Sign in / up

back to article Exploit for 'extremely critical' Yahoo Jukebox vuln goes wild

Just one day after nasty security flaws were disclosed in Yahoo's Music Jukebox, miscreants have begun to actively exploit them. The buggy Yahoo media player is one of at least three pieces of web software reported in the last week to be smitten by ActiveX flaws that leaves users wide open to attack. Elazar Broad, the …

COMMENTS

House rules Send corrections
This topic is closed for new posts.
  1. Anonymous Coward
    Coat

    Ah, already the first fruits of the MS / Yahoo merger...

    Wot, I have to have a comment as well as a title??

    0 0
  2. Anonymous Coward
    Stop

    Here we go again

    If you had <Insert Browser> instead of (insert rival product) running on (insert O/S) then you would never suffer any problems ever! No really, never ever. In fact <insert product> is so amazing, it will help you win the lottery, get a boy/girl friend and get a life, it's that good !

    0 0
  3. Rich Silver badge
    Coat

    ActiveX

    Looking back over the years, at the numerous exploits and failings of ActiveX [out-of)] controls, is it just me that thinks ActiveX is a really clever, robust, and secure way of doing stuff?

    Oh, I see. It IS just me, isn't it?....

    0 0
  4. Ross

    Re: Here we go again

    Yada yada yada. The undeniable point is that Active X, IE and Windows are insecure out of the box individually. Taken together they are an open door to your PC and whatever information you store or put through it. *Any* other combo is an improvement, including any other browser on Windows.

    I've been struggling to think of *any* Active X control that added value to a Windows install and the only one is the MS Update control, which let's face it was only deployed as an Active X control so MS could say "look we have to keep IE tied to the OS otherwise you can't update it" thus killing off the competition (Netscape)

    MS *are* getting better with their security (eventually!) but they still have miles to go with technologies like Active X. At least if you blow a Java applet up you still have to break out of the sandbox. I'm not saying it's impossible but it's a darn sight more difficult than just waiting for a stack frame to pop.

    I also look sternly at people like Yahoo! that release such shoddy products. The plain fact is there are people that you can pay to test your code for vulnerabilities if you don't have the skills in house. Yahoo! et al clearly feel that their bottom line > your security however so they don't.

    Until MS fix their technologies, until producers of Active X controls learn even the most basic secure coding best practices, nobody should take the unneccessary risk of running Active X under IE on Windows when there are plenty of other options to take. Which one you prefer is entirely your choice, just don't be a lazy **** and stick with the crap that came out of the box.

    </rant>

    0 0
  5. Lucas

    don't panic

    It would take social engineering to trick a user into exposing themself to the exploit. Only users who install plugins that send them to external web pages are vulnerable, and even then they have to be tricked into going to a web page with the exploit. This is very unlikely, since almost no users of this software ever install any plugins.

    About "I also look sternly at people like Yahoo! that release such shoddy products", that's ridiculously harsh. All internet software has vulnerabilities. We have had very few exploits in this software, and we are racing to ship a patch.

    The underlying issue is once again the insecure design of ActiveX. Windows needs a capabilities model.

    0 0
  6. Claire Rand

    virtual machine

    MS could fix a lot of the problems by making IE run in a virtual machine of some sort. hack away, a site should never see anything the site didn't put there or a user entered directly.

    why exactly does a random website need the ability to run code that can potentially see the whole machine?

    if you have a need to do that provide a program to download, and use which provides the data collection etc.

    0 0
  7. Sceptical Bastard

    Good heavens! Surprise, surprise!

    Active X implicated in a security panic??? Well, knock me down with a whore's draws!

    "Yahoo has announced plans to abandon an unlimited service and transfer users to RealNetworks' Rhapsody service."

    And THAT is meant to be a good thing? See:

    http://www.theregister.co.uk/2008/01/31/realplayer_branded_badware/

    0 0
This topic is closed for new posts.