Javascript & IE

[Rik]

If you use version 6 or 7 of Microsoft's Internet Explorer browser you should disable the JavaScript function immediately.

Security experts have warned anyone using Internet Explorer 6 or 7 on a Windows XP or Windows Vista PC to take immediate steps to ensure their security.

This is because an exploit for a previously unknown flaw in the browser has been spotted in circulation.

The flaw could enable a hacker to take over a computer if a surfer visited a compromised website using a vulnerable version of the IE browser.

Proof-of-concept code is already circulating on the web, with more exploit code likely to be on the way.

Security firm Symantec advised surfers to disable JavaScript in IE and to ensure their anti-virus definitions were up to date.

"The exploit currently exhibits signs of poor reliability, but we expect that a fully-functional reliable exploit will be available in the near future. When this happens, attackers will have the ability to insert the exploit into sites, infecting potential visitors," Symantec said in a statement.

You can disable JavaScript in IE7 by going to Tools, Internet Options, click on the Security tab and then click on Custom Level. Scroll down until you find the entry for Scripting, then click on Disable.

In IE6, follow the same instructions, though you are looking for the entry for 'Active scripting' in the Custom Level dialogue box. You will also need to restart your browser for the fix to take effect.

Other versions of Internet Explorer and Windows could also be affected, Symantec warned.

Microsoft has not yet commented on the vulnerability.

[somanyholes]

shame they don't have no script On a more serious note turning off javascript is going to break a massive amount of sites, I can't believe they have recommended to turn it off. Web security would be so muc better if javascript didnt exist at all, it really is a big gaping hole in browser security.

[Glenn]

Do you have a link please Rik, I'll send it to my desktop admin team?

[Rik]

I don't, I stole it from elsewhere, So.

[Noreen]

Is it the one called "Scripting of Java Applets", Rik?

[Rik]

This is the best I could find:

http://voices.washingtonpost.com/securityfix/2009/11/new_attack_targets_weakness_in.html

[Rik]

Is it the one called "Scripting of Java Applets", Rik?

Possibly.

[Glenn]

http://news.softpedia.com/news/IE7-0-Day-Vulnerability-Published-in-the-Wild-127732.shtml

[Sebby]

Good old IE.

[Baz]

i dont use IE if I can help it  but for those that do and are not familiar with Javascript  how do you disable it Rik and how long to leave it disabled

[Rik]

You can disable JavaScript in IE7 by going to Tools, Internet Options, click on the Security tab and then click on Custom Level. Scroll down until you find the entry for Scripting, then click on Disable.

In IE6, follow the same instructions, though you are looking for the entry for 'Active scripting' in the Custom Level dialogue box. You will also need to restart your browser for the fix to take effect.

Baz. Not sure about IE8.

[Baz]

opps   sorry Rik didnt read it all 

[Rik]

  I know the feeling Baz, I do it all day.

[Baz]

what do they class as a compromised website or is there far too many to mention  

[Noreen]

I found this  http://www.technipages.com/internet-explorer-7-enabledisable-javascript.html

[Rik]

Thanks, Noreen.

[psp83]

Web security would be so muc better if javascript didnt exist at all, it really is a big gaping hole in browser security.

Web security would be better if IE didnt exist!

Its not javascript thats in the wrong, its the browser not coded correctly.

[somanyholes]

Web security would be better if IE didnt exist!

Its not javascript thats in the wrong, its the browser not coded correctly.

xss/csrf dont care what browser your using, javascript/actionscript all lead down the same path.

[Noreen]

I disabled it and found that I couldn't use smilies in posts so I've reset it again.

[Rik]

It would do that, and affect some other forum functions too.

[Noreen]

Possibly doesn't affect Vista, only XP. http://blogs.pcmag.com/securitywatch/2009/11/unpatched_vulnerability_and_ex.php

[Noreen]

Looks as though it does affect Vista. http://www.microsoft.com/technet/security/advisory/977981.mspx

[Rik]

Nice to see they're really going flat out to fix it, isn't it.

[Gary]

Nice to see they're really going flat out to fix it, isn't it.

Makes Windows 7 look tempting for those with XP and Vista, Rik.

[Rik]

Makes a Mac look even more tempting.