RSSFirefox Patched for Netscape-Era Flaw
By David Worthington | Published March 23, 2005, 7:59 PM
The Mozilla Foundation has preemptively patched its Firefox Web browser to guard against attacks that could conceivably exploit a hole in Netscape-era legacy code.
The code was used by Netscape engineers as a method to animate GIFs, but lacks protection against specially crafted images that can be used to execute arbitrary code. The exploit was first disclosed by Internet Security Systems.
"To deliver our users the experience they deserve, we must stay ahead of the curve in patching potential vulnerabilities," said Chris Hofmann, director of engineering for the Mozilla Foundation.
"For example, the bug patched in this update has no known real world exploits, and we were able to provide a quick response."
The previous point release of Firefox, version 1.01, inoculated users against potential security threats and included a workaround for a well publicized spoofing vulnerability stemming from the browser's implementation of the Internationalized Domain Names (IDN) standard.
This week, security Researchers at Symantec published a biannual Internet Threat Report that tabulated a total of 21 vulnerabilities, seven of which were deemed "critical," in Mozilla-based browsers in the second half of 2004. Microsoft's Internet Explorer browser suffered nine critical bugs during that time.
It does'nt matter if it's IE, FireFox, Opera, Marathon or what ever browser your using. They are software written and will ALWAYS have holes in them, regardless of what anyone tells you or what they issue in press releases.
The more they patch them the more people will try to exploit them.
I've been patching the patches that were suppose to patch the patches on alot of software but the idiots that seems to have more time on their hands than money keep creating havoc with software written for net access and this will continue, since it is human nature to screw your fellow man.
Score: 0
|I like FF and IE they have their points. As it has been said FF is or was only secure due to the fact that it' is still new. Now that is outdated. FF is not secure as we all knew it would not stay. I still use it for some things and IE for others. [Edit] I base it on this artical,"This week, security Researchers at Symantec published a biannual Internet Threat Report that tabulated a total of 21 vulnerabilities, seven of which were deemed "critical," in Mozilla-based browsers in the second half of 2004. Microsoft's Internet Explorer browser suffered nine critical bugs during that time."[/Edit]
Score: 0
|What do you mean it's outdated? Mozilla releases updates to "possible" issues, BEFORE they are an actual problem.
Score: 0
|You mean 'not secure' as in 'my computer has ground to a halt with spyware and adware'? Not likely.
Score: 0
|The only reason firefox is still as "secure" as it is, is due to the fact that its still not as widely popular as IE. Once firefox hits the popularity levels of 30% or more usage on the internet, then you will see people attempting to exploit it more, and find ways to get stuff installed through the browser. Believe me, if IE was used by only 10-15% of the market, do you think there would be so much attention paid to its security? No, because it wouldnt be worthwhile to hack it, the same goes for any browser
Score: 0
|Obviously you are right about the amount of effort put into hacking Firefox right now. However, the outcome we can only speculate in right now. Only time will tell what will really happen. My money's on /not a lot/.
Score: 0
|Not as secure.... And exactly what are you basing this on? The largest security fault by far with IE is ActiveX...which WILL NOT RUN in FireFox.
Adware and spyware installing through your browser is another huge issue with IE. In FireFox, you must first allow the site to be included in your list of sites allowed to install software, and then you have to click 'install' when something actually does try to install. They won't be able to sneak it by you.
IE reacts to exploited security risks. We've seen it happen over and over again. FireFox prevents possible security risks BEFORE they are exploited.
Yes, FF is still 'new', and I am sure there are ways around some of the built-in protections. But they have touted the fact that FF is more secure than IE...have marketed the product based on these claims, and have shown, so far, that they intend to do whatever is necessary to make good on these claims.
If someone, anyone, can prove to me they got a rootkit through FF, I'll give it some serious thought, but until then, I will use FF exclusively on my systems and suggest to ANYONE that they do the same. Using IE at this point in time is begging for trouble...end of story.
(background to the above statement: My wife used IE exclusively. Despite my attempts to safegaurd her system via NAT routing, Firewall, and NOD32AV, She still managed to get Rootkit infections as well as tremendous amounts adware infestations. The count since I forced the issue with FF? Zero. And I have disabled the firewall, though the NAT gateway is still firewalled.)
Score: 0
|Microsoft does patch to prevent attacks you just never hear about it because they don't use it to promote their browser. I'm willing to bet IE7 is going to blow people away.
Score: 0
|I'm willing to bet IE isn't going to rock anyone's world. In fact, I'm willing to bet we'll be disappointed, yet again.
Tabbed browsing?...been there, done that...in IE, even.
Ad-Blocking/Pop-Up blocking? Doubtful. Especially when it comes to MSN.
More secure? Possibly...IF they drop ActiveX completely. Not going to happen. Secure? Yeah, maybe by their definition.
I have yet to hear one thing about IE7 that is either innovative, or hasn't been done to death by a host of others. MS has been dragging their heels since IE4 with their browser and this will simply be another example.
Score: 0
|They could arguably (theoretically?) drop activex support. The .NET CLR is becoming more mature and would be the best way to deliver content / functionailty within the ie browser. Security with .NET applets is easier to maintain than with activex controls.
I love these frivolous browser debates...
Score: 0
|Right. It's like if Apache were more used than IIS it'd be less secure. ... Wait, Apache *is* vastly more used than IIS and is far more secure.
Score: 0
|Avant browser is based of IE, but u can disable ActiveX. And many other things, like remote scripts etc... It has a great pop up blocker, and many other features, it's worth giving it a try before judging it. O ya and its extreamly FAST! http://www.avantbrowser.com
Score: 0
|And it STILL uses the crap IE engine... so even once it's secured, it's still outdated and gutless.
Score: 0
|Who cares what engine it uses; get a better firewall if you're worried about getting hacked! I have personally never got hacked using IE, AVANT, or FIREFOX, I use all 3 of them, just depending on what site I’m visiting and which browser I feel like using... and if u get a virus, that’s what anti-virus software is for.
Score: 0
|good point,
Excellent point!
Score: 0
|The point about the engine had nothing to do with getting hacked or security...
IE is inherently less secure, but that's moot - it CAN be secured, and when combined with being secured, firewall, anti-spyware, and anti-virus software, it's not unsafe. (nevermind that none of that software should be required to have a safe computing experience)
The problem with the engine is it has the least support for advanced DHTML, HTML, and CSS of any modern browser, and an awful DOM implementation.
Making it secure, hooking the engine into "Maxthon" or "Avant" or whatever you hook it into doesn't make it more or less of a piece of crap.
Score: 0
|Obviously there is more patching up to do!!! Sticking with FF until IE can show me that I won't get adware or spyware on my box when using it.
Score: 0
|So, your saying that even before IE became such a security issue there was never a point to a firewall or an antivirus suite? Boy have you been misinformed. Viruses existed well before the advent of IE's security flaws, as have antivirus products (I remember the old dos based MS antivirus, or norton antivirus 8.0 for dos) and firewalls have been used by corporations for years and have come to the home user because creating an os that functions the way users want it to requires a lot of new code which can potentially be exploited. Even if you test the code for 100 years, it will still end up with a security hole, its inevitable. Human beings arent perfect, thats why they put erasers on pencils, so how can you expect code to be? I hate to say it, but even the beloved firefox or opera or linux or whatever you all clammer about, isnt as robust as its made out to be.
Score: 0
|Excuse me?
People assume a lot of s*** around here, and do a lot of speculation based on pure assumption.
If an OS were properly secured, you wouldn't need to run a full security suite to connect to the internet. Just for kicks, I connected a clean install of Windows XP SP2 to the internet, in the default configuration - using the Windows XP firewall, and Internet Explorer. I did a google search for "naked chicks" and clicked the first 3 links that came up, and wandered around a bit.
After 5 minutes, I unplugged the network cable, and attempted to install anti-virus software.
It wouldn't install.
I tried to install a different firewall.
It wouldn't install.
I pulled the hard drive, and installed it as a slave in another (properly secured) machine.
It had 8 different viruses and almost 1000 pieces of spyware. 5 Minutes.
Anyone who says SP2 is secure is an idiot.
What I said was - you SHOULDN'T need to install a firewall, antivirus, and antispyware before it's safe to connect to the internet.
Microsoft's internet connection wizard doesn't mention anything about the firewall being inadequate to protect you from attacks - but obviously it is.
So, just for kicks, I connected a clean install of Ubuntu Linux to the net.
In the default configuration, I loaded up Firefox, and did a search for naked boobies, and surfed around for 20-30 minutes.
Nothing.
No poups, no spyware, no hackers, no problems.
And all this with no anti-virus, a light firewall, and no anti-spyware.
Did you know that McAfee actually designed the first viruses, so they could sell their anti-virus software?
It seems that Windows is likely full of holes by design - if it was perfect, they'd never make any money off upgrades, and they wouldn't create a market for their partners either...
Score: 0
|Stop trying to console yourself with that BS. Everyone know's it just an excuse for IE to be lousy.
Score: 0
|Wow, nice argument ;-) Why dont you try actually proving your theories
Score: 0
|So, your telling me you visited findarticles.com, a livejournal, and one actual porn site? Funny, I just visited the same sites on a VANILLA XP installation (Thats right, NO SP2), and guess what, not one infection that you claim to get. I surfed around the porn site for about 20 minutes, and didnt get hit with a single thing (aside from the RPC bug). Only spyware detected was a bunch of tracking cookies which I dont even consider spyware, why? because none of the spyware scanners do this check for any alternate browsers such as firefox or opera, i guess they think those cookies are safe for alternate browsers to have ;-)
http://www.google.com/se...l=en&q=naked+chicks
Crazy Naked Chicks Free Naughty Pictures And Movies... Crazy Naked Chicks Archives. ... old Webmasters: Trade/Submit © 1998-2004 Crazy Naked Chick Naked Chicks favorite search places google | yahoo. ...
www.crazynakedchick.com/ - 99k - Mar 23, 2005 - Cached - Similar pages
free moustache handlebar rides' Journalwww.livejournal.com/community/spokes_n_chains/ - Similar pages
Ziff Davis Smart Business: 40 Million Naked ChicksFull text of the article, '40 Million Naked Chicks' from Ziff Davis Smart Business, a publication in the field of Computers & Technology, is provided free of ...
www.findarticles.com/p/articles/ mi_zdzsb/is_200206/ai_ziff26382 - 20k - Mar 23, 2005 - Cached - Similar pages
By the way, what viruses were reported, Just curious :) and with what antivirus did you scan because they ALWAYS produce a report that I would like to see you post here :) Also guess what, after visiting these sites, My A/V installed just fine, in fact all 4 of the ones I tried installed fine, so did 3 different Anti-spyware utilities. Also, I must say, you showing that you can hook up a linux box and not be hacked, wow, total genious. Lets put a box on the net that 90% of people arent gonna successfully exploit using a microsoft windows hack :) Good job, you really proved me wrong! *Hooks up his gentoo box to see if he can get it to not be infected with the RPC exploit, or any of the various IE exploits, or even get a linux spyware program to install*.
No one develops spyware for linux, why, because how many people run linux at home? about 2%, so if your going to try and prove someone wrong, do it with something that actually makes a legit comparison and include some sort of data from your investigations to prove it. Anyone can easily say they did something, but providing the proof is another thing.
Score: 0
|