Security Bytes: Injection flaw in popular browsers

Article

Security Bytes: Injection flaw in popular browsers

SearchSecurity.com staff

Injection flaw in multiple browsers
Danish security firm Secunia has reported a "moderately critical" window injection vulnerability in Firefox, Internet Explorer, Opera, Netscape, Safari and Konqueror. Attackers could use the flaw to spoof the content of Web sites. "The problem is that a Web site can inject content into another site's window if the target name of the window is known," Secunia said. "This can be exploited by a malicious Web site to spoof the content of a pop-up window opened on a trusted Web site."

A test is available to check if your browser is affected by the vulnerability. The flaw was confirmed in Mozilla 1.7.3, Firefox 1.0; a fully patched system with Internet Explorer 6 and Microsoft Windows XP SP1/SP2; Opera 7.54; Netscape 7.2; Safari 1.0; and Konqueror 3.0. For now, users of these browsers are advised to avoid untrusted Web sites.

Microsoft boosts Windows Server 2003 security
Microsoft has rolled out a nearly-finished service pack for its Windows Server 2003 software, a slew of security upgrades at its heart. This is for Windows Server 2003 what SP2 was for Windows XP. "This is more than the typical service pack," Michael Cherry, an analyst with Redmond, Wash.-based Directions on Microsoft, told TechWeb News. "It has changes, some new features, not just a roll-up of previously-released

    Requires Free Membership to View

    Login

    SearchSecurity.com members gain immediate and unlimited access to breaking industry news, virus alerts, new hacker threats, highly focused security newsletters, and more -- all at no cost. Join me on SearchSecurity.com today!

    Michael S. Mimoso, Editorial Director

    By submitting your registration information to SearchSecurity.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchSecurity.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

security patches." In that regard, he said, the release candidate of Windows Server 2003 Service Pack 1 (SP1) is much like SP2. Changes range from revamped security on the vulnerable DCOM and RPC protocols -- exploited last year by the MSBlast worm -- to a more secure Internet Explorer. SP1 also automatically blocks all incoming network traffic to a new server until the latest patches are downloaded and installed, a technique used to ensure that fast-acting network-attacking worms can't infiltrate an exposed server, TechWeb News reported. Microsoft also added what it calls the Security Configuration Wizard, which walks administrators through the process of reducing the server's attack vulnerability by setting options to block unnecessary ports, change pertinent registry keys, and configure audit settings. Download details are on Microsoft's Web site.

On the heels of Firefox 1.0 comes Thunderbird 1.0
After successfully launching the Firefox 1.0 Web browser last month, the Mozilla Foundation this week released its Thunderbird 1.0 open source e-mail client, complete with new antispam and antivirus features. Thunderbird is available now for Windows, Macintosh and Linux systems as a free download. It comes with adaptive junk mail controls designed to stop spam by learning from users' e-mail management practices and automated e-mail migration functionality to switch e-mail from existing Microsoft Outlook, Outlook Express, Eudora, and Netscape Communicator clients. "Thunderbird gives you a faster, safer and more productive e-mail experience. We designed Thunderbird to prevent viruses and to stop junk mail so you can get back to reading your mail," the foundation said on its Web site. It added that Thunderbird "provides enterprise- and government-grade security features such as S/MIME, digital signing, message encryption, support for certificates and security devices." Firefox has been hailed as a more secure alternative to Microsoft's much-attacked Internet Explorer browser, though some experts say Firefox could become a more tempting target as more people download it.

SUSE fixes flaws in multiple packages
SUSE has issued an advisory fixing security holes in multiple packages an attacker could use to overwrite files, gain escalated privileges and commit additional mischief. SUSE recommends users update their packages as soon as possible. Affected SUSE products are:

  • eMail Server 3.0
  • Linux 7.0, 8.0, 9.0, 9.1 and 9.2
  • Linux Connectivity Server
  • Linux Database Server
  • Linux Desktop 1.0
  • Linux Enterprise Server 7, 8 and 9
  • Linux Firewall on CD/Admin host
  • Linux Office Server
  • Linux Openexchange Server 4.0
  • Linux Standard Server 8

A full account of the vulnerabilities can be found in the SUSE advisory.

Sun fixes Solaris vulnerability
Sun Microsystems has fixed a vulnerability in the "in.rwhod(1M)" daemon a remote privileged user could use to launch malicious code with "root" privileges when the daemon is enabled on the system. This affects Solaris 7, 8 and 9 on the SPARC and x86 platforms. "A system is only vulnerable to this issue if the in.rwhod(1M) daemon is enabled. This can be determined by using the pgrep(1) command which will only generate output if the daemon is enabled," Sun said in an advisory. The company recommends users apply the patches.


Join the conversationComment

Share
Comments

    Results

    Contribute to the conversation

    All fields are required. Comments will appear at the bottom of the article.
    Back to top