Tag Archives: critical

Firefox Update (3.6.12) Fixes Zero Day Vulnerability

image

Yesterday, we reported on a critical zero day vulnerability in both Firefox 3.5, and Firefox 3.6., which could have allowed remote code execution in the Browser.

Mozilla jumped on this issue immediately, and has provided a fix by releasing Firefox version 3.6.12. Firefox 3.5 users, can ensure protection is in place against this vulnerability by updating to version 3.5.15.

If you haven’t updated your version of Firefox yet, then go to Help – Check for updates. Not all users allow automatic updates and installation – I’m one, as the following graphic illustrates. However, I do allow the update to download.

image

For an overview of Browser security add-ons you should consider installing, read – An IT Professional’s Must Have Firefox and Chrome Add-ons, here on this site.

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

8 Comments

Filed under Application Vulnerabilities, Browsers, cybercrime, Don't Get Hacked, downloads, Firefox, Freeware, Malware Advisories, Online Safety, Software, Windows Tips and Tools

Firefox 3.6.3 Released – Fixes Critical Security Issue

image If you don’t have Firefox’s automatic update feature turned on, then you need to manually update your version immediately, to Version 3.6.3.

According to Mozilla “A memory corruption flaw leading to code execution was reported by security researcher Nils of MWR InfoSecurity during the 2010 Pwn2Own contest.” Apparently, this exploit only affects Firefox 3.6 and not earlier versions.

Since Browser vulnerabilities operate as a prime gateway for malware, immediate updating is strongly recommended.

Some time back, I took a running shot at Firefox (this was one of my very infrequent “the glass is half empty” days), when I wrote here, “For the umpteen time, in just a short time frame, Mozilla has released a patched version of Firefox ….. this is a continuing saga with Firefox and its not getting better. If anything, its getting worse.”

I felt justified in chastising Mozilla for what I perceived to be, a series of continuing flaws in Firefox, leading to very frequent updates. Until, that is, I received an email from Mozilla’s Christopher Blizzard, in which he pointed out the following –

“Our goal is to try and update as quickly as possible to get fixes into user’s hands. Sometimes this means that we update frequently. As an example 3.5.1 was turned around in 48 hours from the release of an proof of concept exploit. And we had no warning before it was public.

So we worry about the time-to-fix as opposed to the number or frequency of releases. Firefox’s userbase happens to update pretty quickly when we release an update and this often means that our users are also the safest.

The faster you can get fixes into people’s hands, the less likely they are to run into something that’s exploitable.”

We also schedule releases every few weeks to fix known problems and fix non-severe and non-critical security fixes. But sometimes we get something that causes us to release early.”

Christopher’s sensible explanation removed a certain anxiety, and a sense of worry, that I would have to give up my beloved FF, and my stable of crucial add-ons.

To paraphrase Winston Churchill – “This was not my finest hour”. In fact, my tech friends are still laughing at me over that one.

If you have ever questioned Firefox’s frequent update history, then consider Christopher’s closing statement –

“I would point out that all browsers have security problems. And it’s how you respond to them that counts. So that’s why you’re seeing frequent updates from us.”

If you found this article useful, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

15 Comments

Filed under Browsers, cybercrime, Don't Get Scammed, Don't Get Hacked, downloads, Firefox, Freeware, Online Safety, Software, Windows 7, Windows Vista, Windows XP

Avoid Drive-by Downloads – Update Firefox to Version 3.5.4 Now

firefox If you don’t have Firefox’s automatic update feature turned on, then you need to update your version immediately to Version 3.5.4.

Reports indicate that previous versions are subject to 11 critical security issues, including the risk of drive-by downloads. Drive-by downloads can include the installation of spyware, a virus, or other nasties, which can take place by simply visiting a web site, opening an e-mail, or by dealing with a popup.

According to Mozilla the following security issues have been dealt with in the release of Version 3.5.4.

MFSA 2009-64 Crashes with evidence of memory corruption (rv:1.9.1.4/ 1.9.0.15)
MFSA 2009-63 Upgrade media libraries to fix memory safety bugs
MFSA 2009-62 Download filename spoofing with RTL override
MFSA 2009-61 Cross-origin data theft through document.getSelection()
MFSA 2009-59 Heap buffer overflow in string to number conversion
MFSA 2009-57 Chrome privilege escalation in XPCVariant::VariantDataToJS()
MFSA 2009-56 Heap buffer overflow in GIF color map parser
MFSA 2009-55 Crash in proxy auto-configuration regexp parsing
MFSA 2009-54 Crash with recursive web-worker calls
MFSA 2009-53 Local downloaded file tampering
MFSA 2009-52 Form history vulnerable to stealing

If you enjoyed this article, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

6 Comments

Filed under Application Vulnerabilities, Browsers, Don't Get Scammed, Don't Get Hacked, downloads, Firefox, Freeware, Malware Advisories, Software, Tech Net News, Viruses, Windows Tips and Tools

ANOTHER Firefox Patch – Update Now!

Mozilla likes to advertise Firefox as “The faster, more secure, and fully customizable way to surf the web”. Obviously, Mozilla doesn’t subscribe to the principle of truth in advertising.

In the first place Firefox is NOT the fastest browser available; it may be the most customizable, but it is a long way from being the most secure.

Until recently, any mention of Internet Explorer’s safety record, amongst my techie friends, was sure to draw a huge round of laughter when compared with Firefox’s record. But, no longer.

For the umpteen time, in just a short time frame, Mozilla has released a patched version of Firefox – this one is version 3.5.2, to address the following issues:

Fixed in Firefox 3.5.2

MFSA 2009-46 Chrome privilege escalation due to incorrectly cached wrapper
MFSA 2009-45 Crashes with evidence of memory corruption (rv:1.9.1.2/1.9.0.13)
MFSA 2009-44 Location bar and SSL indicator spoofing via window.open() on invalid URL
MFSA 2009-43 Heap overflow in certificate regexp parsing
MFSA 2009-42 Compromise of SSL-protected communication
MFSA 2009-38 Data corruption with SOCKS5 reply containing DNS name longer than 15 characters

In just over a month, since the release of version 3.5, we have had to download and install two patched versions due to severe, or critical, security issues. I’m not laughing; this is a continuing saga with Firefox and its not getting better. If anything, its getting worse.

The only thing that keeps this unreliable browser on any of my systems is the add-ons.  Without this customizing ability, Firefox – you’d be gone!

If you haven’t updated yet, I strongly urge you to do so.

If you enjoyed this article, why not subscribe to this Blog via RSS, or email? It’s easy; just click on this link and you’ll never miss another Tech Thoughts article.

25 Comments

Filed under Browsers, Don't Get Hacked, Firefox, Freeware, Internet Safety, Internet Security Alerts, Open Source, Software, Windows Tips and Tools

Windows Patch Tuesday – April 2009

Microsoft released 8 security bulletins on Tuesday (April 14, 2009) to fix remote code execution and denial of service vulnerabilities.

windows_generic_v_web We have always recommended, on this site, that users ensure that Windows Automatic Update is enabled as a major step in maximizing operating system security.

It is not an overstatement to say; an unpatched Windows system is an invitation to disaster.

If you have updates enabled, patches will be downloaded routinely. Careful users will verify that patches, have, in fact, been applied.

If Windows Automatic Update is not enabled on your system, then you should logon to the MS update site and download and apply these patches immediately.

Vulnerability issues and the corresponding patches:

MS09-010/KB923561 – Important (XP, 2000, 2003): There are four bugs (two previously disclosed publically, two previously undisclosed) that affect a variety of word processing documents, that can allow remote code execution exploits to occur.

MS09-011/KB961373 – Critical (XP, 2000, 2003): This patch closes a hole that let attackers execute a remote code execution attack through MJPEG files; the bug is in DirectX 8.1 and 9.0x.

MS09-012/KB952004/KB956572 – Important (XP, Vista, 2000, 2003, 2008): This patch resolves four holes in Windows that have already been publically disclosed. The hole allows an attacker who is already logged onto the system to escalate their privileges and take full control of the system.

MS09-013/KB960803 – Critical (XP, Vista, 2000, 2003, 2008): This patch addresses three bugs in the Windows HTTP Services system; one of them allows remote code execution which allows an attacker to completely own a system. This is a “must patch” item for all Windows systems.

MS09-014/KB963027 – Critical (XP, Vista, 2000)/Important (2000, 2003): This is a cumulative security update for Internet Explorer 5, 6, and 7. Some of the fixes address already public bugs, some deal with privately disclosed exploits. You should install this patch immediately. Users with IE8 do not need this patch.

MS09-015/KB959426 – Moderate (XP, Vista, 2003, 2008)/Low (2000): This patch takes care of a problem with the Windows Search Path function that could enable an escalation of privileges.

6 Comments

Filed under Application Vulnerabilities, Don't Get Hacked, Malware Advisories, Microsoft Patch Tuesday, Spyware - Adware Protection, Windows Tips and Tools

Massive Patch Tuesday – 28 Vulnerabilities Patched

There are currently 28 vulnerabilities in unpatched Microsoft Windows, Internet Explorer and Microsoft Office, that could allow cyber-criminals to launch malicious attacks on your computer.

On Patch Tuesday, December 9, 2008, Microsoft released security patches to address these issues.

Vulnerability issues and the corresponding patches:

MS08-070 (critical; 6 vulnerabilities fixed): This update resolves five privately reported vulnerabilities and one publicly disclosed vulnerability in Visual Basic 6.0 Runtime Extended Files (ActiveX Controls), which could allow remote code execution if a user browsed a Web site that contains specially crafted content.

MS08-071 (critical; 2 vulnerabilities fixed): This update resolves two privately reported vulnerability in Windows, which could allow remote code execution if a user opens a specially crafted WMF image file.

MS08-072 (critical; 8 vulnerabilities): This update resolves eight privately reported vulnerabilities in Microsoft Office, which could allow remote code execution if a user opens a specially crafted Word or Rich Text Format (RTF) file.

MS08-073 (critical; 4 vulnerabilities fixed): This update resolves four privately reported vulnerabilities in Internet Explorer, which could allow remote code execution if a user views a specially crafted Web page using Internet Explorer.

MS08-074 (critical; 3 vulnerabilities): This update resolves three privately reported vulnerabilities in Microsoft Office, which could allow remote code execution if a user opens a specially crafted Excel file.

MS08-075 (critical; 2 vulnerabilities): This update resolves two privately reported vulnerabilities in Windows, which could allow remote code execution if a user opens and saves a specially crafted saved-search file within Windows Explorer or if a user clicks a specially crafted search URL.

MS08-076 (important; 2 vulnerabilities): This update resolves two privately reported vulnerabilities in Windows, which could allow remote code execution.

MS08-077 (important; 1 vulnerability): This update resolves one privately reported vulnerability in Microsoft Office SharePoint, which could allow elevation of privilege if an attacker bypasses authentication by browsing to an administrative URL on a SharePoint site. A successful attack could result in denial of service or information disclosure.

It is not an overstatement to say; an unpatched Windows system is an invitation to disaster. If you have Windows Update turned on you’re covered, if not, I highly recommend that you download manually immediately.

Updated December 12, 2008:

The details being published about this weeks IE 0-day is incorrect and
insufficient to protect users, read more:
http://secunia.com/blog/38/

The updated Secunia Advisory is available here:
http://secunia.com/advisories/33089/

1 Comment

Filed under Application Vulnerabilities, Don't Get Hacked, Interconnectivity, Internet Safety, Malware Advisories, Microsoft Patch Tuesday, Spyware - Adware Protection, Windows Tips and Tools

FireFox Full of Critical Security Holes – Update to Version 3.0.4 Now!

Mozilla has just released FireFox 3.0.4 which fixes eleven security issues discovered in FireFox version 3.0.3.

These issues run from high (critical), to moderate, and include the risk of illegal code execution, the possibility of personal information being exposed, and denial-of-service attacks.

If you haven’t already updated to version 3.0.4, it is critical that you do so now to ensure the integrity of your computer and to safeguard your personal and financial information.

The following are the vulnerabilities involved and the risk attached to each as per the Mozilla web site.

Critical vulnerabilities patched:

– MFSA 2008-55 Crash and remote code execution in nsFrameManager. A vulnerability in part of Mozilla’s DOM constructing code can be exploited by modifying certain properties of a file input element before it has finished initializing. When the blur method of the modified input element is called, uninitialized memory is accessed by the browser, resulting in a crash. This crash may be used by an attacker to run arbitrary code on a victim’s computer.

– MFSA 2008-54 Buffer overflow in http-index-format parser. This is a flaw in the way Mozilla parses the http-index-format MIME type. By sending a specially crafted 200 header line in the HTTP index response, an attacker can cause the browser to crash and run arbitrary code on the victim’s computer.

– MFSA 2008-53 XSS and JavaScript privilege escalation via session restore. The browser’s session restore feature can be used to violate the same-origin policy and run JavaScript in the context of another site. Any otherwise unexploitable crash can be used to force the user into the session restore state. This vulnerability could also be used by an attacker to run arbitrary JavaScript with chrome privileges.

– MFSA 2008-52 Crashes with evidence of memory corruption. Mozilla developers identified and fixed several stability bugs in the browser engine used in FireFox and other Mozilla-based products. Some of these crashes showed evidence of memory corruption under certain circumstances and we presume that with enough effort at least some of these could be exploited to run arbitrary code.

Two vulnerabilities rated as a high security risk have been patched:

MFSA 2008-57 -moz-binding property bypasses security checks on codebase principals

MFSA 2008-56 nsXMLHttpRequest::NotifyEventListeners() same-origin violation

The following vulnerabilities rated as a moderate security risk have also been patched:

MFSA 2008-51 file: URIs inherit chrome privileges when opened from chrome

MFSA 2008-47 Information stealing via local shortcut files

MFSA 2008-58 Parsing error in E4X default namespace

4 Comments

Filed under Browsers, Don't Get Hacked, Firefox, Freeware, Interconnectivity, Internet Safety, Internet Safety Tools, Malware Advisories, Online Safety, Safe Surfing, Software, Spyware - Adware Protection, System Security, Windows Tips and Tools