CGISecurity Logo

Topics

Tags

  • Opera 9.64 Security Updates and Enhancements

    Posted by Robert A on

    in
    , ,
    | |

    From Opera's changelog Fixed an issue where specially crafted JPEG images ccould be used to execute arbitrary code, as reported by Tavis Ormandy of the Google Security Team; see our advisory Fixed an issue where plug-ins could be used to allow cross domain scripting, as reported by Adam Barth; details will be disclosed at a…

  • Seven Must-Have Firefox Security Add-Ons

    Posted by Robert A on

    in
    , ,
    | |

    "Ensuring that the browser is up to date can help minimize security risks, but perhaps the most interesting feature of Firefox from a security perspective is the possibility of enhancing the browser's security with the addition of browser extensions or add-ons. Of course any add-ons risks adding new vulnerabilities, but if they protect against known…

  • Apple goes public with security in Safari 4

    Posted by Robert A on

    in
    , ,
    | |

    "Apple announced on Tuesday the public availability of its next browser, Safari 4, seemingly adding a host of new security features to the program along with speedier Javascript processing and additional eye candy, such as cover flow. The security features are not new, however. The company quietly added anti-malware and phishing protection, as well as…

  • The Multi-Principal OS Construction of the Gazelle Web Browser

    Posted by Robert A on

    in
    , , ,
    | |

    I was reading slashdot and saw that Microsoft has released a paper outlining a new secure browser architecture. From the abstract "Web browsers originated as applications that people used to view static web sites sequentially. Asweb sites evolved into dynamic web applications composing content from various web sites, browsershave become multi-principal operating environments with resources…

  • Firefox 3.0.6 Released To Address Multiple Security Issues

    Posted by Robert A on

    in
    , , ,
    | |

    Fixed in Firefox 3.0.6 MFSA 2009-06 Directives to not cache pages ignored MFSA 2009-05 XMLHttpRequest allows reading HTTPOnly cookies MFSA 2009-04 Chrome privilege escalation via local .desktop files MFSA 2009-03 Local file stealing with SessionStore MFSA 2009-02 XSS using a chrome XBL method and window.eval MFSA 2009-01 Crashes with evidence of memory corruption (rv:1.9.0.6) Additional…

  • Microsoft Fixes Clickjacking in IE8?

    Posted by Robert A on

    in
    , , ,
    | |

    "Microsoft has introduced a release client version of its latest browser, Internet Explorer 8 (IE8), and the new iteration of the application includes several security improvements, including a noteworthy attempt to address the emerging problem of clickjacking attacks. For those who don't recall, clickjacking is a relatively new technique — first detailed in mid-2008 by…

  • Safari RSS Reader Vulnerability

    Posted by Robert A on

    in
    , ,
    | |

    In 2006 I gave a talk at blackhat on the risks of RSS vulnerabilities. It appears Safari has a flaw in its RSS reader as outlined by Brian Mastenbrook. "The original version of this page contained a simple workaround for this issue which I believed would protect users against this problem. I have since discovered…

  • HTTPS-only mode added to Chrome Browser

    Posted by Robert A on

    in
    ,
    | |

    Google has added a HTTPS browsing feature to chrome. From the changelog"A new HTTPS-only browsing mode. Add –force-https to your Google Chrome shortcut, and it will only load HTTPS sites. Sites with SSL certificate errors will not load. " Release Notes 2.0.156.1 http://dev.chromium.org/getting-involved/dev-channel/release-notes/releasenotes201561 Very cool.

  • Thunderbird 2.0.0.19 Released With Security Fixes

    Posted by Robert A on

    in
    , ,
    | |

      MFSA 2008-60 – Crashes with evidence of memory corruption (rv:1.9.0.5/1.8.1.19)   MFSA 2008-61 Information stealing via loadBindingDocument   MFSA 2008-64 XMLHttpRequest 302 response disclosure   MFSA 2008-65 Cross-domain data theft via script redirect error message|   MFSA 2008-66 Errors parsing URLs with leading whitespace and control characters   MFSA 2008-67 Escaped null characters ignored…

  • Thousands of legitimate sites SQL injected to serve IE exploit

    Posted by Robert A on

    in
    ,
    | |

    "Once again confirming the trend of having more legitimate sites serving exploits and malware than purely malicious ones, Chinese hackers have been keeping themselves busy during the last couple of days, launching massive SQL injection attacks affecting over 100,000 web sites. The SQL injection attacks serving the just patched Internet Explorer XML parsing exploit, are…

  • Firefox Halting 2.x security patching/support, urges users to upgrade to 3.0 or get pwned

    Posted by Robert A on

    in
    ,
    | |

    "Mozilla has told Firefox users that it will no longer be updating version 2 of the browser and they should upgrade to version 3 right away. The warning came alongside a security update patching ten problems, four of them critical. The critical problems involve cross-site scripting. That’s a serious concern as it allows the unauthorised…

  • Microsoft issues emergency patch for IE

    Posted by Robert A on

    in
    ,
    | |

    "Microsoft will push out an emergency security patch for Internet Explorer on Wednesday, addressing a critical security hole currently being exploited in the wild. Redmond issued advanced notice for tomorrow's fix, describing the out-of-cycle patch as protection from "remote code execution." Unscheduled updates are pretty rare for Microsoft, stressing the potentially serious nature of the…

  • FireFox 3.0.5 fixes three critical security flaws

    Posted by Robert A on

    in
    ,
    | |

    "Mozilla has rushed out updates to plug a few critical holes in versions 2 and 3 of its popular open source Firefox browser. Firefox 3.0.5 fixes three critical security flaws in the browser, while 2.0.0.19 stitches four critical vulns. Mozilla said that XSS vulnerabilities in SessionStore, XSS and so-called JavaScript “privilege escalation” and crashes that…

  • Opera releases update for ‘extremely severe’ vulns

    Posted by Robert A on

    in
    , ,
    | |

    "Opera pushed out an update to its popular web browser on Tuesday that fixes vulnerabilities it described as "extremely severe". The update fixes seven security bugs, some of which were previously known. Version 9.63 of the browser addresses separate code injection risks stemming from flaws in HTML parsing and text inputing, respectively. A critical bug…

  • Google Chrome Receives Lowest Password Security Score

    Posted by Robert A on

    in
    , ,
    | |

    "Google's new web browser may be fast and slim, but the password management features it offers are full of bugs. Chapin Information Services (CIS) reported critical vulnerabilities in this software during its beta period, all of which were unfixed at release time. Among the problems are three in particular that, when combined, allow password thieves…

  • Internet Explorer 8.0 Beta 2 Anti-XSS Filter Vulnerabilities

    Posted by Robert A on

    in
    , , , ,
    | |

    Rafel Ivgi has published an extensive list of IE8 XSS filter evasions. "Aspect9 has discovered several vulnerabilities in Microsoft Windows Internet Explorer 8.0 Beta 2. This new version of Microsoft's famous browser includes new security improvements such as a Cross Site Scripting(XSS) filter. This version also includes a new object that safely allows transferring data…

  • Google publishes Browser Security Handbook

    Posted by Robert A on

    in
    ,
    | |

    Michal Zalewski from google has published an an extremely in depth guide describing the various behavioral differences between the major browsers. "I am happy to announce the availability of our "Browser Security Handbook" – a comprehensive, 60-page document meant to provide web application developers and information security researchers with a one-stop reference to several hundred…

  • Inside Safari 3.2’s anti-phishing features

    Posted by Robert A on

    in
    | |

    An article over at macworld discusses the anti phishing features in the new safari. "The release of Safari 3.2 on November 13 displayed Apple’s penchant for cryptic release notes, as the company describes all three versions as featuring “protection from fraudulent phishing Web sites.” Let's decode that for you: Safari 3.2 offers an entirely new…

  • Firefox 3.0.4 Released to address multiple security flaws

    Posted by Robert A on

    in
    ,
    | |

    A handful of security vulnerabilities have been fixed in the latest version of firefox. Fixed in Firefox 3.0.4 MFSA 2008-58     Parsing error in E4X default namespaceMFSA 2008-57     -moz-binding property bypasses security checks on codebase principalsMFSA 2008-56     nsXMLHttpRequest::NotifyEventListeners() same-origin violationMFSA 2008-55     Crash and remote code execution in nsFrameManagerMFSA…

  • Firefox 3.0.2 released to address multiple security flaws

    Posted by Robert A on

    in
    ,
    | |

    Firefox 3.0.2 has been released which addresses the following security flaws. MFSA 2008-44     resource: traversal vulnerabilitiesMFSA 2008-43     BOM characters stripped from JavaScript before execution MFSA 2008-42     Crashes with evidence of memory corruption (rv:1.9.0.2/1.8.1.17) MFSA 2008-41     Privilege escalation via XPCnativeWrapper pollution MFSA 2008-40     Forced mouse drag…

  • Mozilla security chief: Apple should open up

    Posted by Robert A on

    in
    ,
    | |

    "Mozilla’s security chief said Apple should disclose more information about the steps it takes to protect customers from malware and other computer-born threats. At a security conference on Monday, Window Snyder said open communication about recently reported vulnerabilities and ongoing processes for locking down products is a core responsibility of security departments at every software…

  • Google Chrome criticised over lack of security

    Posted by Robert A on

    in
    | |

    "Users should wait to use Google Chrome after its vulnerabilities were exposed.   Randy Abrams, director of Technical Education at ESET, claimed that as vulnerable code was used users should only use Chrome when they are not viewing sensitive pages.   He claimed that the oversight by Google is indicative of either a lack of…

  • Microsoft IE8 and Google Chrome – Processes are the New Threads

    Posted by Robert A on

    in
    ,
    | |

    "I happened to install Google Chrome (Alpha) the same day I installed Internet Explorer 8 (Beta). I noticed immediately, as I’m sure many of you have, that both browsers isolate tabs in different processes. Unix folks have known about the flexibility of forking a process forever. In Unix, fork() is just about the easiest thing…

  • Google releases Chrome Web browser

    Posted by Robert A on

    in
    | |

    UPDATED: Yet another issue is discovered, this time a DOS. UPDATED: 3 hours later a vulnerability has been published. Google has just released an open sourced browser based on Apple’s Webkit. I’m guessing it will be less than 48 hours before the first vulnerability is discovered. Since Safari uses Webkit it will be interesting to…

  • Firefox 2.0.0.15 Addresses Multiple Security Issues

    Posted by Robert A on

    in
    ,
    | |

    Firefox 2.0.0.15 was released addressing the following security issues. MFSA 2008-33 Crash and remote code execution in block reflow MFSA 2008-32 Remote site run as local file via Windows URL shortcut MFSA 2008-31 Peer-trusted certs can use alt names to spoof MFSA 2008-30 File location URL in directory listings not escaped properly MFSA 2008-29 Faulty…

Favorite Links

Twitter

Twitter

Popular Pages

WASC Threat Classification

Copyright 2000-2026 CGISecurity.com – The oldest application security site online, predating OWASP.