ZDI shames Microsoft for – yet another – coordinated vulnerability disclosure snafu A Microsoft zero-day vulnerability that Trend Micro's Zero Day Initiative team claims it found and reported to Redmond in May was disclosed and patched by the Windows giant in July's Patch Tuesday – but without any credit given to ZDI. The flaw, tracked as CVE-2024-38112, is in MSHTML aka Trident aka Microsoft's proprietary …
Microsoft disabled Internet Explorer back in June 2022, and the now-dead browser no longer receives security fixes.
Then, a few paras later...
Basically, marks are tricked into opening a malicious shortcut file [..] that activates the Windows PC's dormant Internet Explorer
Seems to me the crux of the problem is this: Redmond's idea of 'disable' and most people's idea of 'disable' are at odds. Their version seems to be 'well, we took the icon away so people can't click it' - and left the codebase in there, complete with any attack surface it presents. Some might say that's the inevitable result of spending ten plus years embedding browser tech deeply into the underlying operating system, suggesting it's impossible to properly remove I.E. without breaking core OS functionality.
Redmond's idea of 'disable' a
You've taken a word written by a Register journalist, and attributed it to Redmond.
I was glad to see that the later part of the article delivered a more accurate description of the status of IE.
Some might say that's the inevitable result of spending ten plus years embedding browser tech deeply into the underlying operating system
30 minus years: Windows 95.
suggesting it's impossible to properly remove I.E. without breaking core OS functionality.
Well, that's been the subject of ongoing dispute: MS asserted that the Help System, HTML Application support, and the Desktop were "core" OS functionality: the competition asserted that anything not matched by Linux/BSD was not "core" OS functionality.
I don't really get what you are trying to say. But having the web browser with the worst security reputation ever still in the codebase is just mindboggling. But sure, Microsoft doesn't care about Windows unless it's about whatever stupid fad is in swing (AR, AI,...). Removing all that exploitable code would be difficult because a lot of parts of Windows are probably still intertwined with it and it doesn't add anything to the bottom line. In a serious organization it would be done anyway but this is Microsoft so par for the course.
when I read this, all I'm getting is a feeling that ZDI have a bruised ego that CheckPoint wrote up the flaw better than they did, and are whining about that.
As for complaining that vendors sometimes patch things quicker than expected - WTF....
ZDI need to grow up.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
