Browser blame game: IE manager points to Firefox; Mozilla exec points back
It's 'very difficult' for IE to validate passed protocols, says program manager
Computerworld - An Internet Explorer program manager and the head of Mozilla Corp.'s security added their voices to the browser blame game yesterday, each saying that the other's application is at fault for multiple Windows zero-day vulnerabilities.
"The limitless variety of [third-party] applications and their unique capabilities make it very difficult to have any meaningful automated parameter validation by the hosting (caller) application," said Diorinos. In the vulnerabilities disclosed so far that involve Mozilla Corp.'s Firefox browser and Cerulean Studios' Trillian instant messaging client, IE has been pegged as the application that calls on those program's unique protocols.
It is, in Diorinos' terminology, the "hosting" application. "It is the responsibility of the receiving (called) application to make sure it can safely process the incoming parameters," Diorinos said.
Diorinos' comments came in response to the ongoing controversy about a flaw that involves both IE and Firefox. Last week, Danish researcher Thor Larholm, among others, put the onus on IE and said that while Firefox registers the "firefoxurl://" protocol used in his proof-of-concept exploits, Mozilla's browser is an innocent bystander. This week, other security researchers said a similar problem involved IE and the "aim" protocol used by Trillian, a multiservice instant messaging program, or for that matter, any AIM (America Online Instant Messenger) client.
Microsoft's stance has not changed since last week, when it first denied that IE was at fault. "Microsoft has thoroughly investigated the claim of a vulnerability in Internet Explorer and found that this is not a vulnerability in a Microsoft product," a spokesman said last Thursday.
"URL protocol handlers are one of the ways we enable rich experiences in browsing, however, as with any other program that accepts untrusted data from the Web, URL protocol handling applications must be carefully designed based on the threat environment," stressed Diorinos.
Mozilla, meanwhile, turned up the heat Tuesday when it updated Firefox to version 22.214.171.124 and patched the open-source browser so it would not accept out-of-bounds data from other applications, such as IE.
And like its browser rival, Mozilla said Microsoft should shape up.
"[This] does not fix the critical vulnerability in Internet Explorer," Windows Snyder, Mozilla's chief security executive, said yesterday of the Firefox update. "Microsoft needs to patch Internet Explorer."
Read more about Security in Computerworld's Security Topic Center.
- Securing Mobile App Data - Comparing Containers and App Wrappers Analysts agree that Mobile Device Management (MDM) is not enough when it comes to securing app data. Although it remains a critical component...
- PCI 3.0 Compliance In this white paper, learn how PCI-DSS 3.0 effects how you deploy and maintain PCI compliant networks using CradlePoint devices.
- Mitigating Security Risks at the Networks Edge This white paper provides strategies and best practices for distributed enterprises to protect their networks against vulnerabilities, threats, and malicious attacks.
- 5 Strategies for Modern Data Protection Read the five strategies for modern data protection that will not only help solve your current data management challenges but also ensure that...
- Business-driven data protection Setting up data protection infrastructures with your organizations' core mission or business in mind is key. In this webinar, the ARCserve team will...
- On-Demand Webinar: Mind the Gap! Watch the webinar featuring Bob Janssen, CTO and Co-Founder of RES Software, to start building a solid foundation for business and IT to... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!