Internet Explorer Flaw Now Rated as "Extremely Critical"

Here is another reason to never use Internet Explorer. The security-riddled web browser has now earned a very rare "Extremely Critical" advisory notice. Microsoft was notified of the problem in March 2005 but has done nothing to modify the program or fix the flaw. In the meantime, rip-off artists can steal information from your computer if you are using Internet Explorer.

Details may be found at http://www.security.ithub.com/article/Unpatched+IE+Flaw+Is+Worse+Than+Expected/166164_1.aspx

Luckily, the problem is easy to fix. Simply switch to either Firefox or Opera. Both of these are better web browsers and, unlike Microsoft's Internet Explorer, both have very few security problems. Both are available free of charge.

Comments

[Mike]

Firefox has had a number of their own security issues. And the more and more that people start using it, the more secuirty flaws that will be found.

[Dino (All Dino, All the Time)]

Mike,

I agree. I'm a Firefox user, but have pretty much lost track of what version is the most current (I think 1.0.7 is current with 1.5 coming out soon.) It seems that security fixes are coming out for Firefox just as fast as they are for IE.

And you can now get an ActiveX plug-in for Firefox that will make it just as full of security holes as IE.

It was good while it lasted, but now that it has 10% of the market, it is beginning to draw hackers' attention.

[Trishymouse]

I agree with the commented named Mike. I work in IT as an IT Administrator. Every software has flaws, and Firefox's increasingly popularity will eventually become it's downfall, so to speak.

[Mark Roy]

Lest anyone get a false sense of security, there's a list of security patches put out for Firefox at http://www.mozilla.org/projects/security/known-vulnerabilities.html. Those are the ones that have been found and fixed.

Now, how about adding a big a Firefox logo with big red X through it?

The ONLY way to completely avoid browser attacks is to completely avoid using browsers. Otherwise, regardless of which browser you use, get yourself a good virus/security application.

[Derek]

I concur with Mark Roy - security is no more absolute with browsers than it is with any other component of internet use. My own personal view is that Firefox is certainly not *less* secure than IE, not to mention that is far, far more configurable and user-friendly. I can't comment on Opera because I haven't used it.

MarkRoy, your link didn't work for me - I tried to paste it into this post, but TypeKey is cutting off the last two letters of the URL. So everyone, to follow the link in the previous post:

copy and paste it into your browser window, press the right-arrow key, type the letters "ml" at the end of the line, and press enter.

[Dick Eastman]

I think that is over-simplifying the issue. There is truth to what you say, but consider the following:

1. There have been many more security holes identified in Internet Explorer than in all other web browsers combined.

2. No other web browser has EVER been issued an "Extremely Critical" rating by the security companies.

3. Microsoft has known about the problem since March and has not yet fixed it.

4. When (smaller) security holes were identified in the other browsers, they always were fixed within days.

5. At this moment, there is no known "Extremely Critical" security hole of that sort in Firefox, Mozilla, Opera, etc. and there never has been.

6. At this moment, there is an 8-month-old major (Extremely Critical) security hole in Internet Explorer that allows others to steal data from you.

OK, which web browser are you using AT THIS MOMENT? One that has a known Extremely Critical security hole AT THIS MOMENT or one that has no known security holes at this moment?

Yes, that could easily change in the future. But how about right now? If you are reading this message in Internet Explorer, you KNOW that your data is exposed.

Your choice.

- Dick Eastman
(using Firefox)

[Cleaveland]

The problem with this advice is that there are many sites out there that don't work with FireFox; they need IE. What's worse is that in some it's hard to figure that out. PayPal is one of them - try the url https://www.paypal.com/us/ in both and see if you see the "send money" tab.
I struggled for some time before I realized the problem. I complained to them some time ago and nothing's been done so far.

Yes, I use FireFox normally, but have to be aware at all times for glitches that demand IE. The FireFox plugin for "View this page in IE" is invaluable in those cases.

I haven't tested Opera.

Dick

[Mark Roy]

Dick Eastman;

Take a look at http://secunia.com/product/4227/?period=2005#statistics. There *has* been a Extremely Critial advisory for Firefox. In fact there have been 25 advisories for Firefox this year -- more than IE's 15 over the same period. Firefox has also had 7 Highly Critical advisories -- more than IE's 5. Firefox currently has 3 unpatched issues.

Secunia also has a current Highly Critical advisory on Opera.

Re the IE extreme issue -- yes, it has been know about since March of this year, but was thought by all to be less critical issue. It was only "upgraded" to Extremely Critical on 11/21.

I am using IE 6 SP1 right now.

I'm not defending Microsoft or IE, but I won't give Firefox a free pass on this one.

[david]

More importantly, why are we reading about it here? Dick, your Microsoft bashing was quaint at first, but it's more than tiring at this point. Stick to genealogy, and let the security websites deal with the warnings.

[Mark Roy]

From an article on ZDNet yesterday (http://news.zdnet.com/2100-9590_22-5976718.html)

Apple releases OS X security patches

"The most severe of these are the vulnerabilities found in curl and the PCRE library used by Safari," said Thomas Kristensen, chief technology officer for security site Secunia, which rated Apple's updates as "highly critical"--the second-highest danger ranking.

Contrary to popular belief, Mac users are not immune...

[Cleaveland]

Qoting Mark Roy:
"Take a look at http://secunia.com/product/4227/?period=2005#statistics. There *has* been a Extremely Critial advisory for Firefox. In fact there have been 25 advisories for Firefox this year -- more than IE's 15 over the same period. Firefox has also had 7 Highly Critical advisories -- more than IE's 5. Firefox currently has 3 unpatched issues."

From the page cited:
"Please Note. The statistics below should not be used for a direct comparison of how secure two different products are.

[Mark Roy]

I did not intend to make a comparison of the relative overall security of IE vs. FF. I'm certainly not suggesting that FF is 'less secure' than IE.

The point is that neither product is "safe". Nor is Opera or Safari.

[Dick Eastman]

This story doesn't seem to want to go away. Another Internet Explorer bug has been published. It details a problem with IE being used with Google Desktop. It seems that a bug in IE's software for CSS (cascading style sheets) exposes user information. Mozilla Firefox and Opera do not have this problem.

The full story is at http://www.eweek.com/article2/0,1895,1895579,00.asp?kc=ewnws120205dtx1k0000599

[Gordon Banks]

Every time one of these security announcments comes out indicting IE, a bunch of Microsoft fans jump in to say that Firefox or Safari, or some other browser has flaws too. That is undoubtedly true. The fact remains, however, that no other browser allows Active-X programs to be started up on your computer.

The other important fact is that despite Linux and Apple and Firefox having vulnerabilities, no one seems to be writing exploits for anything but Windows software. I do all my emailing and browsing from Linux. I get several emails every day with viruses for Windows embedded in them. I have never yet ever received a Linux or Mac virus. The kids who write these just aren't interested in trashing Linux or Mac, but they are interested in trashing Microsoft.

[Dick Eastman]

Here is another article that should add more fuel to the "which browser is safer" debate: http://www.eweek.com/article2/0,1895,1865087,00.asp

Note that this article is from the prestigious eWeek Magazine that has an excellent reputation for reporting technical issues.