IT Security: Serious issues with Firefox and OpenSSL, says US-CERT
The USA's government run IT security service, US-CERT, has published a list of "high-vulnerability" issues with Firefox, OpenSSH and OpenSSL, mainstays of the Open Source industry.
Most Recent - This Section
IT Security: criminals exploit insecure WordPress installationsIT Security: Phishing attack from within Yahoo Messenger
IT Security: Zappos.Com admits huge security breach.
IT Security: "Twihards" targeted by internet crooks
IT Security: Microsoft ceases use of "supercookies."
Most Recent - Whole Site
The Risk Professional: Green Capital Consulting GroupLegal Professional: Baker Mac lawyer guilty of money laundering and securities fraud
Sales and Marketing: shooting oneself in the foot
Business Crime: Dear Mrs Kate Dave: Yes, please. Send it now.
The Risk Professional: Is your data secure enough for the UK's ICO?
Most Recent - BankingInsuranceSecurities.Com
Sanctions: USA PATRIOT Act designation 20120522Sanctions: OFAC Update 20120515
Sanctions: OFAC update 20120508
Sanctions: OFAC Update 20120517
Sanctions: OFAC Update 20120517 - 2
The issues are:
Mozilla Firefox:
1. The WebSockets implementation in Mozilla Firefox 4 through 4.0 Beta 7 does not properly perform proxy upgrade negotiation, which has unspecified impact and remote attack vectors, related to an "inherent problem" with the WebSocket specification.
2. Use-after-free vulnerability in Mozilla Firefox before 3.5.16 and 3.6.x before 3.6.13, and SeaMonkey before 2.0.11, allows remote attackers to execute arbitrary code via vectors involving a change to an nsDOMAttribute node.
The current stable version of Firefox is 3.6.13 and can be downloaded from http://www.mozilla.com/firefox/
OpenSSH
OpenSSH 5.6 and earlier, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol, a related issue to CVE-2010-4252.
The current version of OpenSSH is 5.6. See http://www.openssh.com/
OpenSSL
OpenSSL before 1.0.0c, when J-PAKE is enabled, does not properly validate the public parameters in the J-PAKE protocol, which allows remote attackers to bypass the need for knowledge of the shared secret, and successfully authenticate, by sending crafted values in each round of the protocol.
The current version of OpenSSL is 1.1.0b. See http://www.openssl.org/
Download PDF version of this page
