Hello,

I'm not sure where to post this or even how to investigate it any further
but I have found what I believe could be a security issue in IE8 that allows
3rd party content from a page to continue to run even after the browser has
been closed.

Could someone suggest to me where I might post to discuss this without
announcing it publicly, in case this is an unpatched exploit?

Thank you.
Paul

//erlin! wrote:

> Hello,
>
> I'm not sure where to post this or even how to investigate it any further
> but I have found what I believe could be a security issue in IE8 that
> allows 3rd party content from a page to continue to run even after the
> browser has been closed.
>
> Could someone suggest to me where I might post to discuss this without
> announcing it publicly, in case this is an unpatched exploit?
>
> Thank you.
> Paul

Paul,

http://www.microsoft.com/technet/sec...n/alertus.aspx
I need to report a possible security vulnerability to Microsoft.
If you are a security researcher and believe you have found a security
vulnerability that meets the definition of a security vulnerability that is
not resolved by the 10 Immutable Laws of Security, please send e-mail to us
at secure@microsoft.com with as much of the below information as possible.
This information will help us to better understand the nature and scope of
the possible issue.

http://www.microsoft.com/security/msrc/report.aspx
"Report a Vulnerability".

--
Vincenzo Di Russo
Microsoft® MVP - Most Valuable Professional since 2003
Windows Internet Explorer, Windows Desktop Experience & Security
My MVP Profile: https://mvp.support.microsoft.com/profile/Vincenzo
My Blog: http://blogs.dotnethell.it/vincent/

erlin wrote:

> I have found what I believe could be a security issue in IE8 that
> allows 3rd party content from a page to continue to run even after
> the browser has been closed.

Did you look in Task Manager's Processes tab to make sure there were no
instances of iexplore.exe running after you thought you have *exited*
(not closed) IE8?

Yes, that was my first next stop. I also closed down all instances of
applications that could render a html window to ensure this was not a
cross-over issue with another application using the same classes in .NET

Thanks.

@Vincenzo...thanks I'll follow up on that.

"VanguardLH" wrote:

> erlin wrote:
>
> > I have found what I believe could be a security issue in IE8 that
> > allows 3rd party content from a page to continue to run even after
> > the browser has been closed.
>
> Did you look in Task Manager's Processes tab to make sure there were no
> instances of iexplore.exe running after you thought you have *exited*
> (not closed) IE8?
>

//erlin! wrote:

> Yes, that was my first next stop. I also closed down all instances of
> applications that could render a html window to ensure this was not a
> cross-over issue with another application using the same classes in .NET
>
> Thanks.
>
> @Vincenzo...thanks I'll follow up on that.

YW.

--
Vincenzo Di Russo
Microsoft® MVP - Most Valuable Professional since 2003
Windows Internet Explorer, Windows Desktop Experience & Security
My MVP Profile: https://mvp.support.microsoft.com/profile/Vincenzo
My Blog: http://blogs.dotnethell.it/vincent/

> "VanguardLH" wrote:
>
>> erlin wrote:
>>
>>> I have found what I believe could be a security issue in IE8 that
>>> allows 3rd party content from a page to continue to run even after
>>> the browser has been closed.
>>
>> Did you look in Task Manager's Processes tab to make sure there were no
>> instances of iexplore.exe running after you thought you have *exited*
>> (not closed) IE8?