Browser blame game continues over Windows zero-day flaw
243487
The debate over who's at fault for a Windows zero-day vulnerability continues, with Microsoft saying it's not responsible for the issue and Mozilla making plans to patch Firefox -- even though it accepts no blame for the flaw either.
435582
Blog: Updates address some critical vulnerabilities in the popular browser.
268907
Microsoft is investigating reports of a serious security flaw in Internet Explorer, but has not yet seen malicious code that exploits the reported flaw, the company said today.
86025
An Internet Explorer vulnerability first reported yesterday is already getting a workout. Malware utilizing the hole for installation is turning up on various Russian porn sites, with more trouble expected.
567801
A newly found vulnerability in Microsoft's Internet Explorer browser could allow an attacker to take over a targeted machine -- even one with all its patches up to date.
95664
A attack on Windows machines that uses Internet Explorer and a vulnerability in a RealPlayer ActiveX control is spreading in the wild, and researchers say the situation is urgent.
145367
(InfoWorld) - In a public mea culpa, Mozilla's chief security officer acknowledged Monday that Firefox includes the same flaw that the company called a "critical vulnerability" in Internet Explorer during a two-week ruckus over responsibility for a Windows zero-day bug. "Over the weekend, we learned about a new scenario that identifies ways that Firefox could also be used as the entry point," said Window Snyder of Mozilla. "While browsing with Firefox, a specially crafted URL could potentially be used to send bad data to another application. "We thought this was just a problem with Internet Explorer," Snyder continued. "It turns out, it is a problem with Firefox as well." The argument over responsibility for a flaw that involved both Internet Explorer and Firefox began two weeks ago when Danish researcher Thor Larholm argued that Internet Explorer contained an input validation bug that passes potentially malicious URLs to other applications. Larholm called out Firefox's "firefoxurl://" protocol as one that Internet Explorer mishandled. He staked out the position that Internet Explorer was to blame, while other security experts said it was Firefox's fault. As fingers pointed, Mozilla patched the Internet Explorer-Firefox interaction bug by releasing an update, Version 2.0.0.5. Even so, Snyder and others continued to argue that Internet Explorer was the problem. "Microsoft needs to patch Internet Explorer," Snyder said last Wednesday. That same day, Asa Dotzler, director of community development, contrasted what he said were the differences between Microsoft and Mozilla on the bug. "We think it's Firefox's job to ensure that users are protected from malicious Web sites when they're surfing the Web in Firefox. Apparently, Microsoft doesn't think the same for Internet Explorer," Dotzler said then. Friday, Jesper Johansson, a former Microsoft security strategist but now a security program manager at Amazon.com, spelled out how Firefox was as guilty as Internet Explorer of failing to validate input. In a post that leaned on the metaphor of "glass houses," Johansson showed how Firefox passes potentially malicious URLs to other applications, including the multiple-service instant messaging client Trillian. "Firefox is subject to the exact same flaw that they blame on Internet Explorer. Firefox also does not escape quotes in URLs before it passes them on to protocol handlers," he said. Snyder did not credit Johansson by name for alerting Mozilla to the Firefox bug, but she admitted that the flaw should have been spotted. "We should have caught this scenario when we fixed the related problem in 2.0.0.5," she said. She did not specify when a patch would be issued, but one is in the works, according to an entry in Bugzilla.
68810
Rare, out-of-cycle Windows patch fixes one flaw, but attacks through other known, yet-to-be-plugged holes continue.
47409
Mozilla works to fix a Firefox browser flaw that could give attackers unauthorized access to data on a victim's PC.
753365
(InfoWorld) - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update. No, that's not a typo, just the strange fall-out from an unusual bug that had security researchers debating the question this week, "Who's to blame? Microsoft or Mozilla?" Security researcher Thor LarholmÂ kicked off the controversy on Tuesday, claiming that he had discovered a flaw that would let an attacker run commands on a victim's PC. In his blog posting, Larholm said the bug was similar to a flaw he'd discovered last month in Apple's Safari 3.0 beta software, and he called it an an "input validation flaw in Internet Explorer." The problem is with a URL protocol handler component of Internet Explorer, he said. This software allows Internet Explorer users to launch applications such as Excel or Firefox by clicking on specially written links on Web pages. When Internet Explorer clicks on a link that launches the Firefox browser, however, the software does not properly check its syntax, and that, Larholm said, lets an attacker create a malicious link, that could be used in an attack. Security vendor Secunia ApS rates the flaw as "highly critical." So while the flaw affects Internet Explorer users, it appears to be a risk only to those who already have Firefox installed. And to make matters more complicated, if a Firefox user were to click on one of the specially written links, he would not be affected. Still, Microsoft Security Program Manager Mark Griesi said that the bug was not his company's problem. "We don't feel that there's an issue in IE and therefore there's nothing to be fixed," he said Tuesday. With Microsoft saying it won't fix the vulnerability, Mozilla said it would change the way its Firefox URL protocol handler worked in its next Firefox update. That will fix Larholm's bug, but Mozilla security strategist Window Snyder wouldn't say whether or not she considered the vulnerability to be an IE or Firefox problem. She did, however, point out that without Microsoft making changes to IE, other Windows programs may be at risk. Noted browser bug-hunter Aviv Raff wrote in his blog that he thought both Microsoft and Mozilla were to blame. But another security expert said that the responsibility to fix the problem lies with the open-source browser developers. "This is an oversight in how Mozilla decided to construct their protocol registration, and how they do input validation between this handler and their application," said Eric Schultze, chief security architect with Shavlik Technologies, via e-mail. "I think Mozilla needs to write and release a patch for this issue and Microsoft can take the week off."
620094
roundup Free-roaming source code breeds new Netsky pest. Also: From IE to Opera, browsers are a likely prey.
115827
Blog: Critical security flaw found in Firefox 2.0 and later versions potentially puts users' systems at risk of a remote attack.
298762
Microsoft's IE (Internet Explorer) browser has an unpatched vulnerability that could let hackers hijack, then access, Google Gmail accounts, a California security company warned Monday.IE, said Santa Clara-based Cenzic in an alert issued Monday, contains an unspecified cached files bug that, when combined with a cross-site request forgery flaw in the Web-based e-mail service, exposes Gmail account sign-ons and lets others access those accounts and any messages or file attachments there.Although not a bug that can be leveraged remotely -- an attacker must have local, physical access to the PC -- as Cenzic pointed out in its alert, there are scenarios where that's not a limitation. "These vulnerabilities could be exploited such that all users of a shared computer who use Internet Explorer and share a user account -- a common practice at computer kiosks in a library or Internet cafe -- could be vulnerable," said Cenzic.Gmail contributes to the overall vulnerability because its URLs display attachments when viewed using the "View Source" command, the warning went on. IE, however, sports "improper use of caching directives [and] incorrect access checks on cached Internet Explorer files."Together, the bugs could conceivably let someone at a public PC hijack any Gmail log-on credentials that had been entered on the machine since the IE cache had last been purged. IE deletes the contents of its cache only as new files are added -- and the oldest are deleted -- or when the user explicitly instructs the browser to clear the cache using the "Delete Browsing History" command.Microsoft denied that IE even has a bug. "Microsoft has thoroughly investigated the claim and found that this is not a product vulnerability," said a company spokesman Tuesday morning. "In the scenario in question, an attacker would need authenticated access to the system in order to modify files located in the cache. With that level of access, an attacker could install malicious programs that would have more impact than the scenarios described."While true, that did not address Cenzic's scenario; by design, public PCs such as those in libraries, schools or Web cafes do not require authentication to access. Microsoft was not available for clarification.Google did not immediately respond to questions about Gmail's part in the threat
490340
Browser beware Security experts are crying foul over a new supposedly secure browser application.â¦
63078
Security researchers have discovered another vulnerability in Windows XP Service Pack 2, but it doesn&#39;t appear to be an immediate threat.
395103
The emergence of a new Internet virus targeting a Microsoft Windows security flaw could cause more damage than usual because the company&#39;s system for fixing the problem is so complex that many
235692
Microsoft's recent set of security patches is causing problems, namely for Internet Explorer 6 users, who are watching their browsers crash midstream when visiting some sites. Redmond has offered a technical workaround to solve the problem until a more formal fix can be developed.