Security Internet Explorer

1 security

1.1 security vulnerabilities
1.2 vulnerability exploited in attacks on u.s. firms
1.3 major vulnerability across versions

security

internet explorer uses zone-based security framework groups sites based on conditions, including whether internet- or intranet-based site user-editable whitelist. security restrictions applied per zone; sites in zone subject restrictions.

internet explorer 6 sp2 onwards uses attachment execution service of microsoft windows mark executable files downloaded internet being potentially unsafe. accessing files marked such prompt user make explicit trust decision execute file, executables originating internet can potentially unsafe. helps in preventing accidental installation of malware.

internet explorer 7 introduced phishing filter, restricts access phishing sites unless user overrides decision. version 8, blocks access sites known host malware. downloads checked see if known malware-infected.

in windows vista, internet explorer default runs in called protected mode, privileges of browser severely restricted—it cannot make system-wide changes. 1 can optionally turn mode off not recommended. restricts privileges of add-ons. result, if browser or add-on compromised, damage security breach can cause limited.

patches , updates browser released periodically , made available through windows update service, through automatic updates. although security patches continue released range of platforms, feature additions , security infrastructure improvements made available on operating systems in microsoft s mainstream support phase.

on december 16, 2008, trend micro recommended users switch rival browsers until emergency ie patch released fix potential security risk allow outside users take control of person s computer , steal passwords . microsoft representatives countered recommendation, claiming 0.02% of internet sites affected flaw.

on december 17, 2008, fix security problem above became available, release of security update internet explorer kb960714, available microsoft windows update s webpage. microsoft has said update fixes security risk found trend micro previous day.

in 2011, report accuvant, funded google, rated security (based on sandboxing) of internet explorer worse google chrome better mozilla firefox.

a more recent browser security white paper comparing google chrome, microsoft edge, , internet explorer 11 x41 d-sec in 2017 came similar conclusions, based on sandboxing , support of legacy web technologies.

security vulnerabilities

internet explorer has been subjected many security vulnerabilities , concerns: of spyware, adware, , computer viruses across internet made possible exploitable bugs , flaws in security architecture of internet explorer, requiring nothing more viewing of malicious web page in order install themselves. known drive-by install . there attempts trick user installing malicious software misrepresenting software s true purpose in description section of activex security alert.

a number of security flaws affecting ie originated not in browser itself, activex-based add-ons used it. because add-ons have same privilege ie, flaws can critical browser flaws. has led activex-based architecture being criticized being fault-prone. 2005, experts maintained dangers of activex have been overstated , there safeguards in place. in 2006, new techniques using automated testing found more hundred vulnerabilities in standard microsoft activex components. security features introduced in internet explorer 7 mitigated of these vulnerabilities.

internet explorer in 2008, had number of published security vulnerabilities. according research done security research firm secunia, microsoft did not respond competitors in fixing security holes , making patches available. firm reported 366 vulnerabilities in activex controls, increase prior year.

according october 2010 report in register, researcher chris evans had detected known security vulnerability which, dating 2008, had not been fixed @ least 600 days. microsoft says had known vulnerability of low severity victim web site must configured in special way attack feasible @ all.

in december 2010, researchers able bypass protected mode feature in internet explorer.

vulnerability exploited in attacks on u.s. firms


browser market share worldwide july 2017

in advisory on january 14, 2010, microsoft said attackers targeting google , other u.s. companies used software exploits security hole, had been patched, in internet explorer. vulnerability affected internet explorer 6 on windows xp , server 2003, ie6 sp1 on windows 2000 sp4, ie7 on windows vista, xp, server 2008 , server 2003, , ie8 on windows 7, vista, xp, server 2003, , server 2008 (r2).

the german government warned users against using internet explorer , recommended switching alternative web browser, due major security hole described above exploited in internet explorer. australian , french government issued similar warning few days later.

major vulnerability across versions

on april 26, 2014, microsoft issued security advisory relating cve-2014-1776 (use-after-free vulnerability in microsoft internet explorer 6 through 11), vulnerability allow remote code execution in internet explorer versions 6 11. on april 28, 2014, united states department of homeland security s united states computer emergency readiness team (us-cert) released advisory stating vulnerability result in complete compromise of affected system. us-cert recommended reviewing microsoft s suggestions mitigate attack or using alternate browser until bug fixed. uk national computer emergency response team (cert-uk) published advisory announcing similar concerns , users take additional step of ensuring antivirus software up-to-date. symantec, cyber security firm, confirmed vulnerability crashes internet explorer on windows xp . vulnerability resolved on may 1, 2014, security update.