New flaw in old browsers
vnunet.com, 10 Jan 2005
Security experts have found a critical flaw in the Mozilla browser, days after the disclosure that the Firefox browser was vulnerable to phishing scams.
The flaw is in the browser's handling of the Network News Transfer Protocol (NNTP), which is used to post and distribute Usenet messages. All Mozilla browsers before version 1.7.5 have the flaw.
In order to exploit the flaw hackers would have to craft a long news:// address and which would crash the application and possibly allow code to be inserted onto the target machine.
"I found a flaw in NNTP handling code which may cause heap overflow and allow remote attacker to execute arbitrary code on client machine," said Maurycy Prodeus, from security firm iSEC security research.
"On my RedHat 9.0 with Mozilla 1.7.3 attached proof of concept code overflows the buffer using attacker-supplied data. I decided to make this bug public because Mozilla Team hasn't warned users."
Mozilla recommends users upgrade their browsers to the latest version (found at http://www.mozilla.org/products/mozilla1.x/) to solve the problem.
How web services contribute to data headaches
Remote access - Three steps to getting connected
3.4 million UK professionals now work from home – is your company equipped?
Cost benefits of a global collaboration network
This white paper is a must read for organisations looking for evidence of the bottom-line benefits of high-definition video and voice communications
Keep up to date with the latest products, services and technologies from the world's leading IT companies; IThound.com brings you over 6,000 white papers, case studies and analyst reports.
Chris Adams, Office Client product manager for Microsoft UK, explains...
Critics says government proposals to curb illegal downloading are unworkable...
Do you agree?
Have your say on this article