Re: Design Change Requests

[Jerry Adams <jerry@xxxxxxxxxxxxxxx>]

Joe,


It is typically a contest between the browser vendors (all of them) and 
the f@#$%g jackasses trying to find and exploit holes.  Most of the 
hackers attack IE simply because of its ubiquitousness; if the hole also 
affects Firefox, et al, so much the better (from their point of view).


I think that the major difference between Firefox and IE, though, is the 
response time to address known vulnerabilities.  From independent 
studies, recapped in Windows Newsletter, M$ response is measured in 
weeks or, even, months.  FF's is usually measured in days.  Obviously, 
when you're as big a target as M$, more people are going to take shots 
at you simply because you're easier to hit.  But the empirical evidence 
doesn't show that M$ has really taken Bill's emphasis on security (when 
did he make that statement?  2005?  2004?) very seriously. 


Security is still an afterthought with M$.  FF (and perhaps others) are 
designed with that in mind; admittedly they have the advantage of seeing 
the havoc wreaked on IE.  Another example:  OS/400 is designed with 
security as the foundation; everything else is written on top of that.  
Which, I think, would make it easier to plug the holes when leaks occur.



        * Jerry C. Adams
*iSeries Programmer/Analyst
B&W Wholesale Distributors, Inc.* *
voice
        615.893.8633x152
fax
        615.995.1201
email
        jerry@xxxxxxxxxxxxxxx <mailto:jerry@xxxxxxxxxxxxxxx>



Joe Pluta wrote:

> > From: Ingvaldson, Scott
> >
> > I don't know that it's documented anywhere, but I saw it with my own
> > eyes.  My mother's PC was having problems so I updated her anti-virus
> > (AVG Free on WinXP) and ran a full system virus scan.  It cleaned most
> > of the virus' the first time but one kept coming back no matter what I
> > did.  I finally tracked it to the IE cache.  Opened IE, Tools > Internet
> > Options > Delete Files... > Delete all offline content.  Then ran the
> > full system virus scan again and finally it was clean.
> >    
>
> Come on, people, let's keep it real.  IE is NOT the only known vector for
> virus proliferation.  Firefox/Mozilla have plenty of exploits as well.
> Obviously they get better with each release, but here's a list from July of
> 2005, with release 1.0.4 (not that old of a release):
>
> http://www.frsirt.com/english/advisories/2005/1075
>
> Twelve vulnerabilities were identified in Mozilla Suite and Firefox, which
> may be exploited by malicious web sites to execute arbitrary commands or
> conduct spoofing and cross site scripting attacks. 
>
> - An improper cloning of base objects could allow web content scripts to
> walk up the prototype chain to get to a privileged object, which could be
> exploited by attackers to execute arbitrary code.
>
> - An input validation error in the processing of XHTML documents containing
> fake <IMG> elements could be exploited by malicious web sites to execute
> scripting code with elevated "chrome" privileges.
>
> - JavaScript dialog boxes do not display or include their origin, which
> allows a new window to open e.g. a prompt dialog box, which appears to be
> from a trusted site. See : FrSIRT/ADV-2005-0820 
>
> - An input validation error in the processing of javascript URLs opened by
> media players could be exploited by attackers to execute arbitrary code.
>
> - An error in the processing of "top.focus()" calls could be exploited by
> attackers to conduct spoofing and/or cross site scripting attacks.
>
> - A regression error could be exploited by attackers to inject arbitrary
> JavaScript code from one page into the frameset of another site.
>
> - An input validation error in the "InstallVersion.compareTo()" function
> when handling specially crafted objects could be exploited by attackers to
> run arbitrary code or conduct denial of service attacks.
>
> - An input validation error in the processing of "data:" URLs could be
> exploited by attackers to conduct cross site scripting attacks.
>
> - An error in the "InstallTrigger.install()" method could be exploited to
> conduct cross site scripting attacks.
>
> - An error when handling Wallpapers could be exploited by attackers to run
> arbitary code on a vulnerable system by convincing a user to use the "Set As
> Wallpaper" context menu item on a specially crafted image.
>
> - Scripts in XBL controls from web content are run even when Javascript was
> disabled.
>
> - An error in the browser UI when handling user/synthetic events could be
> exploited by attackers to execute arbitrary code.
>
> ------------
>
> Sure it's an older release, but those are some pretty nasty flaws.
>
> Joe
>
>
>