Firefox v2.0.0.6 Released

Mozilla has released Firefox v2.0.0.6 today to address two critical security vulnerabilities.  Users should update as soon as possible.

Advisories 

• MFSA 2007 - 26
  
• MFSA 2007 - 27

To update Firefox go to Help > Check for Updates

Winpatrol 2007 v12 Beta Available

I mentioned in a previous post that Scotty of Winpatrol fame will soon get his bark back.  The new version of Winpatrol is almost ready for release but if you are feeling adventurous then you can download and test the Beta version here.

There are a couple of interesting and exciting additions to this great program and Scotty has a new icon and of course he woofs again on Vista.

This is a beta version of the program so do follow the advice given by Winpatrol and back up your system before installing it and please do feedback to them if you find any bugs.

Another Messenger Worm

F-Secure reports of another Messenger worm, it sends messages to other Messenger contacts that are along the lines of:

Psssssst …. just between me and you, please accept
Looking for hot summer pictures ? well here they are !!

…and includes a link to a file hosted on chatamis.net.

Spammer Banned From MySpace

Technorati Tags: spam, myspace, social networking

US District Judge Audrey B. Collins has forbidden Sanford Wallace and his associates from creating or maintaining MySpace profiles, using the site to send private messages or post public comments or to suggest in commercial emails or other electronic communications that that they are affiliated with the social network.

The preliminary injunction came in a lawsuit MySpace filed in March. It claims Wallace created more than 11,000 MySpace profiles that churned out private messages, comments and bulletins that directed users to spoofed MySpace pages seeking their login information.

The ruse allowed him to hijack at least 320,000 accounts, which he used to send 400,000 private messages and post 890,000 comments, both of which redirected MySpace users to the sites freevegasclubs.com and realvegas-sins.com. The sites are owned by Feeble Minded Productions, an aptly-titled firm affiliated with Wallace.

See the full story at The Register.

Password Vulnerability in Firefox and Safari

The latest versions of Firefox and Safari contain a password management security flaw that could allow certain websites to access stored usernames and passwords.A message on the Full Disclosure mailing list warned that users who have either browser configured to remember passwords, and have JavaScript enabled, are at risk.

Mozilla fixed a similar reverse cross-site scripting flaw in Firefox last November, but this was a lot more serious as it did not require JavaScript to be enabled.

Heise Security has a demonstration of the vulnerability on its website to allow users to determine whether they are vulnerable to the attack.

However, some developers and commentators have questioned whether this constitutes a vulnerability in the browser, as it requires the attacker to place malicious code on the web server.

If an attacker can place script code on a server, they would be able to manipulate the pages anyway, and would have other ways to steal user access data.

Until a fix is released, users are urged to disable JavaScript in their browser or avoid the use of the password manager on sites where users are allowed to post JavaScript pages.

Source | vnunet.com

To disable Java Script in Firefox, go to Tools > Options > Content and untick the Enable Javascript checkbox

To disable Java Script in Safari, go to Preferences > Security > and untick the Enable Javascript checkbox

Winpatrol Gets It's Bark Back

Anyone who knows me will know that I love Winpatrol, one of it’s endearing features has been the little bark that Scotty gives when alerting you to something or when you launch the program.

However… for some reason, Scotty lost his bark on Windows Vista.  But the good news is that Scotty will get his bark back on the next Winpatrol update…. I can’t wait!    Woof Woof!

Check out all the technical details at Bits From Bill 

Ransom-ware Trojan is Back

This summary is not available. Please click here to view the post.

A Little Phish Quiz

McAfee have put up a little quiz so you can see just how good you are at spotting fake sites. Remember, I gave you a few tips here on how to avoid Phish sites but this quiz really shows just how good some of these pages can be.

So get yourself a coffee and a biscuit and spend 10 minutes on this quiz. You can access it here

Incidentally, I got 8 out of 10

Windows Vista Drivers

Drivers for Windows Vista have been a bit of a problem since the Beta version was released last year. A friend of mine couldn’t wait to try it out, but he just couldn’t fix the problem he had with finding a compatible sound driver.

Things are a bit better now, but hardware manufacturers are still taking their time updating their drivers so that your kit will play nice with Vista.

Of course, finding the right driver is the difficult bit. Ed Bott has set up a Vista Master Driver List so if you can’t find it there then it’s probably not been released yet. Thanks to Ed for a great resource and thanks to Corrine of Security Garden for the tip… she’s added this list to Vista Bookmarks which is another site you should check out regularly.

QuickTime Update Fixes Eight Flaws

Apple has released a new version of its ubiquitous QuickTime player for both Mac OS X and Microsoft Windows computers. The latest version, v. 7.2, plugs at least eight security holes in the software.

QuickTime vulnerabilities that span both operating systems may present a very attractive target for malicious hackers, as the program is installed by default on all Apple machines, and on most Windows PCs (if you have iTunes installed, chances are you also have QuickTime on your system). Indeed, recent automated attack tools have been found to exploit QuickTime flaws.

Mac users can grab the latest, patched version using the built-in Software Update feature. Windows users should be able to fetch the patches using the Apple Software Update program that comes bundled with most relatively recent versions of QuickTime and iTunes.

Source | Security Fix

Flash Player Update

There has been a Flash Player update that addresses two security vulnerabilities.

Adobe Security Bulletin

Please note; You don't have to have the Google Toolbar to install the update so just uncheck it.

Talking of Adobe, there are also some Photoshop CS2 and CS3 updates to address security vulnerabilities.

Mozilla Firefox Multiple Popup Tabs Denial of Service Vulnerability

 Firefox is prone to a remote denial-of-service vulnerability.

An attacker may exploit this issue by enticing victims into opening a maliciously crafted HTML document.

Successful exploits can allow attackers to crash the affected browser, resulting in denial-of-service conditions.

Firefox 2.0.0.4 is vulnerable to this issue; other versions may also be affected.

Source | Security Focus