But don't think Mozilla's security woes means Microsoft's getting off easy this week. eEye Digital Security is reporting that its engineers have discovered a new vulnerability in Outlook and Internet Explorer. eEye has sent the information to Microsoft, and this security vendor doesn't provide any details about vulnerabilities until the vendor releases a patch.
So far, all we know from the disclosure is that the vulnerability entails a remote code execution threat to multiple versions of Internet Explorer. Our article on the topic offers a little more information, implying that would-be attackers could exploit the IE vulnerability by getting users to surf across a banner ad.
In addition, eEye published an earlier vulnerability that also affects IE as well as Outlook. The security vendor notified Microsoft of the vulnerability on March 16, but the software giant has not yet released a patch. Because eEye publishes no details about new threats that could help script kiddies, it's difficult to determine which of the two IE threats is generating online reports elsewhere.
Applicability
Most—and possibly all—Mozilla-family browsers are vulnerable to the Java-based information disclosure threat. Specifically, all Mozilla browsers from 0.x through 1.7.x are vulnerable, as well as all Firefox versions, including 1.0.2 (the most recent release). Netscape 6.x and 7.x are definitely vulnerable, but Secunia reports that other versions may also be susceptible.
While unspecified, multiple versions of IE on various platforms are vulnerable to one or both of the remote code execution threats discovered by eEye.
Risk level - Critical
All three of these threats range from serious to critical. At this time, vendors have yet to release any patches. However, I haven't seen any reports that attackers are attempting to actively exploit any of the three threats either.
Mitigating factors
Since all three threats appear to apply to default installations of the browsers, the only mitigating factor is that no one is exploiting the vulnerabilities yet. Thanks to the availability of more details about the Mozilla-family vulnerability, we know attackers can only exploit this threat if users browse to a malicious Web site. However, thanks to the publishing of proof-of-concept code for the Mozilla-family browsers, we can expect to see exploits soon.
Of course, while you can switch to Firefox to avoid the latest IE vulnerability, you'll then have to deal with the new Firefox vulnerability instead—and it appears to be nearly as dangerous.
Talkback
If only the press as a whole would have held Internet Explorer to the same standards in the beginning as they do now FireFox. It would have been a different world.
Other then that I think it's a plus to disclose flaws in software. Certainly security and privacy related ones. Currently the general public is mostly ignorant about the state of affairs in software security land since the general public is mostly informed by means of ads and news flashes and that's hardly an accurate representation of the actual facts.
"In fact, troubles for the increasingly popular browser are coming so fast and furious that mozillaZine has reported that a new Firefox release candidate has already replaced the Firefox release candidate 1.0.3, which became available on April 5."
The extra fixes to be included in 1.0.3 fix bug 281988. There have been no security problems found with the code relating to that bug, just the potential for problems.
https://bugzilla.mozilla.org/show_bug.cgi?id=281988
"Be forewarned that this release candidate 1.0.3, and probably the eventual release version as well, is likely to cause problems with a number of extensions."
"Asa Dotzler has announced another set of Mozilla Firefox 1.0.3 release candidates. ***These builds should allow extensions and other features to operate as they did in Firefox 1.0.2 while still including the security improvements wanted by the Mozilla Foundation.***"
http://www.mozillazine.org/talkback.html?article=6369
"Of course, while you can switch to Firefox to avoid the latest IE vulnerability, you'll then have to deal with the new Firefox vulnerability instead—and it appears to be nearly as dangerous."
IE's problem is remote code execution. Firefox's is information disclosure. I don't know about you, but I'd much rather have an attacker be able to read random bits of memory than him be able to run whatever code he likes on my machine.
"All of the Mozilla, Firefox, and Navigator threats appear to involve Java. So, until Mozilla releases a patch, disabling JavaScript will block any attack attempts in the meantime."
Java is not the same Javascript! Perhaps you should let someone who knows the difference write the articles from now on.
You appear to be confused between the language in which an exploit exists and the language to disable using a security setting. Do you know the difference between Java and JavaScript?
Java is an object oriented development language delivered over the network as class and jar files.
JavaScript/ECMAScript is a scripting language embedded into a html page and usually delivered in plain text.
If the vulnerability is Java then keep it clear and advise users to switch off Java.
If the vulnerability is JavaScript then keep it clear and advise users to switch off JavaScript.
I hope you run a follow up article showing for each of the Firefox and IE vunerabilities how long each takes to fix. That would be proper editorial.