Researchers penetrate last bastion of Windows security.

[JMH]

Security researchers have defeated vulnerability protections baked into the latest versions of Internet Explorer, demonstrating that it's possible to poke holes in a safety net that's widely relied on to keep end users safe from drive-by exploits.

By exploiting weaknesses in Adobe Systems' Flash Player, researchers have devised two separate attacks that bypass mitigations Microsoft put into IE 7 and 8. Known as ASLR, or address space layout randomization, and DEP, or data execution prevention, the technologies are designed to lessen the severity of bugs by making it hard for them to cause the execution of malicious code.

Both techniques wield the so-called just-in-time compiler in Flash so that a computer's memory is blanketed with large chunks of identical shellcode. The "JIT-spray" allows attackers to overcome ASLR, which normally thwarts execution by picking a different memory location to load system components each time an operating system is started.

Source -
Researchers penetrate last bastion of Windows security ? The Register

 

[electrotune1200]

Thanks for the info..... It just goes to show nothing can stay secure forever. Both sides of the fence are able to keep people employed and very busy.

 

[Lee]

This won't be the last. . .you can bet on that.

 

[Zidane24]

anyone else not realizing that yet again an adobe product is the cause of a major security hole in Windows systems?

First PDFs...now flash??

 

[z3r010]

anyone else not realizing that yet again an adobe product is the cause of a major security hole in Windows systems?

First PDFs...now flash??

After all the recent fuss with IE6 due to security issues, maybe it's time that flash was phased out too as not a week goes by without another flash vulnerability.

 

[smsff7]

I think I hate flash more etch day...to many security issues

 

[thefabe]

anyone else not realizing that yet again an adobe product is the cause of a major security hole in Windows systems?

First PDFs...now flash??

After all the recent fuss with IE6 due to security issues, maybe it's time that flash was phased out too as not a week goes by without another flash vulnerability.

I agree excellent idea. All for it. Fabe

 

[HJA]

maybe it's time that flash was phased out

I have to use Flash when I use Adobe video editing. Locking off the internet and then disabling Flash when I'm done should be a safe route, shouldn't it?

 

[garysgold]

Thanks for the heads up Jan.

 

[matt_0978]

i'm no Apple fanboy but this is why Jobs won't entertain flash.

 

[blackroseMD1]

I agree that it's about time that Flash went the way of the Dodo. Hopefully MS can keep Silverlight secure, and HTML5 is a step in the right direction as well. There will always be malicious code out there, it's just up to companies like MS and others to try to stay ahead of it. Adobe just doesn't seem to care.

 

[arkhi]

This is why I use 64-bit IE. I get virtually no add-ons that people exploit. It's like having a no-add-on-IE running, but it's faster. You might think that running a browser without flash is crazy. That's what I thought too, but then I realize there are still sites that doesn't use flash at all, like this forum.

I just switch to 32-bit when browsing to a site I want that utilizes flash, and I NEED the flash (ew advertisement flash).

So far so good.

(Am just talking to IE users btw)