Meanwhile, the Mozilla Foundation has updated Firefox to version 3.5.5. The developers only mention stability fixes, this release doesn’t seem to fix security issues. Anyhow it is a good idea to install the update.

There was another security Update for Sun Java. Version 6 Update 17 fixes a lot of security vulnerabilities. Those flaws may lead to remote code execution, thus updating immediately is recommended.

What else? Adobe has released Shockwave Player 11.5.1.602 which also closes security holes in the software which allow for remote malware injection. Users of the Shockwave Player (which is different from Adobe Flash Player) should also update their software immediately.

Today also Google released an update for its Chrome browser. It fixes 2 security problems which put users at risk.

Dirk Knop
Technical Editor

Some of the bugs also affect earlier versions of the Mozilla browsers and get fixed within Firefox 3.0.15 (though it is recommended to update to Firefox 3.5) and in SeaMonkey 2.0. Thunderbird doesn’t get mentioned in the security advisories.

As some of the vulnerabilities are quite serious security issues, users should update the software as soon as possible. The easiest way is to go to the “Help” menu and choose “Check for Updates”.

Dirk Knop
Technical Editor

With Firefox 3.5.3, the developers also added a nice new feature to the software: It’ll warn users if their Adobe Flash Player plug-in is outdated and must be updated. They’ll extend this feature for other plug-ins, according to the Mozilla Security Blog.

Please install the update as soon as possible. The easiest way is to go to the Help menu and click on “Check for Updates”. You can also download the whole installation package on the Firefox web site.

Dirk Knop
Technical Editor

The second vulnerability could get abused to inject malicious code – for example a Trojan – into the victim’s computer by putting certain regular expressions into a certificate for SSL communication. This happened due to code that was meant to provide backwards compatibility to the non-standard regular expression syntax used by Netscape clients and servers. Now Firefox uses the current industry-standard wild-card syntax.

Update your Firefox as soon as possible by clicking on the Help menu and choosing “Search for Updates”. As other Mozilla products like Thunderbird and SeaMonkey are vulnerable too, apply updates ASAP as well when they get available.

Dirk Knop
Technical Editor

Dirk Knop
Technical Editor

Microsoft expects exploits for all fixed vulnerabilities within the next 30 days according to the Exploitability Index of the security bulletin summary. The patches should be applied as soon as possible therefore to protect the own computer and/or network.

The Mozilla Foundation issued a warning of a security hole in the Just-in-time compiler for JavaScript of the new Firefox 3.5 web browser. As exploit code is already publicly available they recommend to turn of the compiler temporarily. From the security advisory:

1. Enter about:config in the browser’s location bar.
2. Type jit in the Filter box at the top of the config editor.
3. Double-click the line containing javascript.options.jit.content setting the value to false.

The developers are currently working on a fix. Until then it is a good idea to implement the described workaround.

Dirk Knop
Technical Editor

From Microsofts Security Response Center: “The vulnerability is in the QuickTime parser in Microsoft DirectShow. An attacker would try and exploit the vulnerability by crafting a specially formed video file and then posting it on a website or sending it as an attachment in e-mail. While this isn’t a browser vulnerability, because the vulnerability is in DirectShow, a browser-based vector is potentially accessible through any browser using media plug-ins that use DirectShow. Also, we’ve verified that it is possible to direct calls to DirectShow specifically, even if Apple’s QuickTime (which is not vulnerable) is installed.”

The company offers a solution in a knowledgebase article. Users can apply a fix by clicking on the “fix it”-link in that article with Internet Explorer – currently the fix is undergoing maintenance obviously though. Microsoft writes that it wants to ship a patch as soon as it is production stable. It is unclear weather this means that they want to ship an update out-of-band or if it is ready for the June Black Tuesday.

Dirk Knop
Technical Editor

An overview of the vulnerabilities is available at the Mozilla website. As the Mozilla based web browsers are highly popular, the cybercriminals develop malware for them as well. So update your Firefox to the current version 3.0.9, Thunderbird to 2.0.0.22 and Seamonkey to 1.1.17 or newer as soon as possible!

Dirk Knop
Technical Editor

The developers from the Mozilla project just released an update for Firefox 3, bumping the version number to 3.0.4. The patch remedies 11 vulnerabilities of which 4 are considered crititcal by the Mozilla developers. They may lead to execution of injected code (like a trojan) so please update ASAP.

Microsoft published 3 patches for critical weaknesses in it’s operating systems and the office solutions on November Black Tuesday which also may allow attackers to remotely take over users’ machines. Two patches close holes in Microsofts XML-parser (XMLcore). Another update is available which helps with a security problem which is known for roundabout 7 yeras now, a so called SMB reflector attack: An attacker on a network sends back credentials which he sniffed earlier and gets access to the SMB client. Users and companies are well advised to install the patches soon.

Another story is making rounds in the media concerning an ISP from San Jose in the U.S., McColo. That ISP provided “bullet proof hosting” which is often used for Command&Control-servers for botnets. The two major internet carriers which were connecting McColo to the internet pulled the plug yesterday. Since then the spam rate on the net dropped down to half of the usual amount, sometimes even to 10%. Unfortunately, this won’t hold long as the criminals are loosing profit and for sure look for alternatives.

Dirk Knop
Technical Editor