IE flaw to be exposed at Black Hat, probably not fixable

Here's just one more reason to stop using IE to browse the Internet. Once this flaw leaks out to the bad guys, anyone using IE will be vulnerable. Because it affects SMB, IMHO it may be difficult-to-impossible to fix without breaking Microsoft Windows networking.

Internet Explorer Flaw Reveals Web Surfers Hard Drive Contents | CyberInsecure.com

... The hole is difficult to close because the attack exploits an array of features IE users have come to rely on to make web application work seamlessly. Simply removing the features could neuter functions such as online file sharing and active scripting, underscoring the age-old tradeoff between a system’s functionality and its security.

Based on Medina’s characterization, it appears that fixing the weakness will require changes in a Windows network sharing technology known as SMB, or server message block, as well as the way Windows makes file caches available to a wide variety of applications.

“The things we are reporting are not bugs, they are features,” Medina said. “They are needed for many applications to work, so [Microsoft] can’t simply remove or truncate” them.

IE suffers from at least one other long-standing security bug that can enable attacks against people browsing websites that are otherwise safe to view. It can be exploited to introduce XSS, or cross-site scripting, exploits on webpages, allowing attackers to inject malicious content and code.