Bugtraq mailing list archives
ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)]
From: Gadi Evron <ge () linuxbox org>
Date: Sun, 24 Sep 2006 13:45:02 -0500 (CDT)
On Sun, 24 Sep 2006, Bill Stout wrote:
http://sunbeltblog.blogspot.com/2006/09/seen-in-wild-zero-day-exploit-be ing.html "This exploit can be mitigated by turning off Javascripting. Update: Turning off Javascripting is no longer a valid mitigation. A valid mitigation is unregistering the VML dll. "
There is, of course, the ZERT (Zeroday Emergency Response Team) patch, available to those who choose to use it. Along with source code, testing methodology, etc. Naturally a vendor patch is BETTER, this is merely an alternative that can be used, right now, by those who choose to do so. http://www.eweek.com/article2/0,1895,2019162,00.asp http://isotf.org/zert/ Richard wrote an interesting blog entry on it: http://taosecurity.blogspot.com/2006/09/zert-evolution.html
Bill Stout
Gadi.
Current thread:
- ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] Gadi Evron (Sep 25)
- Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (Sep 25)
- Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] Gadi Evron (Sep 25)
- Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (Sep 25)
- Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] Bojan Zdrnja (Sep 25)
- Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] Gadi Evron (Sep 25)
- Re: ZERT patch [was: 0day for IE (Disabling Javascript no longer a fix)] Susan Bradley, CPA aka Ebitz - SBS Rocks [MVP] (Sep 25)