Next Page >>
web browsers
From your paper:
>>It is noteworthy that it has taken 19 months since the initial general
availability of IE7 (public release October 2006) to reach 52.5%
proliferation amongst users that navigate the Internet with Microsoft's
Web browser. Meanwhile, 92.2% of Firefox users have migrated to FF2.
Could this be due to the fact that Mozilla stops supporting, and issuing
updates for old versions just a few months after the release of a new
one?
> From your paper:
>
>>>It is noteworthy that it has taken 19 months since the initial general
> availability of IE7 (public release October 2006) to reach 52.5%
> proliferation amongst users that navigate the Internet with Microsoft's
> Web browser. Meanwhile, 92.2% of Firefox users have migrated to FF2.
>
> Could this be due to the fact that Mozilla stops supporting, and issuing
> updates for old versions just a few months after the release of a new
> one?
A reply from Robert Hensing at Microsoft
(http://blogs.technet.com/robert_hensing/archive/2008/07/01/vulnerable-w
eb-browser-study-full-of-fail.aspx) says that your study did not include
minor version information for Internet Explorer, probably because such
information is not reported in the user-agent string. But fully-patched
copies of IE5 and IE6 are not insecure in the same way as an unsupported
version; Microsoft is still supporting them.
So is it true that your study calls anyone running IE7 secure, and
anyone running IE5 or IE6 insecure, regardless of their patch levels?
Hi List,
For the last 18 month we analyzed the daily USER-AGENT data collected by
Google's Web search and application servers around the world to study how users
patch and update their Web browsers.
We came out that approximately 637 million (or 45.2 percent) users currently
surf the Web on a daily basis with an out-of-date browser – i.e. not running a
current, fully patched Web browser version.
1. XSS 1
A HTTP GET request against the following URL will, on a web browser
with Javascript support, cause a dialog box saying '1' to be displayed:
http://CACTIHOST/graph.php?action=zoom&local_graph_id=1&graph_end=1%27%20style=visibility:hidden%3E%3Cscript%3Ealert(1)%3C/script%3E%3Cx%20y=%27
This vulnerability is only exploitable if the victim is allowed to view
- Hijack user accounts by stealing the victim's cookies that are
assigned to the victim's browser by the vulnerable website
- Hijack user accounts by injecting a "fake" html form on the html
rendered by the victim's web browser
- Redirect the victim to a malicious third-party website which would
perform a phishing attack to steal the user credentials or exploit a
vulnerability (i.e.: buffer overflow) on the
- Hijack user accounts by stealing the victim's cookies that are
assigned to the victim's browser by the vulnerable website
- Hijack user accounts by injecting a "fake" html form on the html
rendered by the victim's web browser
- Redirect the victim to a malicious third-party website which would
perform a phishing attack to steal the user credentials or exploit a
vulnerability (i.e.: buffer overflow) on the victim's web browser in
order to compromise the victim's workstation
http://labs.idefense.com/intelligence/vulnerabilities/
Jun 10, 2010
I. BACKGROUND
Adobe Flash Player is a very popular Web browser plugin. It is available
for multiple Web browsers and platforms, including Windows, Linux and
MacOS. Flash Player enables Web browsers to display rich multimedia
content, such as online videos, and is often a requirement for popular
websites. For more information, see the vendor's site at the following
link.
Dear all,
with research colleague Thomas Duebendorfer from Google in Zurich I've
finally had a chance to look deeper into the performance of Web
browser update mechanisms. The analysis of anonymized Google Web
server logs allowed us to compare and rank the update strategies
deployed by
Google Chrome, Mozilla Firefox, Apple Safari, and Opera. We found
considerable differences in the performance of the update techniques
deployed by each browser by measuring the share of the latest minor
http://labs.idefense.com/intelligence/vulnerabilities/
Aug 24, 2010
I. BACKGROUND
Adobe Shockwave Player is a popular Web browser plugin. It is available
for multiple Web browsers and platforms, including Windows, and MacOS.
Shockwave Player enables Web browsers to display rich multimedia
content in the form of Shockwave videos. For more information, see the
vendor's site found at the following link:
http://labs.idefense.com/intelligence/vulnerabilities/
Jun 14, 2011
I. BACKGROUND
Adobe Shockwave Player is a popular Web browser plug-in. It is available
for multiple Web browsers and platforms, including Windows, and MacOS.
Shockwave Player enables Web browsers to display rich multimedia content
in the form of Shockwave videos. For more information, see the vendor's
site found at the following link:
http://labs.idefense.com/intelligence/vulnerabilities/
Jun 14, 2011
I. BACKGROUND
Adobe Shockwave Player is a popular Web browser plug-in. It is available
for multiple Web browsers and platforms, including Windows, and MacOS.
Shockwave Player enables Web browsers to display rich multimedia content
in the form of Shockwave videos. For more information, see the vendor's
site found at the following link:
http://labs.idefense.com/intelligence/vulnerabilities/
Jun 14, 2011
I. BACKGROUND
Adobe Shockwave Player is a popular Web browser plug-in. It is available
for multiple Web browsers and platforms, including Windows, and MacOS.
Shockwave Player enables Web browsers to display rich multimedia content
in the form of Shockwave videos. For more information, see the vendor's
site found at the following link:
Summary:
Multiple vulnerabilities in Firefox and Xulrunner
Software Description:
- firefox: safe and easy web browser from Mozilla
- xulrunner-1.9.2: XUL + XPCOM application runner
- firefox-3.5: safe and easy web browser from Mozilla
- firefox-3.0: safe and easy web browser from Mozilla
Details:
http://labs.idefense.com/intelligence/vulnerabilities/
May 11, 2010
I. BACKGROUND
Adobe Shockwave Player is a popular Web browser plugin. It is available
for multiple Web browsers and platforms, including Windows, and MacOS.
Shockwave Player enables Web browsers to display rich multimedia
content in the form of Shockwave videos. For more information, see the
vendor's site found at the following link:<BR> <BR>
http://get.adobe.com/shockwave
http://labs.idefense.com/intelligence/vulnerabilities/
Feb 08, 2011
I. BACKGROUND
Adobe Shockwave Player is a popular Web browser plug-in. It is available
for multiple Web browsers and platforms, including Windows, and MacOS.
Shockwave Player enables Web browsers to display rich multimedia
content in the form of Shockwave videos. For more information, see the
vendor's site found at the following link:
http://labs.idefense.com/intelligence/vulnerabilities/
Jun 10, 2010
I. BACKGROUND
Adobe Flash Player is a very popular Web browser plugin. It is available
for multiple Web browsers and platforms, including Windows, Linux and
MacOS. Flash Player enables Web browsers to display rich multimedia
content, such as online videos, and is often a requirement for popular
websites. For more information, see the vendor's site at the following
link.
http://labs.idefense.com/intelligence/vulnerabilities/
Jun 14, 2011
I. BACKGROUND
Adobe Shockwave Player is a popular Web browser plug-in. It is available
for multiple Web browsers and platforms, including Windows, and MacOS.
Shockwave Player enables Web browsers to display rich multimedia content
in the form of Shockwave videos. For more information, see the vendor's
site found at the following link:
http://labs.idefense.com/intelligence/vulnerabilities/
Jul 30, 2009
I. BACKGROUND
Adobe Flash Player is a very popular web browser plugin. It is available
for multiple web browsers and platforms, including Windows, Linux and
MacOS. Flash Player enables web browsers to display rich multimedia
content, such as online videos, and is often a requirement for popular
websites.
- Gallery -- begins to scan all images in phone memory and card, and
crashes soon, obviously when it encounters nokiacrash.jpg. So, just
putting this file anywhere in the filesystem is Gallery DoS.
- Web Browser -- does nothing when typing file:///E:/nokiacrash.jpg, but
crashes upon <IMG SRC=nokiacrash.jpg> in HTML file (of course,
Settings->Page->Load Content have to be set to "Images" or "All",
otherwise IMG tags are skipped).
_________________________________________
I. BACKGROUND
---------------------
"Apple Safari is a web browser developed by Apple. As of February 2010,
Safari was the fourth most widely used browser, with 4.45% of the
worldwide usage share of web browsers according to Net Application."
II. DESCRIPTION
I'll demonstrate how to get administrator rights even
if the victim has a protection against XSS (NoScript
Firefox plugin for example). First, the attacker will
fix the victim's session id by setting a cookie to
the victim. Then he'll also force the victim's web
browser to establish a connexion to a script that
will get the victim's IP. Take a look at this schema:
+----------------------------------------------------------+
| The attacker post a comment using the XSS vulnerability. |
| The code which will be executed on the client browser |
[MajorSecurity Advisory #64]Apple Safari 4.0.4 Denial of Service
Details
============
Product: Apple Safari Webbrowser
Security-Risk: low
Remote-Exploit: yes
Vendor-URL: http://www.apple.com/safari/
Vendor-Status: informed
Advisory-Status: published on 02-02-2010
http://labs.idefense.com/intelligence/vulnerabilities/
Dec 11, 2007
I. BACKGROUND
Internet Explorer is a graphical web browser developed by Microsoft
Corp. and included as part of Microsoft Windows since 1995. The
setExpression method is commonly used to assign a JavaScript expression
to a CSS or DHTML object within a web page. For more information, visit
the following URLs.
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Advisory Name: Chrome Password Manager Cross Origin Weakness
Release Date: 2010-02-15
Application: Google Chrome Web Browser
Versions: 4.0.249.78, 3.0.195.38, and likely earlier
Severity: Medium/Low
Author: Timothy D. Morgan <tmorgan (a) vsecurity . com>
Vendor Status: Update Released [2]
CVE Candidate: CVE-2010-0556
Method 1:
The updates are available for download using the following procedures:
1. Open a web browser and visit http://www.hp.com
2. In the Search field, type the applicable SoftPaq number from the list below. Start the search.
3. Select an item from the search results.
Method 1:
The updates are available for download using the following procedures:
1. Open a web browser and visit http://www.hp.com
2. In the Search field, type the applicable SoftPaq number from the list below. Start the search.
3. Select an item from the search results.
pre-deployed, the client software is installed and run like any other
application.
When the Cisco AnyConnect Secure Mobility Client is deployed from the
VPN headend, an SSL connection is initiated to the VPN headend using
a web browser. After the user logs in, the browser displays a portal
window and when the user clicks the "Start AnyConnect" link, the
process of downloading the Cisco AnyConnect Secure Mobility Client
begins. This action causes the browser to first download a "helper"
application that aids in downloading and executing the actual Cisco
AnyConnect Secure Mobility Client. The helper application is a Java
Advisory URL: http://www.toucan-system.com/advisories/tssa-2011-02.txt
--[ Introduction:
Opera is a web browser having a market share of about 2,74%
following http://en.wikipedia.org/wiki/Usage_share_of_web_browsers .
Following the vendor, it runs on "Mac, PC and Linux computers, mobile
phones and PDAs, game consoles, and other devices like the
Nintendo Wii, DS, Sony Mylo, and more."
I. BACKGROUND
---------------------
"Microsoft Internet Explorer is a web browser developed by Microsoft and
included
as part of the Microsoft Windows line of operating systems with more than
60% of
the worldwide usage share of web browsers." (Wikipedia)
Next Page>>
|
