Browser blame game: IE manager points to Firefox; Mozilla exec points back
It's 'very difficult' for IE to validate passed protocols, says program manager
Computerworld - An Internet Explorer program manager and the head of Mozilla Corp.'s security added their voices to the browser blame game yesterday, each saying that the other's application is at fault for multiple Windows zero-day vulnerabilities.
"The limitless variety of [third-party] applications and their unique capabilities make it very difficult to have any meaningful automated parameter validation by the hosting (caller) application," said Diorinos. In the vulnerabilities disclosed so far that involve Mozilla Corp.'s Firefox browser and Cerulean Studios' Trillian instant messaging client, IE has been pegged as the application that calls on those program's unique protocols.
It is, in Diorinos' terminology, the "hosting" application. "It is the responsibility of the receiving (called) application to make sure it can safely process the incoming parameters," Diorinos said.
Diorinos' comments came in response to the ongoing controversy about a flaw that involves both IE and Firefox. Last week, Danish researcher Thor Larholm, among others, put the onus on IE and said that while Firefox registers the "firefoxurl://" protocol used in his proof-of-concept exploits, Mozilla's browser is an innocent bystander. This week, other security researchers said a similar problem involved IE and the "aim" protocol used by Trillian, a multiservice instant messaging program, or for that matter, any AIM (America Online Instant Messenger) client.
Microsoft's stance has not changed since last week, when it first denied that IE was at fault. "Microsoft has thoroughly investigated the claim of a vulnerability in Internet Explorer and found that this is not a vulnerability in a Microsoft product," a spokesman said last Thursday.
"URL protocol handlers are one of the ways we enable rich experiences in browsing, however, as with any other program that accepts untrusted data from the Web, URL protocol handling applications must be carefully designed based on the threat environment," stressed Diorinos.
Mozilla, meanwhile, turned up the heat Tuesday when it updated Firefox to version 22.214.171.124 and patched the open-source browser so it would not accept out-of-bounds data from other applications, such as IE.
And like its browser rival, Mozilla said Microsoft should shape up.
"[This] does not fix the critical vulnerability in Internet Explorer," Windows Snyder, Mozilla's chief security executive, said yesterday of the Firefox update. "Microsoft needs to patch Internet Explorer."
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts