Opera patches bug, bashes Mozilla
Norwegian browser maker took rival to the woodshed over irresponsible disclosure
The update, dubbed Opera 9.26, plugs three security vulnerabilities. The most serious is rated "highly severe" by the Oslo-based developer and could be used by attackers to dupe the browser into treating image-file comments as script. "This can cause the script to be run in the wrong security context," Opera's advisory read.
But it was another, less-dangerous bug that raised the ire of Claudio Santambrogio, Opera's quality assurance desktop test manager. In a post to a company blog last Thursday, Santambrogio used the flaw to take Mozilla to task.
"Mozilla notified us of one security issue the day before they published their public advisory," said Santambrogio. "They did not wait for us to come back with an ETA for a fix. They kept their bug reports containing the details of the exploits closed to the public for a few days, and now opened most of them to everybody."
The bug, which was one of 11 that Mozilla patched Feb. 7 when it released Firefox 18.104.22.168, could let attackers spoof input fields. Mozilla said that the vulnerability could be used to dupe users into unwittingly uploading malicious code; Opera's advisory agreed.
Although Santambrogio claimed that Mozilla had opened the vulnerability's Bugzilla entry -- and thus disclosed details of the bug before Opera was able to patch -- the entry is currently locked. It is inaccessible even to users with a general Bugzilla account.
Santambrogio seemed to knock Mozilla for not abiding by the unwritten rule of "responsible disclosure," which requires that researchers wait until vendors patch a bug before revealing details of the vulnerability. "Opera is as always committed to not only protecting its users, but to making the Web a safe place. We believe in responsible [emphasis in original] disclosure of vulnerabilities affecting several vendors," he said.
Mozilla said it would not comment on the dustup.
Opera 9.26 can be downloaded from the company's Web site in versions for Windows, Mac OS X and Linux.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts