Thursday, July 22, 2004 - Posts

Linspire Advertisement

Have you see the new Linspire moovie? Check it here:

http://www.linspire.com/RunLinspireFlash.php

Really amazing... but too offensive against Microsoft I see...

Mono Win32 Combined Installer

A package that must be signaled:

if you want to try Mono on Windows, now on Novell site is available a Windows Installer that includes Mono 1.0, GTK# 1.0, gtk+ 2.24, and XSP, the Mono web server for ASP.NET web pages (Apache for Windows is not yet supported due to sockets problems).

Internet Explorer new problem...

Do you remember the so called HijackClick 3 series of Internet Explorer vulnerabilities? In summary, you can force a drag and drop event simply when the user clicking a something by moving the window when the OnMouseDown event fires.

MS seems to patch these vulnerabilities some times ago (ok, I think it's really discutible this fact: disable some functions from being called when the mouse button is down for me is not a real patch, but only a temporary solution).

What's new? As you can see on a new post on SecurityFocus, MS has patched MSHTML.DLL and IEXPLORE.EXE but they have forgotten to patch the Popup.Show() function. Now an exploiter can show a popup on loading of the main window, move it and show a favorites list on the MouseDown event, and set a timer to hide the favorites list and taunt the victim who just got tricked into adding a link of our choice to their favorites list.

Also a real example of these exploit is available, just click HERE.

I think this is a clear sign that IE staff must improved, they must start thinking on something better. Patching a problem is not equals to simply disable functions, but the problem must be understood and correct.