Browser blame game: IE manager points to Firefox; Mozilla exec points back
It's 'very difficult' for IE to validate passed protocols, says program manager
Computerworld - An Internet Explorer program manager and the head of Mozilla Corp.'s security added their voices to the browser blame game yesterday, each saying that the other's application is at fault for multiple Windows zero-day vulnerabilities.
"The limitless variety of [third-party] applications and their unique capabilities make it very difficult to have any meaningful automated parameter validation by the hosting (caller) application," said Diorinos. In the vulnerabilities disclosed so far that involve Mozilla Corp.'s Firefox browser and Cerulean Studios' Trillian instant messaging client, IE has been pegged as the application that calls on those program's unique protocols.
It is, in Diorinos' terminology, the "hosting" application. "It is the responsibility of the receiving (called) application to make sure it can safely process the incoming parameters," Diorinos said.
Diorinos' comments came in response to the ongoing controversy about a flaw that involves both IE and Firefox. Last week, Danish researcher Thor Larholm, among others, put the onus on IE and said that while Firefox registers the "firefoxurl://" protocol used in his proof-of-concept exploits, Mozilla's browser is an innocent bystander. This week, other security researchers said a similar problem involved IE and the "aim" protocol used by Trillian, a multiservice instant messaging program, or for that matter, any AIM (America Online Instant Messenger) client.
Microsoft's stance has not changed since last week, when it first denied that IE was at fault. "Microsoft has thoroughly investigated the claim of a vulnerability in Internet Explorer and found that this is not a vulnerability in a Microsoft product," a spokesman said last Thursday.
"URL protocol handlers are one of the ways we enable rich experiences in browsing, however, as with any other program that accepts untrusted data from the Web, URL protocol handling applications must be carefully designed based on the threat environment," stressed Diorinos.
Mozilla, meanwhile, turned up the heat Tuesday when it updated Firefox to version 184.108.40.206 and patched the open-source browser so it would not accept out-of-bounds data from other applications, such as IE.
And like its browser rival, Mozilla said Microsoft should shape up.
"[This] does not fix the critical vulnerability in Internet Explorer," Windows Snyder, Mozilla's chief security executive, said yesterday of the Firefox update. "Microsoft needs to patch Internet Explorer."
Read more about Security in Computerworld's Security Topic Center.
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!