Firefox / Mozilla vulnerability, Win users, upgrade ASAP!

[chicken]

Mozilla/Firefox has finally been hit with a bug, but a patch is already
available:

Here is a re-post of our main security System Admin here at Brown, warning us on the SYSADMIN listserv.

Windows users, please upgrade your Mozilla and Firefox browsers to 0.9.2 -- remember, as the man says the link still says 0.9.1, but it really leads to an 0.9.2 release,

He also reminds us once again to run Windows Update to fix a few I.E. bugs, and to use I.E. as little as possible, since it has many unfixed bugs.

EDIT: Being a Mac user RULES!

---- Forward from System Admin: -----

Many of you have heard me describe Internet Explorer vulnerabilities and
have begun to use or are using Mozilla/Firefox. If you are using these
products you need to upgrade your browser to fix the latest browser
vulnerability.

The latest vulnerability allows you to execute a windows executable from
a web page with the following command:

<a href=shell:windows\system32\cmd.exe>CMD.EXE</a>

The patch tells Mozilla/Firewfox to ignore the "shell" portion of the
above HTML. It may be possible to use this flaw to run arbitrary code
on your system, so you should upgrade ASAP. This vulnerability does not
work in Opera (tested version 7.50). Internet Explorer asks you if you
wish to run the command when you click on the link, but will execute it
if you click the "Open" button. Upatched versions of Mozilla and
Firefox will open the link without prompting you.

http://www.mozilla.org/products/firefox/ - Firefox download page (lists
0.9.1 as latest version, but download link gives you versio 0.9.2).
http://www.mozilla.org/products/mozilla1.x/ - Mozilla download page,
1.7.1.

http://www.eweek.com/article2/0,1759,1621463,00.asp - eWeek article by
Larry Seltzer

Also, while we're on the subject of patching browsers, don't forget to
apply the latest windows updates to fix the latest IE security
vulnerabilties (See advisory from yesterday).

Comments

[maryavatar.livejournal.com]

Nuts, I had to delete Real Player to get enough disk space. I need a new computer.

Y'know, it's so wrong that I don't have an 'Oh crap!' icon.

[chicken-cem.livejournal.com]

And ironically, you cannot now MAKE an "Oh crap!" icon since, you, uh, don't have enough disk space. Catch-22!

[chicken-cem.livejournal.com]

P.S. -- My disk is full, too. Instead of buying a new computer, I'll probably just buy a gargantuan external Firewire 800 hard drive in the neighborhood of 300 GB (room for vidding).

[maryavatar.livejournal.com]

UG has bought a huge box of computer parts, and is in the process of building himself a new computer. It's very shiny, and he says I can have his old one. Which is excellenct, since his 'old' one is four times as powerful and has over ten times the disk space of my one. Whee!

[chicken-cem.livejournal.com]

Excellent! And pretty free.