A noted security researcher Monday disclosed four new zero-day vulnerabilities in Microsoft Corp. and Mozilla Corp.'s browsers, including a critical flaw in Internet Explorer (IE) and a "major" bug in Firefox. Michael Zalewski, who regularly publishes browser flaw findings, posted details on the Full-disclosure mailing list for cookie-stealing, keystroke-snooping, malicious downloading and site-spoofing bugs.

The most serious of the four, said Zalewski, is an IE6 and IE7 flaw he rated "critical." Dubbing it a "bait-and-switch" vulnerability, he said that the Microsoft browser gives hackers a window of opportunity to run malicious JavaScript to hijack the PC. "The entire security model of the browser collapses like a house of cards and renders you vulnerable to a plethora of nasty attacks," Zalewski claimed in notes that accompanied a demonstration of the IE bug. Up-to-date IE6 and IE7 are both at risk, he said, although Firefox is not.

View: Full Story
News source: PC World


There are 7 additional comments
Advertisement
Quote this comment Reply to this comment #1 Posted by Yogurth on 05 Jun 2007 - 21:13
I wonder have they tested Opera.
(1 reply) Quote this comment Reply to this comment #2 Posted by toadeater on 05 Jun 2007 - 21:49
First rule of Windows security: don't use Internet Explorer.
Quote this comment #2.1 Posted by RealFduch on 06 Jun 2007 - 00:17
No. The first one is: don't use Firefox.
And the second one is: use your head.
(3 replies) Quote this comment Reply to this comment #3 Posted by RealFduch on 06 Jun 2007 - 00:18
reading comprehension?
Quote -
"IE7 is not affected because of certain high-level changes in the browser," Zalewski said
Quote this comment #3.1 Posted by +mrbester on 06 Jun 2007 - 09:30
Perhaps you should go back to school as well IE fanboy.
Full quote:
Quote -
Zalewski posted information about two other bugs, both rated "medium." A Firefox vulnerability could lead to unauthorized downloads, while IE6 is open to yet another address bar-spoofing flaw. "IE7 is not affected because of certain high-level changes in the browser," Zalewski said of the fourth vulnerability.
Quote this comment #3.2 Posted by RealFduch on 06 Jun 2007 - 17:25
Quote - (mrbester said @ #3.1)
Full quote:
Quote -
Zalewski posted information about two other bugs, both rated "medium." A Firefox vulnerability could lead to unauthorized downloads, while IE6 is open to yet another address bar-spoofing flaw. "IE7 is not affected because of certain high-level changes in the browser," Zalewski said of the fourth vulnerability.

So tell me please how to transform that quote to this:
Quote -
Up-to-date IE6 and IE7 are both at risk, he said, although Firefox is not.
Quote this comment #3.3 Posted by +mrbester on 07 Jun 2007 - 11:34
That was referring to the the IE6 and IE7 flaw he rated "critical". You mixed up the "critical" flaw that affects IE and not Firefox (the bait-and-switch) with a "medium" flaw that doesn't affect IE7 but does affect IE6 (the address spoofing). Clearer now?
[1]

Commenting has either been disabled on this article or you are not logged in. Click here to login or register, its free!

Note: Anonymous commenting is disabled in order to keep the quality of responses to a high standard.


Scroll to the Top
....
My Preferences
....
Communicating with server
Loading
Please Wait...
....
Loading
 X 
....