MozillaZine

New IE Security Hole - And It's a Big One!

Tuesday August 24th, 1999

Yet another hole has been found in Internet Explorer's ActiveX implementation. This one allows arbitrary code to be written to the user's hard-drive. The bug was found by Georgi Guninski, who has found many security bugs in IE and Communicator. To read more about it, click here to visit Georgi's page. If you click "Test it" beside the name of this bug ("Executing programs with IE 5.0") while using IE, the page you visit will write a small bit of sample code to your StartUp menu. You've been warned. Georgi calls this bug "the most significant of my discoveries and the most dangerous also".

Thanks to Zaw for the news.


#7 It IS an ActiveX

by SomeSmartAss

Wednesday August 25th, 1999 10:55 AM

You are replying to this message

Yes. It IS an ActiveX control, not ActiveX complient (you can embed gecko into IE, but not the other way around). I don't think Mozzila would implemant it, since ActiveX is an OS proprietary technology (have they ported it to MacOS's yet?)

I admit I did once wonder aloud if they Should implement a windows only ActiveX clomplience, just for more cross-browser, but after this, I'm glad that no one was listening.