0.3

And why always MS vs Mac vs Linux vs whatever. Isn't it nice if people find Linux perfect to their use? For example I do things in Linux which I can't do in Windows so Windows is not alternative for me. No, I don't hate Windows.
If people are saying Windows/Linux/etc. sucks, so what?! If you don't like, don't use it.
Thanks.


Well, that is, of course, correct, but you can hardly blame people for turning to attack Beer, when he comes on here with that attitude.

As it goes, about this issue, it is unpatched and will work on Linux as well.  It just happens that in this example, it generates a batch file in order to show a proof of concept of remote code execution.

What this bug really shows is the biggest weakness in Firefox - the XPCOM system.  To be honest, this is as powerful but as dangerous as ActiveX.  In fact, it shares much of the conceptual design of ActiveX.

The point overall is this is not a Windows, Mac or Linux issue.  The execution platform is Firefox.

And, as a further aside, the original posted exploit wont work now because of server-side changes made by Mozilla themselves.

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/ebe1eafca4494ee68a909dec00486d54#ebe1eafca4494ee68a909dec00486d54 Mon, 09 May 2005 18:34:01 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/ebe1eafca4494ee68a909dec00486d54#ebe1eafca4494ee68a909dec00486d54 Cider 17 http://channel9.msdn.com/Niners/Cider/Discussions/RSS Coffeehouse - And so it begins.
Beer28 wrote:


Linux is the poor man's unix clone, but it works on solaris and solaris 10 works on x86, the poor man's box and is free. Explain that one?



'twas only available of Sparc Solaris (Solaris x86 wasn't available back then) and I don't think Solaris was free then either. In any case, Sparc hardware was a long way from cheap. 

Beer28 wrote:


Also, I don't see a download link. Did they release a source package,


No. IE isn't open source, so why would they? I'm not sure you can download it any more as IE 5 is no longer a supported piece of software and IE 6 never made it to Unix.

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/83886432af8846b8b86f9dec00486d7d#83886432af8846b8b86f9dec00486d7d Mon, 09 May 2005 20:29:27 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/83886432af8846b8b86f9dec00486d7d#83886432af8846b8b86f9dec00486d7d AndyC 17 http://channel9.msdn.com/Niners/AndyC/Discussions/RSS Coffeehouse - And so it begins.
Beer28 wrote:


Yeah, but solaris is free now, I guess I see your point about it not being free back then.
I'm still shopping for a solaris box for testing.
I found some pretty good deals on refurbs here
http://www.anysystem.com/e220r-special-1.html

They have ultra5's for like a hundred bucks.


Well worth it. They aren't the most powerful boxes in the world but they do alright for low capacity stuff, a fair chunk of the network services here run on Sparc Ultra 5s.

]]> http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/a9f03da584b44194b7bd9dec00486da5#a9f03da584b44194b7bd9dec00486da5 Tue, 10 May 2005 08:56:02 GMT http://channel9.msdn.com/Forums/Coffeehouse/64866-And-so-it-begins/a9f03da584b44194b7bd9dec00486da5#a9f03da584b44194b7bd9dec00486da5 AndyC 17 http://channel9.msdn.com/Niners/AndyC/Discussions/RSS