Business IT - Technology for your business

No. 1 Story

Mobile operators get fixed price spectrum renewal in $3b Government windfall

The Government has offered Australia's three mobile operators, and vividwireless, renewal of their existing spectrum allocated on 15 year licences in the late 90s and early 2000s at set prices, while the Government expects to rake in $3 billion.

read more

Pwn2Own winner's Firefox hole plugged

Business IT - Open Source

Firefox updates are arriving thick and fast. The latest fixes a flaw that was discovered by one of the winners in last month's Pwn2Own contest.


Just over a week after Firefox 3.6.2 was released to fix a remotely exploitable security vulnerability, version 3.6.3 arrived to patch a bug revealed during the Pwn2Own hacking contest held at the CanSecWest conference last month.

A security researcher at MWR InfoSecurity known simply as Nils identified a flaw in Firefox 3.6.x that could be exploited to run arbitrary code. He won a Sony Vaio notebook, $US10,000, and other benefits relating to contest sponsor Tipping Point's Zero Day Initiative.

According to the security advisory from Mozilla, "By moving DOM nodes between documents Nils found a case where the moved node incorrectly retained its old scope. If garbage collection could be triggered at the right time then Firefox would later use this freed object."

The release notes imply this is the only fix in version 3.6.3.

Mozilla has indicated that while Nils' exploit is only useful against Firefox 3.6.x, the underlying bug will be patched in a future release of version 3.5.x "just in case there is an alternate way of triggering the bug."

Users of Firefox on Windows or Mac OS X may most easily update to the new version by using the Check for Updates command. The most recent versions of Firefox and other Mozilla programs may be downloaded here.

 

Loading comments ...

- sponsored feature -

The Death of Traditional BI: What’s Next?

How to Make Business Discovery Work for Your Business IP PABX BUYING GUIDE

Business Discovery takes its cues from consumer apps. Like Google, it encourages us- ers to hunt for and explore data without worrying about or even noticing the underly- ing technology. Their entire experience is working within an intuitive interface to get real-time, self-service results with only minimal training. ...more