Security hole found in Mozilla browser

Quote:

---

Developers at the open-source Mozilla Foundation have confirmed that the latest version of their Web browsers have a security flaw that could theoretically allow attackers to crash computers or launch unauthorized programs.
The flaw was publicized Wednesday on a security mailing list, along with a link to a fix for the problem . Updated versions of the affected software programs, which include the Mozilla, Firefox and Thunderbird browsers, have been released.

Developers said the flaw affected only Windows users, not computers running either the Macintosh or Linux operating systems

...

Mozilla developers said that future versions of the Firefox Web browser would have automatic update notifications that would make it easier to notify users about security fixes.

---

Source : http://zdnet.com.com/2100-1105_2-5262676.html
Patch : http://www.mozilla.org/security/shell.html

Well that was a quick and painless patch. Thank God for open source. MSFT still hasn't fixed a couple of known 'sploits in IE.

Quote:

---

Originally posted here by thread_killer
hank God for open source.

---

You said it. Had a discussion at work with the sysadmin today about how Opensource focuses on quality because it doesn't have the desire to make money get in the way and have them rush the product. It's really made me consider using Linux. I think I'd just go ahead and do it if I didn't game. Wish they made more games for Linux. :(

Regards,
Xierox

/edit - "Linux" not "Llinux". :rolleyes:

Would this mean that coding for windows can bring programming flaws because of how certain routines are handled? I'm only wondering in general, since we seem to have a plethora of exploits for win-based software, and nearly not as many for lin. [although Gates said otherwise].

Or is it simply that more exploits are found because windows is a more widespread system? I know it's a bit off-topic. [or a byte, if you will]

Yeah, when you have OpenSource project's that are distributed to the public, it's people like security guru's that can help to fix a problem or patch a flaw. Therefore patches come easier and problem's/exploit's solved quicker.

I couldn't agree more I have always thought that opensource was better for those reasons. I am just waiting and hopeing for Linux to turn into an industry standard so my users can abandon their Windows machines and load up some free software! Also in doing this I would be able to study the Linux Kernel more (while at work) and people wouldn't bother me.

- MilitantEidolon

I don't think things are this easy.

I think microsoft is the target for so much exploits for many reasons. One of those reasons is (indeed) the widespread system. Another reason is the (absence of) knowledge of most of its users. Windows is a very easy to use OS. Even a nitwit can use it. But they don't know when anything goes wrong. A third (but by for not the last) reason is indeed the big dollar industry behind windows.

Because linux is opensource and free, it's less a target to attacks. There are exploits in the OS, but they are fixed rather fast. Why?? - not because of the guru's but because of the open-source spirit. If Microsoft had to pay the same amount of people that are now working together on the dev of Linux, they would be bankrupt.

Quote:

---

One of those reasons is (indeed) the widespread system.

---

snatched from a post I made previously
This is a popular myth not only amoung browsers but also Operating Systems. People believe that popularity == amount of exploitation But you have to remember that even if IE is more popular, thousands upon thousands of eyes look over Mozilla and other open source projects each and every day. This doesn't just mean that the source code is in danger because of how popular it is to the linux crowd, but also that even if IE is popular on a more roundabout percentage, the smarter and brighter people of the computer world are going to be in Linux and using Open Source web browsers (on a percentage basis) but yet their code still remains more secure overall than IE. The smarter people with the power to exploit the code, choose not too.

So, it doesn't come down to popularity, or else Gnome and KDE would be riddled with holes. It comes down to how well a program is exploited. According to the way IE was coded, it is -very- easily exploited and thus why the attraction to continue exploiting it. Mozilla and Firefox, etc etc, have a history of being rock solid in terms of security and thus the less appeal to exploiting it (even though the source is secured by hand each day).

Quote:

---

Because linux is opensource and free, it's less a target to attacks.

---

Some of the most secure computer programming utilities are closed source and not free:

http://www.pgp.com/ - They started pgp, which inspired gnugp.
http://wwws.sun.com/software/solaris/ - Quite possibly the most secure OS to ever have seen the face of networking (according to statistics of %of breakins per OS).
http://www.kerio.com/kwf_home.html - One of the most indepth and configurable firewalls I've ever seen. With it's list of exploits being so few that it's #1 on vunerability security.
http://www.cisco.com/ - Some of the most reobust chipset and management software avaliable for hardware firewalls and server systems.


Closed source and free != better or more secure. It always comes down to the programers and their ethics on programming correctly and securley.

Ahem... depending to what extent you use Solaris... because I have a very legal download of Solaris 9, 3 CDs. :)

:cool: Some more info here




:mad: Damn dialup, me waits for nearly 2 hours to download Mozilla 1.7.1

Using it now and i must say that it's a nice change from IE, i like the
extra popup windows warning of sending unencrypted info over the net,
i will mess around with it to see if any issues come up, and if not adios m$ IE.....

hypronix....huh? I don't get what you were referring to at all

Quote:

---

Originally posted here by TidaLphasE23
...to see if any issues come up...

---

I use Mozilla all the time. 99% of sites work just fine with it, but the problem is, IE has been used by 95% of people for so long that a lot of Web Devs don't bother checking compatability with other browsers. (I was one until I learned differantly. :D) So for a little while, we're stuck having IE as a backup. :mad:

this might be a dumb question but what exactly is "the shell". is it the javascript console? i read that article and didnt really get the idea of how these attacks would be launched? i assume its malicious code in a web page that exploits the win xp help wizard things using some kind of file extionsion bug or something... is that right?

Quote:

---

Originally posted here by Lansing_Banda
hypronix....huh? I don't get what you were referring to at all

---

pooh sun tzu linked a number of softwares that are "closed source and not free" and one of the links was to Solaris... I just wanted to point out that Solaris does come as a free download also. [hence the mentioning of 'legal' rather than warez]

However it is not always the latest distribution that can be obtained for free [like Solaris, 10 is not free while 9 is]

phonedog- a command prompt is typically called a shell. If a hacker has a shell on your computer, that means they can run commands on your box. If you have a ssh server, then you can connect to it and get a shell on that box. If the attacker were able to exploit this flaw posted, they could install a backdoor and get a shell to work on.

Another example of a popular product that is miles ahead of most of it's less popular couterparts is Apache Web Server. Despite being the most popular product in it's category, Apache still has less exploits than say, IIS. It's been ages since Apache has had a serious exploit.

Cheers,
cgkanchi

thx for the info...
let me say... i'm happy to use

Mozilla 1.3
Mozilla/5.0 (Windows; U; Windows NT 5.0; de-AT; rv:1.3) Gecko/20030312

and i'm not clickin' install on every window coming up...

hu... it's the same when you doubleclick all the attechmentts of your email
or just downloading a unknown program and execute it.,..

well...someone would like to see the mozilla project dead.
i do not talk about exploits
but about the kind of reporting by a lot of (news )services.
fugg you , gil bates !

A seat on your wagon if I may....


To say that Open Source is just more secure by nature may not be true for every project at every stage of development; however any adolescent or matrue project is likely to become more and more secure with every release.

I devote about 10 or so hours a week combing through a certain BSD derivatives code, and code for software that may one day be ordained secure enough to join the ports collection. I enjoy scrutinizing software written in C, C++, and Assembler, and the production releases of these projects enjoy having the extra eyes, expertise and obsession to go over code again and again and again.

There are tens of thousands of dedicated nerds just like me who give this time freely for no other reason than they like to help find and fix bugs. This is the true power of Open Source in my opinion, and why it will always win in security and sustained rate of innovation.

Solaris, my favorite commercial UNIX™, was mentioned in this thread. I do have to say that although it takes a more skilled administrator to lock it down than say OpenBSD, it is well worth consideration if you want a secure, scalable, and very stable OS. Sun is slowly loosing it's death grip on the commercial Unix market to the new Linux players, but it is going to be around and in wide spread use for a long time to come simply because everyone has such a long way to go to catch up to Sun on their strongest points.

-- spurious

Quote:

---

well...someone would like to see the mozilla project dead.
i do not talk about exploits
but about the kind of reporting by a lot of (news )services.
fugg you , gil bates !

---

Why would Bill Gates really care about mozilla. If people use firefox instead of IE is it really hurting his pocket?

It might. As it was with Netscape a while back, and considering that in Europe MS was fined over $600 million for distributing Windows Media Player with Windows, there might a moment when MS might not be allowed [at least in certain parts of the world] to distribute their OS with IE.

Sure, he might make it a free download. But more and more standards will be defined by the way Mozilla works, if IE would still be closed source. It used to be that web scripting depended on what IE could display [the web is a business place, firstly]. Things could change, and new languages might ne better implemented by Mozilla in the future.

Using another browser besides IE is not going to hurt "Bill's pockets" one bit. The OS is still on 95% of the worlds PC's, and having another browser just gives M$ more time to fix the one he has, while you explore a open source browser. It is when people start to explore open source operating systems is when his pockets will get a little lighter.

You didn't get what I was going at. IE is on so many computers because it ships with the OS. If that will not happen anymore, people will be looking on their own at what browsers to use. And open source projects will have better support and a higher popularity.

But this is theoretical and off-topic.