1

we're trying to analyze some attack vectors on one of our MVC apps and we are considering writing some code to prevent users from accessing our site using a browser[version] that we consider to be too insecure.

For example, anything less than IE 7 is getting banned from our site.

Any browser [+version] that doesn't implement the HttpOnly cookie or has serious known holes/scripting issues would be on our watch list.

Without the obvious sarcastic comments about all versions of IE being totally insecure(!), which browsers and/or versions would you consider to be risky? IE tends to get all the bad press, but what about version 1 of Chrome or version 3 of Safari, etc.?

Improve this question

1 Answer 1

Reset to default
1

Honestly I still think most unsecure browser is IE. There is a lot of crashes and a lot of code execution bugs for IE. In last days of 2012, bluehole 0-day bug discovered being exploited in wild. But I don't remember last bug I've seen which successfully executes shellcode in Windows 7 with DEP and ASLR enabled. Those days almost passed for Firefox and Chrome. Specially chrome sandbox is really secure. I've seen only Vupen found a 0-day vulerability which executed code in Chrome like 1 year ago.

You can see list of vulnerabilities per year, per product and you'll see classification of bugs also. http://www.cvedetails.com/product/3264/Mozilla-Firefox.html?vendor_id=452

Change product to Chrome, Internet Explorer and Safari.

Also IE is really vulnerable by third-party plugins, you can achieve code-execution easier on IE.

If you have more specific question, please ask.

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

thanks for your reply. The link you supplied is really useful and contains lots of excellent information. I appreciate your comment re IE but the fact is we cannot just ban IE outright! We have simply banned IE 7 and back. Other than IE, which VERSIONS of each of the mainstream browsers would you suggest we ban?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.