Members
  • Total Members: 12816
  • Latest: t114563
Stats
  • Total Posts: 28524
  • Total Topics: 8240
  • Online Today: 900
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: New zero-day bugs crop up in IE, Firefox  (Read 1520 times)

0 Members and 1 Guest are viewing this topic.

Amker

  • SCF Global Moderator
  • *****
  • Posts: 1081
  • KARMA: 22
  • Gender: Male
    • SCforum.info
New zero-day bugs crop up in IE, Firefox
« on: 08. June 2007., 20:44:15 »
A noted security researcher disclosed four new zero-day vulnerabilities in Microsoft and Mozilla's browsers, including a critical flaw in Internet Explorer (IE) and a major bug in Firefox.

Michael Zalewski, who regularly publishes browser flaw findings, posted details on the full-disclosure mailing list for cookie-stealing, keystroke-snooping, malicious downloading and site-spoofing bugs.

The most serious of the four, said Zalewski, is an IE6 and IE7 flaw he rated "critical." Dubbing it a "bait-and-switch" vulnerability, he said that the Microsoft browser gives hackers a window of opportunity to run malicious Javascript to hijack the PC.

"The entire security model of the browser collapses like a house of cards and renders you vulnerable to a plethora of nasty attacks," Zalewski claimed in notes that accompanied a demonstration of the IE bug. Up-to-date IE6 and IE7 are both at risk, he said, although Firefox is not.

But Mozilla's browser also suffered at Zalewski's hands. A new IFrame vulnerability in Firefox 2.0 can let attackers plant keyloggers or drop malicious content into a legitimate web site. The flaw, rated as "major," is related to a similar bug discovered last year; although Mozilla patched that problem, Zalewski said the fix hadn't plugged all the holes.

Zalewski posted information about two other bugs, both rated "medium." A Firefox vulnerability could lead to unauthorised downloads, while IE6 is open to yet another address bar-spoofing flaw. "IE7 is not affected because of certain high-level changes in the browser," Zalewski said of the fourth vulnerability.

Mozilla is aware of both Firefox bugs — they have been posted to its Bugzilla management system — and a Microsoft spokeswoman said the company's security team is looking into Zalewski's claims. "Upon completion of this investigation, Microsoft will take the appropriate action, which may include issuing a security advisory or providing a security update," she added.

Microsoft also said it knows of no ongoing attacks using the vulnerabilities.
# Online Anti-Malware Scanners: http://scforum.info/index.php/topic,734.0.html

Samker's Computer Forum - SCforum.info

New zero-day bugs crop up in IE, Firefox
« on: 08. June 2007., 20:44:15 »




 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising