Windows and Fire Fox updates!

[bob3160]

In following with Microsoft's "megapatch" on Tuesday, Mozilla Corporation updated its Firefox browser to patch a staggering 24 vulnerabilities.

The new Firefox v1.5.0.2 includes 7 patches, with 5 of them marked critical. Mozilla Corporation also released 11 new patches for the older Firefox 1.5, and 15 for the Firefox1.0x line.

Compared to Microsoft's every-second-Tuesday schedule, Mozilla Corporation releases their security updates erratically (their last update was in February, 2006). They now plan on moving to a schedule that will release their updates every six or eight weeks.

If you are running Firefox or Internet Explorer, it is extremely important that you apply the latest updates immediately. If you use Internet Explorer, you can update using the Windows Update Website:

http://windowsupdate.microsoft.com

If you use Firefox, you can simply download the updates from the browser or download the latest Firefox from Mozilla's website.

http://www.mozilla.org

Whenever an exploit is discovered, it leaves an open opportunity for hackers to attack the vulnerabilities exposed. Symantec said it takes an average six days after the release of a security fix for another exploitation to occur.

(Source: CNet: news.com)

[Lisandro]

Mozilla Corporation releases their security updates erratically (their last update was in February, 2006).

You're right Bob...  :'(
More than this, the Mozilla updates aren't stable at all, I mean, some system are deeply affected by them and the user should went back to the 'old' version. We don't have a stable environment after the update...

P.S. I'm using Firefox as default browser now.

[bob3160]

P.S. I'm using Firefox as default browser now.

Tech my friend,
How about trying GreenBrowser       

[DavidR]

I'm not sure I would call the updates erratic, rather they are released quickly after a perceived/know threat. I would much prefer that frequency to any artificial pre-defined schedule of update release, such as patch Tuesday. Even Microsoft have broken that rule for serious threats which are being currently exploited.

[Lisandro]

P.S. I'm using Firefox as default browser now.

Tech my friend,
How about trying GreenBrowser       

I've been using Maxthon for a long time... just trying to use Firefox and get used to it.
In fact, the extension power (when they work  ) makes Firefox very flexible, fast, full of features that you can choose.
Maybe sometime I'll take a look on GreenBrowser. I've downloaded a long time ago when you started to talk good things about it... Maybe I've choosed Maxthon just because it's not only in English at that time.

[FreewheelinFrank]

I think I'd rather use a browser that works hard to find and fix vulnerabilities before they become public and hackers have a chance to exploit them, than a browser that allows vulnerabilities with exploit code "in the wild" and used on hundreds of websites to remain unpatched for weeks. No contest really.

Firefox updates when necessary. Hence erratically. IE updates regularly 1)because there's usually a vulnerability to patchevery month and 2)to allow IT people to evaluate the impact of updates. The second is not such a good thing when it leaves users exposed to attack for weeks.

More than this, the Mozilla updates aren't stable at all, I mean, some system are deeply affected by them and the user should went back to the 'old' version. We don't have a stable environment after the update...

Tech, have you tried uninstalling all your extensions and then updating? I've heard a lot of problems have been caused by extensions- not the program itself.

[bob3160]

Frank, why  is it so hard to accept that the more popular FireFox becomes,
the greater the number of exploits will be. That's just a fact of life it's not
an indication of a defective browser. 

[FreewheelinFrank]

These are not exploits, they are vulnerabilities. Their being found is nothing to do with the popularity of Firefox. It's down to the code being open source- people find these vulnerabilities, report them and Mozilla fixes them before exploits emerge. In contrast with IE, where people find a vulnerability and have to publish proof of concept in exploit code before MS will even acknowledge it.

Mentioning IE and Firefox patches together is just comparing chalk and cheese.

And don't believe the BS that certain people put about that I and anybody else who sticks up for Firefox is a "Fanboy" who can't accept any criticism of the browser: that's just a juvenile attitude- I've criticised Firefox myself in the past.

[galooma]

the BS that certain people put about 

That would be Moron Central I presume . Gettin the turd polish out again it seems .

[Wulf]

It's beyond me why security aware people use anything other than this browser
http://secunia.com/product/4932/.
Now check out firefox http://secunia.com/product/4227/
and Internet Explorer http://secunia.com/product/11/
No prize for guessing which one I use.

[DavidR]

I have tried Opera on a number of occasions and I still don't like the interface, it hasn't survived more than a day or so on every trial before it got removed but I still keep looking.

So there is more than simply the number of vulnerabilities/attacks, I'm sure that now opera is freeware it may well increase its customer base, raising it head above the parapet for the black hats to take pot shots at.

However there simply isn't that much difference between the two, certainly not enough to warrant a change of browser.

The Secunia database currently contains 0 Secunia advisories marked as "Unpatched", which affects Opera 8.x.
Currently, 0 out of 13 Secunia advisories, are marked as "Unpatched" in the Secunia database.

Mozilla Firefox 1.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical

Currently, 2 out of 28 Secunia advisories, are marked as "Unpatched" in the Secunia database.

Both of those relate to low risk advisories from 2004 with pre 1.0 versions of firefox, so I'm not exactly sure if they are still applicable to 1.5.0.1 or .2.

Neither browser has a serious security issue, so then it has to come down to user preference and I know which I prefer

[CharleyO]

***

I have to agree in some way with all of you. In reverse, I have to disagree in some way with all of you.   

Currently, I am mostly using Opera9 Beta (also tried 8.54) after having used IE7 Beta2 since it's release and IE6 before that. In the past I have also tried various browsers before now. Many of you know I have tested many different browsers this year. Most of them are based on IE's engine with a few on Mozilla. Some of the IE based ones actually are faster and a little more secure than IE itself. With all the many skins/themes available for IE, Mozilla, and Opera, surely there is a "look" anyone can accept.

The best thing that could happen for IE would be if it were removed from the OS but MS continues to fail to do this. Open Source browsers & OS will almost always respond quicker than MS when it comes to patching vulnerbilities/exploits because those working on such have a personal input to the product instead of it being just "a job to do."

Anyway,  the browser with the most vulnerabilities/exploits will always be the one that is the most used. Of course, that has been IE for many years and will be for many more years. As FireFox (or any Mozilla browser) usage increases, so will the vulnerabilities/exploits. The same would also happen to Opera. The fact is that malware writers/users will go after the most used browser (or OS, programs, etc) in the effort to effect/infect the most users possible. To think otherwise is to not know/understand "the ememy" of all of us who are security conscience.

"What one person(s) can code, another person(s) can break. It is only a matter to time & need."


***

[Wulf]

***



Anyway,  the browser with the most vulnerabilities/exploits will always be the one that is the most used. Of course, that has been IE for many years and will be for many more years. As FireFox (or any Mozilla browser) usage increases, so will the vulnerabilities/exploits. The same would also happen to Opera. The fact is that malware writers/users will go after the most used browser (or OS, programs, etc) in the effort to effect/infect the most users possible. To think otherwise is to not know/understand "the ememy" of all of us who are security conscience. 

"
***

You hit it right on the head here CharleyO.
Venturing out onto the Internet these days requires that you do your homework first. Most do, good firewall, antivirus program, spyware programs, proxy connections, and then they connect with a vulnerable browser! Why? Becaused they always used it? Like the look of it? It's the peoples one?
So what if it does leak like a sieve? I've got other programs to deal with any problems it brings home with it!
In my mind, your security begins with your browser, and if there's one freely available that isn't going to drag in the wolves with the shopping, that's the one I'm gong to use. Opera does it for me.
 If the situation changes I'll miss Opera.