Friday, January 02, 2009

Unpatched IE 6 Bugs

Here are a list of unpatched or "partially fixed" bugs in IE6 according to Some of these date back to 2003. Though some of considered only slightly problematic or slight chance and hence seems like they were not patched, some of the bugs in this list could cause a lot of problems if they happen to a particular user.

Additionally I found it interesting that Secunia lists a higher percentage of "advisories" unpatched in IE7. However going through the whole list of items for IE7 there are only 9 unpatched items compared to over 20 below. I would conclude based on that, the traffic I have mentioned in previous posts that looks a bit odd, and just by comparing the different types of bugs outstanding that IE7 is a much better browser choice if concerned about security.

Unpatched IE6 Bug - FTP Injection

IE 6 may disclose sensitive information with OnKeyDown event

Printing table of links from IE6 or IE7

IE6 and IE7 FTP credentials exposure

IE6 allows faking a URL in the address bar

Internet Explorer 6 or 7 File Upload Form Keystroke Event Cancel Vulnerability

IE6 hidden network share weakness

IE5 and IE6 Drag and Drop Vulnerability

IE6 - Trick a use to go to a malicious site

IE6 - XMLHTTP HTTP Request Injection

IE6 - Microsoft Internet Explorer Dialog Origin Spoofing Vulnerability

IE6 Microsoft Internet Explorer Popup Title Bar Spoofing Weakness

IE6 Internet Explorer Global Variables Local File Detection Weakness

IE6 - Window Injection Vulernability

IE6 - save as picture download spoofing - trick users into downloading malicious files

IE6 - cookie vulnerability
Note this bug says partially fixed.

IE6 - bypass file download security warning and save as displays different file extension than actual

Internet Explorer Flash/Excel Content Status Bar Spoofing Weakness

IE6 - Detect the presence of local files
(partial fix)

IE6 - cross domain cookie vulnerability

IE5 & IE6 address bar - faking urls
(partial fix)

IE6 - create popup content overlay
(partial fix)

IE6 bug - fake urls (partial fix)

IE6 - Cross frame scripting restriction bypass

IE6 - Internet Explorer File Identification Variant

IE6 - Exposure of Installed Components

IE6 - Internet Explorer Custom HTTP Error Script Injection Vulnerability (partial fix)

IE6 - Exposes sensitive information (partial fix)