Posts Tagged ‘Microsoft Internet Explorer’

April 1st, 2010

Microsoft Releases Out-Of-Band Patch for IE

Microsoft has fixed an emergency drive-by download vulnerability in Internet Explorer 6 and 7.

Tuesday Microsoft said that it released MS10-018 “out-of-band” due to an increase in attacks against its two older browsers, Internet Explorer 6 and Internet Explorer 7. Normally Microsoft releases updates via its customary “Patch Tuesday” roundup. However, this rare move served an urgent response to a zero-day, drive-by download vulnerability that has been heavily exploited by attackers over the last several weeks.

According to Microsoft, the patch will address the publicly disclosed vulnerability first revealed on March 9. The problem is caused by an invalid pointer reference located within the two older browsers that can be accessed after an object is deleted– this can allow attackers to swoop in and initialize remote code execution attacks. At the time, Microsoft claimed that the problem was limited to “targeted” attacks, however that has since changed.

“The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer,” Microsoft said weeks ago. “Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.”

In addition to the zero-day exploit, the latest patch also addresses nine other vulnerabilities that even effect Internet Explorer 8. Microsoft’s Jerry Bryan said that many have asked Microsoft if Tuesday’s patch addresses the vulnerability that was used in the Pwn2Own contest at the CanSecWest security conference last week. Apparently that’s a negative.

March 17th, 2010

Microsoft IE9 Developer Preview with HTML5 Support Ready for Download

On March 16, Microsoft is making a first developer preview of Internet Explorer (IE) 9 available for download from www.IETestDrive.com.

The IE 9 Platform Preview doesn’t include the IE 9 user interface; instead, it is the plumbing, specifically the new Microsoft JavaScript engine (which is codenamed “Chakra”) and the new graphics subsystem, coupled with a home page full of test sites. There’s no back button and no built-in security. It’s basically the IE 9 rendering engine and early developer tools.

Microsoft officials will show off the IE 9 developer preview and discuss Microsoft’s planned support for more of the emerging HTML5, CSS3 and SVG2 standards with that product during the Tuesday morning Mix 10 keynote.

“We love HTML5 so much we actually want it to work,” quipped Dean Hachamovitch, the General Manager of the IE team, during a briefing I attended at Microsoft last week about IE 9.

As Microsoft supports more of the HTML5, CSS3 and SVG2 markup, the company expects its ACID3 ratings to go up, officials said. At the Professional Developers Conference in November, Microsoft officials showed a very early build of IE 9, which earned an ACID3 score of 32. The build out today is up to 55, according to company officials.

HTML5 applications are a lot richer and demanding, in terms of graphics and speed than Ajax applications. So it’s logical they’ll work better on multi-core machines where the browser can take advantage of multicore performance, Microsoft officials argue. That’s why Microsoft’s new JavaScript engine is built to take advantage of two cores, with the second core compiling JavaScript down to native machine code to help speed up the browser. (Once the native code is available, there’s no need to use interpreted code on Core 1, meaning an app spends less time in JavaScript.)

Microsoft is planning to deliver a lot more preview builds of IE 9 before it hits beta. In fact, the team is committing to delivering an update every eight weeks, and to interact with developers via the Microsoft Connect feedback loop. Microsoft officials wouldn’t say when to expect the first IE 9 beta or to provide any kind of ship date target for the final release. (I’m still betting Microsoft will deliver the final a few months before Windows 8 ships, in 2011 or so.)

Microsoft’s high-level goals for IE 9 include making the browser snappier, maintaining compatibility with Web sites at at least the same level as IE 8 and, ultimately, enabling developers to use the same markup across IE 9 and other non-Microsoft browsers. That last of these three guiding principles is more theoretical and real at this point, but it’s interesting Microsoft is thinking this way.

February 4th, 2010

IE8 is Now World’s Most Popular Web Browser

Firefox 3.5 was for a short period the most popular browser in the world, taking the lead from Micrsoft’s Internet Explorer 6. With Firefox users now slowly transitioning from 3.5 to the newly released 3.6, the window was left open for Microsoft to climb ahead–and that’s what it has done.

Microsoft pointed to Net Application’s January browser market share report showing that Internet Explorer 8 is not only the most popular browser on Windows with 27.9-percent usage share, but that it now has 25.6-percent of market share across all operating systems on a worldwide-weighted usage share basis.

While Internet Explorer has taken a lot of heat over the years for rather loose adherences to web standards and security, especially when compared against the competition, IE8 takes big strides in making the web a better place.

The big factor is IE8′s attention to malware protection. Microsoft boasted that, as of today, Internet Explorer 8 has done over 350 million malware blocks.