Fix for IE
Posted by Sandy Wilbourn at 5:57 AM
When there is a 0-day situation because of a vulnerability that hasn't been patched, it's even more trouble than when the vendor has patched the problem and disclosed it. On Friday, we started noticing that there were a number of PoC's that exploited CVE-2006-1359. Even though our Memory Firewall technology protects against this vulnerability out of the box, we're not widely deployed on desktop systems (yet).
Back in December Ilfak decided to do something similar for the WMF vulnerability and we took note because he did a one-off of the thing that we do for a living around here. We thought it was very cool because it solved the problem and a lot of people downloaded his patch as a temporary workaround. Hats off to Ilfak for inspiring us.
So we decided Friday afternoon that it would be a public service to the community if we created a one-off 'fix' that employed elements of our LiveShield technology to have a quick downloadable exe that would repair the problem once and for all. By Saturday afternoon, Alex had produced the fix and Monday was spent packaging and testing the fix . Our fix literally changes only one byte of code in the executable and addresses the root vulnerability.
We released it last evening, complete with the source so that independent parties could decide whether or not it is a fix. Here are some relevant links.
Back in December Ilfak decided to do something similar for the WMF vulnerability and we took note because he did a one-off of the thing that we do for a living around here. We thought it was very cool because it solved the problem and a lot of people downloaded his patch as a temporary workaround. Hats off to Ilfak for inspiring us.
So we decided Friday afternoon that it would be a public service to the community if we created a one-off 'fix' that employed elements of our LiveShield technology to have a quick downloadable exe that would repair the problem once and for all. By Saturday afternoon, Alex had produced the fix and Monday was spent packaging and testing the fix . Our fix literally changes only one byte of code in the executable and addresses the root vulnerability.
We released it last evening, complete with the source so that independent parties could decide whether or not it is a fix. Here are some relevant links.
- Our Security Advisory
- Websense artical on websites that are using the vulnerability to install bad stuff
- Microsoft's advisory which recomends disabling scripting.