Internet Explorer 6 - Définition

Parts de marché

It was the most widely used web browser during its tenure (surpassing Internet Explorer 5.x), attaining a peak in usage share during 2002 and 2003 in the high 80s, and together with other versions up to 95%. It only slowly declined up to 2007, when it lost about half its market share to Windows Internet Explorer 7 and Mozilla Firefox between late 2006 to 2008.

IE6 remained more popular than its successor in business use for more than a year after IE7 came out. A DailyTech article noted, "A Survey found 55.2% of companies still use IE 6 as of December 2007", while "IE 7 only has a 23.4 percent adoption rate".

Net Applications estimated IE6 market share at almost 39% for September, 2008. According to the same source, IE7 users migrate faster to IE8 than users of its predecessor IE6 does. This led to IE6 once again becoming the most widely used browser version. During the summer and fall of 2009, 8 years after its introduction, IE6 still held the top spot in terms of browser marketshare.

As of February 2010, estimates of IE6's global market share ranged from 10-20%. Nonetheless, IE6 continues to maintain a plurality or even majority presence in the browser market of certain countries, notably China and South Korea.

As of January 29, 2010, Google announced it will begin phasing out support for Internet Explorer 6 web browser. Beginning March 1, 2010, Google's Web based applications and services will stop working well with Internet Explorer 6. YouTube announced that it will no longer support IE6 beginning on March 13, 2010. Many major websites are now trying to discourage use of the web browser, thus far without success.

Problèmes de sécurité

The security advisory site Secunia reported an outstanding 24 unpatched vulnerabilities in Internet Explorer 6 as of February 9, 2010. These vulnerabilities, which include several "moderately critical" ratings, amount to 17% of the total 144 security risks listed on the website as of February 11, 2010.

Although security patches continue to be released for a range of platforms, most recent feature additions and security improvements were released for Windows XP only.

As of June 23, 2006, Secunia counted 20 unpatched security flaws for Internet Explorer 6, many more and older than for any other browser, even in each individual criticality-level, although some of these flaws only affect Internet Explorer when running on certain versions of Windows or when running in conjunction with certain other applications.

On June 23, 2004, an attacker used two previously undiscovered security holes in Internet Explorer to insert spam-sending software on an unknown number of end-user computers. This malware became known as Download.ject and it caused users to infect their computers with a back door and key logger merely by viewing a web page. Infected sites included several financial sites.

Probably the biggest generic security failing of Internet Explorer (and other web browsers too) is the fact that it runs with the same level of access as the logged in user, rather than adopting the principle of least user access. Consequently any malware executing in the Internet Explorer process via a security vulnerability (e.g. Download.ject in the example above) has the same level of access as the user, something that has particular relevance when that user is an Administrator. Tools such as DropMyRights are able to address this issue by restricting the security token of the Internet Explorer process to that of a limited user. However this added level of security is not installed or available by default, and does not offer a simple way to elevate privileges ad-hoc when required (for example to access Microsoft Update).

Art Manion, a representative of the United States Computer Emergency Readiness Team(US-CERT) noted in a vulnerability report that the design of Internet Explorer 6 Service Pack 1 made it difficult to secure. He stated that:

There are a number of significant vulnerabilities in technologies relating to the IE domain/zone security model, local file system (Local Machine Zone) trust, the Dynamic HTML (DHTML) document object model (in particular, proprietary DHTML features), the HTML Help system, MIME type determination, the graphical user interface (GUI), and ActiveX. … IE is integrated into Windows to such an extent that vulnerabilities in IE frequently provide an attacker significant access to the operating system.

Manion later clarified that most of these concerns were addressed in 2004 with the release of Windows XP Service Pack 2, and other browsers have now begun to suffer the same vulnerabilities he identified in the above CERT report.

Many security analystsModèle:Who attribute Internet Explorer's frequency of exploitation in part to its ubiquity, since its market dominance makes it the most obvious target. However, some critics Modèle:Who argue that this is not the full story, noting that Apache HTTP Server, for example, had a much larger market share than Microsoft IIS, yet Apache had traditionally had fewer (and generally less serious) security vulnerabilities than IIS, at the time.

As a result of its many problems, some security experts, including Bruce Schneier, recommend that users stop using Internet Explorer for normal browsing, and switch to a different browser instead. Several notable technology columnists have suggested the same, including The Wall Street Journal's Walt Mossberg, and eWeek's Steven Vaughan-Nichols. On July 6, 2004, US-CERT released an exploit report in which the last of seven workarounds was to use a different browser, especially when visiting untrusted sites.