Re: Antivirus

From: srm (user_at_example.net)
Date: 08/13/04 

Date: Fri, 13 Aug 2004 09:27:06 +0200

Paul J Gans wrote:
>>The Symantec site lists 14 Linux viruses. But none since 2002 and most
>>were 'proof of concept' types where the payload or potential damage was
>>classed as negligible or trivial. Most required very specific
>>environments in which to operate.
>
>
> There are vulnerabilities in many programs that run on Linux.

Indeed. Witness this recent report from Netcraft... 

--
Recent phishing-related security problems for Internet Explorer have 
prompted more than a few Windows users to sample alternative browers, 
including Firefox, the new open source browser from the Mozilla Project, 
as well as Opera.
But it turns out Internet Explorer isn't the only browser vulnerable to 
spoofing. On July 30 a published exploit demonstrated how to 
convincingly spoof a secure web site (in this case PayPal) in Firefox 
and Mozilla by using XML to alter the browser interface (Note: The spoof 
doesn't work in IE).
"The problem is that Mozilla and Mozilla Firefox don't restrict websites 
from including arbitrary, remote XUL (XML User Interface Language) 
files," Secunia writes in its analysis. "This can be exploited to 
'hijack' most of the user interface (including tool bars, SSL 
certificate dialogs, address bar and more), thereby controlling almost 
anything the user sees." Notes from the Bugzilla web site indicate that 
the Mozilla development team was aware of the XUL problem as early as 
Dec. 1999 but kept the security hole confidential, apparently until the 
exploit was published.
On July 26, a separate Firefox spoofing issue was found, which allows a 
malicious website to use another site's SSL certificate to present a 
secure spoofed page with a "locked" icon. The exploit manipulates the 
cache, a directory where the browser stores web pages it has viewed. 
Both spoofing issues are known to affect Firefox 0.9.2, but reportedly 
have been fixed in the latest version, 0.9.3 (although some users say 
the spoofing flaw persists). The brower's official 1.0 release is 
tentatively scheduled for Sept. 14.
A spoofing flaw has also been found in Opera, which allowed an iframe 
tage to display spoofed content. The problem has been fixed in Opera 
7.5.4, whch was released August 5.
--

Relevant Pages

  • Re: [SLE] Upgraded Mozilla still renders wrong
    ... It's not a problem with the browser but the CSS ... >I have Mozilla 1.7.5 installed from a binary tarball I got directly from ... this version still renders some pages horribly. ... >>know that Mozilla and Firefox on Windows, ...
    (SuSE)
  • Re: OT: Mozilla Firefox 3 is out as of yesterday
    ... These changes have been around since "Mozilla" was king of the browsers (pre Firefox). ... It seemed that anything greater caused one of the versions of Mozilla to get lost in it self. ... This value is the amount of time the browser waits before it acts on information it recieves. ... are a lot better than myself in writing reviews, ...
    (alt.sys.pc-clone.dell)
  • Re: OT: Mozilla/Firefox (was:Re: Windoze ends year with a major cert ...)
    ... >>Firefox and Mozilla are different browsers? ... > Mozilla is a suite of browser, mail/news client, IRC client and HTML editor. ...
    (comp.os.vms)
  • Re: OT: Mozilla/Firefox (was:Re: Windoze ends year with a major cert ...)
    ... >> Mozilla is a suite of browser, mail/news client, IRC client and HTML editor. ... >So Mozilla is both the suite and the browser in that suite and Firefox ...
    (comp.os.vms)
  • Re: Mozilla VS Fire Fox, was ( Rip Calvin The Dog 1995-2005)
    ... Firefox extensions are built with XUL, a XML User interface markup Language which makes it relatively easy for people with a background in web programming and design to create extensions. ... The idea actually started with Mozilla, but it was greatly expanded and enhanced with Firefox. ...
    (alt.gathering.rainbow)