From: "Mark Dodel"

Just so we are not completely lulled about the lack of exploits on OS/2, I thought I'd pass on this security alert about Mozilla based browsers that I saw on Dr. Jerry Pournelle's web site
http://jerrypournelle.com/view/view320.html#warn Since it uses Mozilla's internal programming language this is cross-platform and should effect the OS/2 versions as well.:

Dear Dr Pournelle,

http://secunia.com/advisories/12188/ Here we go again:

"*Description*: A vulnerability has been reported in Mozilla and Mozilla Firefox, allowing malicious websites to spoof the user interface.

The problem is that Mozilla and Mozilla Firefox don't restrict websites from including arbitrary, remote XUL (XML User Interface Language) files. This can be exploited to "hijack" most of the user interface (including tool bars, SSL certificate dialogs, address bar and more), thereby controlling almost anything the user sees.

The Mozilla user interface is built using XUL files.

A PoC (Proof of Concept) exploit for Mozilla Firefox has been published.
The PoC spoofs a SSL secured PayPal website.

This has been confirmed using Mozilla 1.7 for Linux, Mozilla Firefox 0.9.1 for Linux, Mozilla 1.7.1 for Windows and Mozilla Firefox 0.9.2 for Windows. Prior versions may also be affected.

NOTE: This issue appears to be the same as Mozilla Bug 244965. [Moderator note: It is actually http://bugzilla.mozilla.org/show_bug.cgi?id=22183 ]

*Solution*: Do not follow links from untrusted sites."

Regards, TC

Source: OS2VOICE

OS/2-eCS-ArcaOS General News

More in General  

OS/2-eCS-ArcaOS Software News

More in Software  

Latest Forum Posts

WarpStock and OS/2-eCS-ArcaOS Event News

More in Events  

Site News

More in Site News