Firefox Update Addresses QuickTime-triggered Vulnerability
29646
Users of Firefox yesterday began receiving notices of the availability of version 2.0.0.7, which the Mozilla organization said addresses a vulnerability involving Apple's QuickTime plug-in. In BetaNews tests of the new version this afternoon, the vulnerability in question appears to have been fully patched.
719808
Security analysts say a flaw in the pop-up blocker in the Firefox browser could allow an attacker to access local files.
302277
Both Windows and Mac versions of the multimedia program have a buffer overflow flaw that puts users at risk.
127768
Third-party fix plugs a recently discovered browser flaw that's increasingly being exploited in cyberattacks.
86222
In brief Exploit circulating for unpatched vuln
588549
Apple released an update to its QuickTime media player on Friday, patching eight security flaws in the application including code execution and information disclosure risks. Both Mac OS X and Windows are affected.
721339
(InfoWorld) - The security team at Mozilla Corp. is looking into a flaw in its Firefox Web browser that hackers exposed at a conference in San Diego over the weekend. In a presentation at theÂ ToorCon hacker conference on Saturday, hackers Mischa Spiegelmock and Andrew Wbeelsoi demonstrated exploit code for a vulnerability in the way Firefox handles Javascript. On Monday, Mozilla said it was busy investigating the flaw, and did not offer any security researchers for comment because, according to spokeswoman Mary Colvig, they were all "heads down" on the problem. The company also said it will patch the flaw if it deems that action necessary. The vulnerability could allow someone to execute a memory corruption attack on Firefox if a user browsed to a Web site that contained the exploit code, said Ken Dunham, director of the rapid response team at security services company iDefense, a VeriSign company. "If you were to go to a Web site that contained the exploit code, it would fill up the available memory on the computer," he said. This would create an environment in which an attacker could take over the computer to do something harmful, he added. Dunham said that iDefense labs tested the exploit code, and it was "unreliable" and crashed the Firefox browser. Because of this, he does not consider the exploit to be a critical threat to Firefox. However, "someone could make some changes to the exploit code and make it more reliable," Dunham said. He added that there are other, more critical unpatched flaws in both Firefox and Microsoft Corp.'s Internet Explorer browser that are currently under attack by hackers.
492868
TechWeb - A new proof-of-concept code is circulating for a Firefox vulnerability that was fixed in Mozilla's security update that was released last week.
142437
The latest version of QuickTime corrects flaws identified last month that could allow a hacker to take control of your system if you happened upon an evil Web page.
605863
com staff. Danish security firm Secunia has reported a &quot;moderately critical&quot; window injection vulnerability in Firefox, Internet Explorer, Opera, Netscape, Safari and Konqueror.
336569
A security issue has been discovered in a common feature included in several Web browsers, including Mozilla, Firefox, Opera, Konqueror and Camino.
758734
(InfoWorld) - Mozilla has fixed a critical bug in the way the Firefox browser works with QuickTime media files. The flaw, which was reported last week by hacker Petko Petkov, gives attackers a way to run unauthorized commands on a victim's PC. "This could be used to install malware, steal local data, or otherwise corrupt the victim's computer," Mozilla said in a security advisory published Tuesday. A July 2007 patch was supposed to take care of this type of problem, but Petkov showed how attackers could still run commands on a victim's system by tricking a victim into opening a maliciously coded QuickTime media file. In fact, until Apple addresses the underlying flaw in QuickTime, there still could be headaches for users, Mozilla said in its security advisory on the issue. "QuickTime Media-link files could still be used to annoy users with popup windows and dialogs until this issue is fixed in QuickTime," the advisory states. The common security measure of disabling JavaScript does not prevent this attack, although the NoScript Firefox add-on does provide protection, Mozilla said. "Petkov provided proof of concept code that may be easily converted into an exploit, so users should consider this a very serious issue," Mozilla's security chief, Window Snyder said in a recent blog posting. Mozilla has been able to reproduce this bug only on the Windows operating system, she added. The flaw also affects the Internet Explorer browser, Petkov said on his blog. However, IE's security policies make the flaw less critical on Microsoft's browser, he added. The Firefox 2.0.0.7 update was pushed out to users starting around 3 p.m. Pacific Time on Tuesday. It contains only one security update: the QuickTime fix.
148460
InfoWorld - Apple has released a security fix for its QuickTime media player software, fixing a critical bug that had been worrying security experts for nearly a month.
116046
Help on the way Mozilla's chief of security has confirmed a vulnerability that could cause fully patched versions of Firefox to expose a user's private data.â¦
196884
A flaw in the pop-up blocker of the open-source browser Firefox could allow an attacker to access local files, according to security analysts.
413975
(InfoWorld) - One week afterÂ updating its Mac OS X operating system, Apple has patched a serious flaw it its QuickTime media player. The security update to QuickTime 7.1.6, published Tuesday, fixes two issues in the way QuickTime works on the Java platform. The most serious of these problems could give criminals a way of taking control of an unpatched computer, Apple said in a security alert. "By enticing a user to visit a Web page containing a maliciously crafted Java applet, an attacker can trigger the issue which may lead to arbitrary code execution," the alert states. The second bug is considered to be less critical, but it could allow an attacker to have a look into the Web browser's memory and lead to the disclosure of sensitive information, Apple said. This latest QuickTime update is available for both Mac OS and Windows users. Apple's security team has been busy of late. Last week's Mac OS X patches fixed 17 flaws, several of which were considered to be critical. Apple also fixed a similar QuickTime for Java bug on May 1 after this flaw was used to claim a $10,000 Mac hacking prize at the April's CanSecWest security conference.ADVERTISEMENTIBM Information On Demand 2006Industrial Industry Leaders, please join us at IBM's premier information management global event, IBM Information On Demand 2006, October 15-20, Anaheim, CA. More IBM business and technical solutions content in one place than ever before! Select from  over 800 sessions. Register today!
533617
(InfoWorld) - With the release of its latest Firefox 2.0.0.5 browser, open-source software maker Mozilla claims to have fixed a number of potentially serious vulnerabilities in its flagship product. According to the firm's chief security officer, the company is working harder than ever to keep its users protected. Through the launch of Firefox 2.0.0.5 late on July 17, Mozilla moved to patch nine individual flaws resident in previous iterations of the program. Patches built into 2.0.0.5 included those meant to address multiple memory corruption bugs, a cross-site scripting vulnerability, and a flaw that could give attackers access to the browser's cache. Among the other problems the company addressed in the update was even an unusual vulnerability that could cause malicious code to run on a PC if the browser is launched using Microsoft's rival Internet Explorer software -- a flaw that Mozilla could have easily pinned on Microsoft, despite denials from the software maker that it is at all responsible for mending the issue. And while some security experts still maintain that open-source products are ill-fitted for use inside enterprise businesses as they may leave the door open to savvy attackers who can take advantage of the readily-available nature of the products' widely-published source code, Window Snyder, whose official title is "chief security something-or-other" at Mozilla, claims that the firm's very makeup has led Firefox and the vendor's other products to offer stronger protection for end-users than proprietary systems with which they compete. "Transparency has been one of the key factors to our success in improving security; some see doing development with the whole world watching as an obstacle, and at times it can be a challenge, but we see it as a unique strength," Snyder said. The security expert, herself a former employee of Microsoft, said that Mozilla currently enlists more than 10,000 people in regular security testing of its nightly product builds. Compared to a standard Web browser development team operating under one company's roof, the virtual legion of open-source contributors provides a far deeper pool of talent to try to assault its products to find any vulnerabilities, she said. Companies including Microsoft often point to the comparatively large numbers of bugs reported in Mozilla products by security researchers as an indicator that the technologies are less secure than their own. However, the volume of issues being uncovered in Firefox and other open-source products is actually an illustration of the high level of scrutiny such applications receive, which is more than their proprietary counterparts, Snyder maintains. Microsoft sends out a set of patches only once every month, but the virtual Firefox security testing team is helping Mozilla turnaround updates almost as quickly as it receives reports of any flaws, she said. Patching vulnerabilities as quickly as possible is a more effective approach to thwarting attacks as hackers often have longer periods of time to craft assaults on proprietary systems before they are fixed, according to the expert. Mozilla has also added real-time vulnerability updates for its users in the past year, easing the burden on people to stay abreast of any fixes on their own. "This community approach is the reason we're able to ship patches so quickly. It's more important to communicate with people and let them know what is going on versus waiting and sitting on the information," said Snyder. "If people start looking at the amount of time it takes for companies to get updates out as the best measurement of overall security versus the number of problems that may be identified, more people are going to change their minds about whether open source is indeed the most secure model." Questioned as to whether it becomes a challenge to respond to 10,000 independent security contributors helping in the review of its programs, Snyder said that an unofficial hierarchy has created itself among the people who regularly make helpful suggestions to Mozilla. "It's a challenge and an opportunity trying to do development with that many different voices, and often the most adamant people make significant contributions, but people also make points and build a consensus and ideas bubble up through the group that way," she said. "Even if it makes for more work, we think it's always better to listen to the voices of many than it is to limit the process to only a few."