Robert McLaws: FunWithCoding.NET

Public Shared Function BrainDump(ByVal dotNet As String) As [Value]

News

<script type="text/javascript"><!-- google_ad_client = "pub-4330602465258980"; google_hints = "ASP.NET, VB.NET, C#, C#.NET, WindowsForms, .NET Framework, VS2005, Visual Studio, XAML, WinFX, Windows Workflow, WPF, WCF, Atlas, NetFX3, Visual Studio Orcas"; google_ad_width = 120; google_ad_height = 240; google_ad_format = "120x240_as"; google_ad_type = "text_image"; google_ad_channel ="4997399242"; google_color_border = "B6C9E7"; google_color_bg = "EFEFEF"; google_color_link = "0000FF"; google_color_text = "000000"; google_color_url = "002C99"; //--></script> <script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script>
<!--
-->

You should feel free to challenge me, disagree with me, or tell me I'm completely nuts in the comments section of each blog entry, but I reserve the right to delete any comment for any reason whatsoever. That said, I will most likely only delete abusive, profane, rude, or annonymous comments, so keep it polite, please.

Blogroll

Cool .NET Articles

My .NET Tools

My Builder.com Articles

My MSKB Articles

IE Flaw Explained - Patch On the Way

News.com has a great article on the IE “address spoofing flaw”, and the forthcoming patch to solve it. It's a must read, so go check it out.
Posted: Jan 29 2004, 04:15 PM by interscape | with 2 comment(s)

Comments

Dumky said:

This seems a bit extreme, but it's true this format can easily confuse end-users...
I hope they fix the %01 part of the problem as well, since it could still contribute to future flaws.

There is a lot of testing involved in making a patch, but how many weeks will this major flaw been left un-patched?
# January 29, 2004 9:04 PM

TrackBack said:

Over a month back a security bug was discovered in IE that allows the address displayed in IE to be different for the actual address used. Here is a description and demo of the spoof attack. Apparently, the upcoming fix includes dropping the http://user:pwd@domain/ url format support. This is a radical "fix" and the response by security experts (mentioned in the article) was surprising. This format isn't the root cause for the specific bug and the "fix" is going to break stuff (not to mention IE's support for standards). In any case, I hope they fix the part of the...
# January 30, 2004 3:24 PM