Writing Secure Web Browsers in Hard

George J. Capnias — Thu, 12 May 2005 08:37:02 GMT

Πριν από καιρό όταν πρωτοπαρουσιάστηκε ο FireFox όλοι πίστεψαν ότι ένας ασφαλής Web Broswer είχε εμφανιστεί. Από την στιγμή που το Mozilla Foundation αποφάσισε να προσφέρει αμοιβή στον καθένα που έβρησκε ένα σοβαρό security hole στο Web Browser του, άρχισε να πέφτει βροχή security holes! Ενώ ο FireFox ετοιμάζεται για το 1.04 release του, πολλά ερωτηματικά υψώνονται για την ασφάλεια που παρέχει...

Writing Secure Web Browsers in Hard

I'm not making excuses, just stating facts. In fact, I just read this from SANS... emphasis is mine.

http://www.sans.org/newsletters/newsbites/newsbites.php?vol=7&issue=19

Fixes Not Yet Available for Firefox Vulnerabilities (9 May 2005)
Two vulnerabilities in the Firefox web browser could allow attackers to gain control of users' computers just by getting them to visit a maliciously crafted web site. Mozilla is recommending that Firefox users disable Javascript or lock down the browser to prevent it from installing additional software. There is no a patch available, although information about the vulnerabilities and proof-of-concept exploit code have already been released. Mozilla plans to release an update, Firefox 1.0.4, as soon as possible.

- http://informationweek.com/story/showArticle.jhtml?articleID=163100338
- http://www.vnunet.com/news/1162904

Editor's Note (Schultz): The number of vulnerabilities in Firefox recently has been alarming. At first Firefox appeared to be an attractive alternative to Internet Explorer (IE) for security reasons, but IE is now looking better and better in comparison.

(Shpantzer): There's so much hacking at the application layer, at some point we'll have to actually lock down configurations for all browsers, regardless of the security mythology that surrounds the project's code and architecture. If you have a supposedly 'secure' browser that's insecurely configured, well, it's not very secure.

Original Link

Today 02:45 | michael_HOWARD

George J.

Ειδήσεις του dotNETZone.gr

Writing Secure Web Browsers in Hard