Patched Firefox 'still vulnerable'
A patched version of Mozilla's Firefox browser released on Friday isn't quite
as watertight as it should be, according to a security researcher.
On Friday, shortly after Mozilla released a patch for a high-profile directory-traversal
flaw - along with nine other patches - Dutch programmer Ronald van den Heetkamp
posted proof-of-concept code which he claims shows that the bug is still exploitable.
The original bug could be exploited when Firefox was running any of more than
600 add-ons to steal "session information, including session cookies and
session history," according to Mozilla, which ranked it as "high"
severity.
But the patch that arrived on Friday only fixes "50 percent" of the
problem, according to van den Heetkamp.
"I found another information leak that is very serious because we are
able to read out all preferences set in Firefox, or just open or include about
every file stored in the Mozilla program files directory, and this without any
mandatory settings or plugins," he wrote in an advisory.
He said the attack vector had only taken "a couple of minutes" to
come up with, and that other similar holes could remain.
Among Friday's 10 Firefox patches were three for critical vulnerabilities,
which could allow an attacker to read sensitive information, bypass certain
security restrictions, conduct spoofing attacks, or compromise a user's system,
according to Mozilla.
» posted by abennett
Techworld.com
Symantec Backup Exec 12 and Backup Exec System Recovery 8 deliver industry leading Windows data protection and system recovery. Download this whitepaper to find out the top reasons to upgrade and how to get continuous data protection and complete system recovery.
Data and system loss — from a hard drive failure, malicious attack, natural disaster, or simple human error — can happen anytime. Don’t leave your business vulnerable. Make sure you have a secure recovery strategy in place. Symantec's latest backup and system recovery technology can efficiently restore critical applications, individual emails and documents and even restore your entire system in minutes in the event of a loss.
Businesses face a growing challenge to ensure that the IT environment is properly protected. Backup Exec 12 integrates with other applications in the Symantec family of products, to complement your current data protection strategy, keep your data securely backed up and make it recoverable when you need it most.
Crimeware: Understanding New Attacks and Defenses
By Markus Jakobsson, Zulfikar Ramzan
Published Apr 6, 2008 by Addison-Wesley Professional. Part of the Symantec Press series.
Enter now! | Official rules | Sample chapter
Securing VoIP Networks: Threats, Vulnerabilities, and Countermeasures
By Peter Thermos, Ari Takanen
Published Aug 1, 2007 by Addison-Wesley Professional.
Enter now! | Official rules | Sample chapter
