- BlackBerry Storm vs. the iPhone
- Digg's Kevin Rose: "We have to do better"
- Blogger warns: "Nortel doesn't make it out alive"
- Financial quagmire bringing out the scammers
- Verizon plays with the wrong e-mail addresses
Newsletters | Podcasts | Chats | Opinions | RSS Feeds | This Week In Print | IT Careers | Community | Reports | Downloads | Slideshows | New Data Center
Partner Sites:Application Performance Solutions | App Performance | Networking Solution | SafeGuard Enterprise Solution Center | SOA | Test your Web Filter | Value of WDS
Opera Software patched a trio of bugs in its flagship browser Tuesday, including one that a company manager used last week to slam rival Mozilla.
The update, dubbed Opera 9.26, plugs three security vulnerabilities. The most serious is rated "highly severe" by the Oslo-based developer and could be used by attackers to dupe the browser into treating image-file comments as script. "This can cause the script to be run in the wrong security context," Opera's advisory read.
But it was another, less-dangerous bug that raised the ire of Claudio Santambrogio, Opera's quality assurance desktop test manager. In a post to a company blog last Thursday, Santambrogio used the flaw to take Mozilla to task (Compare antivirus products).
"Mozilla notified us of one security issue the day before they published their public advisory," said Santambrogio. "They did not wait for us to come back with an ETA for a fix. They kept their bug reports containing the details of the exploits closed to the public for a few days, and now opened most of them to everybody."
The bug, which was one of 11 that Mozilla patched Feb. 7 when it released Firefox 2.0.0.12, could let attackers spoof input fields. Mozilla said that the vulnerability could be used to dupe users into unwittingly uploading malicious code; Opera's advisory agreed.
Although Santambrogio claimed that Mozilla had opened the vulnerability's Bugzilla entry -- and thus disclosed details of the bug before Opera was able to patch -- the entry is currently locked. It is inaccessible even to users with a general Bugzilla account.
Santambrogio seemed to knock Mozilla for not abiding by the unwritten rule of "responsible disclosure," which requires that researchers wait until vendors patch a bug before revealing details of the vulnerability. "Opera is as always committed to not only protecting its users, but to making the Web a safe place. We believe in responsible [emphasis in original] disclosure of vulnerabilities affecting several vendors," he said.
Mozilla said it would not comment on the dustup.
Opera 9.26 can be downloaded from the company's Web site in versions for Windows, Mac OS X and Linux.
| NetworkWorld, Inc. | About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW |
| IDG, Inc. | CIO | Computerworld | CSO | Demo | GamePro | Games.net | IDGconnect.com | IDG World Expo | Infoworld | JavaWorld.com | LinuxWorld.com | MacUser | Macworld | PC World | Playlistmag.com | The Industry Standard | IDG List Services | IDG TechNetwork |
 |
Copyright © 1994-2008 Network World, Inc. All rights reserved. |
Partner Content
Brilliantly simple security and control solutions for email, web and endpoint
www.sophos.com
Stopping data leakage
Learn how to exploit your current security investment to control the information that flows into, through and out of your network.
Download the white paper.
Why detection rates aren't enough
Evaluating endpoint security products is a time-consuming and daunting task. Learn the six critical questions you need to ask prospective vendors to get the right endpoint solution.
Download the white paper.
Applications: taking back control
Employees installing unauthorized applications is a growing threat to business security and productivity. Cost-effectively reduce this threat by integrating control into your malware protection.
Learn more today.
Comment