another winblows security issue

[Maggi]

FYI

http://www.microsoft.com/technet/security/bulletin/ms04-025.mspx

[agallag]

You realize that bulletin has been out for three weeks already, right?

[Maggi]

yup, but it strikes me that even XP SP2 is affected and when you use windows update, you won't get that patch

[Greebe]

M$ never ceases to amaze me

Oh well, don't use IE anywho

[agallag]

XP SP2 is not affected. Look at the first thing in this list:

http://www.microsoft.com/technet/security/news/xpsp2.mspx

[Maggi]

hmmmm

http://www.theregister.co.uk/2004/08/20/sp2_scripting_vuln/

http://secunia.com/advisories/12321

[agallag]

That one is brand new, not related to MS04-025. Their current proof of concept requires the user to first browse to a malicious website, then drag and drop an image from IE to somewhere else on their system. I certainly wouldn't call that "highly critical". Who drags and drops from IE anyway?

I know, they say it could be done with a mouse click, but they haven't proven that yet.

[TnT]

Originally posted by agallag
Who drags and drops from IE anyway?

You'd be suprised. There are users who don't know that you can right-click (side note: that is why Macs come with 1 button mice).

[The PIT]

I accidently did it from firefox the other day rather than moving the browser window. I guess that doesn't count though really does it.