On 9 May 2005 at 12:53, Phil Daley wrote: > >Firefox suffers 'extremely critical' security hole > >Security researchers say exploit code is already circulating online > >News Story by Matthew Broersma > > > >MAY 09, 2005 (TECHWORLD.COM) - Firefox has two unpatched security > >holes that could allow an attacker to take control of a user's > >computer system, and exploit code is already circulating on the > >Internet, security researchers have warned. . . .
Reality check: Internet Explorer is designed from the ground up to allow these kinds of exploits. The only way to protect IE from it is to disable ActiveX which causes a large number of websites to cease working, unless you auhorize them explicitly. Firefox, by comparison, has a software installation mechanism that is turned on by default, but ships with only a very limited number of sites authorized. In other words, Firefox starts out safe, and it's only when the end user whitelists sites that the vulnerability opens up. > >In recent months, Firefox has picked up market share from Microsoft's > > Internet Explorer, partly because it is considered less vulnerable > >to attacks. However, industry observers have long warned that part of > >the reason the browser is more secure is because it has a relatively > >small user base. As Firefox's profile grows, attackers will > >increasingly target the browser. Reality check: so far as I can see, this is, once again, a theoretical exploit that is not being used in the wild. Now that it's been announced, though, no doubt the bad guys will try to exploit it. > >The second part of the exploit triggers software installation using > >an input verification bug in the "IconURL" parameter in the install > >mechanism. The effect is that a user could click on an icon and > >trigger the execution of malicious JavaScript code. Because the code > >is executed from the browser's user interface, it has the same > >privileges as the user running Firefox, according to researchers. Well, d'oh. This is the reason why users should not run their systems on a regular basis as an administrative-level user, as the Windows installer encourages you to do (and as, I believe, WinXP Home requires you to do, with no easy way of changing it). I always turn off any kind of automatic software installation in any software that I install, because I don't want to have changes to my system occuring without me knowing what those changes are. That just seems prudent, since over the years I've seen many software updates that broke the system entirely. Because of that, I don't want it happening except when I ask it to do so. I don't know enough about the JavaScript exploit to say what it can do, but, again, if people didn't run their systems as an administrator, they would be a lot less likely to have truly malicious software installed. It doesn't mean damage can't be done, just that the extent of what kind of damage is possible is less. -- David W. Fenton http://www.bway.net/~dfenton David Fenton Associates http://www.bway.net/~dfassoc _______________________________________________ Finale mailing list [email protected] http://lists.shsu.edu/mailman/listinfo/finale
