Firefox and IE - browsers vulnerabilities

In the 4th of jun Michal Zalewski made public at http://lists.grok.org.uk/pipermail/full-disclosure/2007-June/063712.html a list of 4 vulnerabilities of Mozilla Firefox and Microsoft Internet Explorer.
There is one critical problem at the IE with the access to the cookies of some pages by third part pages. A major problem in Firefox with the iframes that could include javascript injection. Ant other two midium problems, one for the browser provided by Mozilla and the other for the Microsoft's browser.
You will find interesting the last one, here is a demo of how you can be triked that you are visiting the real cnn page.

Google Notebook in Firefox

If you use Google Notebook, you'll find it usefull. It is a firefox add-on that adds your Notebook to the Firefox sidebar. You'll habe acces to your notes from the browser and it is better the their wiget from Google.

Try it, if you don't use Notebook you may start to use it now.

Googel Notebook in Firexox sidebar - find here about it, and about instalation of it.

Windows Media Player Plug-in for Firefox

Have been released another official Microsoft plug-in.
This plug-in allows you to use Windows Media Player inside of Firefox.

It is designed to support the following Windows platforms:

• Windows XP SP2 (x86)
• Windows XP SP2 (x64)
• Windows Vista (x86)
• Windows Vista (x64)/li>

Port25 is hosting it, and you can download it from here: Download - indows Media Player Firefox Plugin

It is backwards compatible with the old 6.4 Windows Media Player. And among other things has the following new features.

Read more.

Critical Firefox hole allows password theft (IE - FF | 1 : 0)

Vulnerability lies in browser's Password Manager software

A flaw in Mozilla Corp.'s Firefox browser makes it easy for cybercriminals to steal user information on Web sites where users create their own pages, such as MySpace.com.

The flaw lies in Firefox's Password Manager software, which can be tricked into sending password information to an attacker's Web site, said Robert Chapin, president of Chapin Information Services Inc. For this attack to work, attackers need to be able to create HTML (Hypertext Markup Language) forms on the Web site, something that is allowed on blogging and social networking sites.

The attack was used in a MySpace phishing attack reported in late October. In that attack, users registered a MySpace account named login_home_index_html and used it to host a fake log-in page that exploited the flaw.

This page sent MySpace username and password information to another Web site, and MySpace users who visited the page using Firefox could have easily had their information compromised, said Chapin.

Firefox developers rate this bug critical, according to an entry in the project's Bugzilla database.

The flaw arises because Firefox's Password Manager does not perform a thorough enough check when it is deciding whether to send password information, and then does not ensure that password information is being sent to the server that requested it, Chapin said. In the MySpace attack, for example, Firefox would check to see if the form was coming from the MySpace.com domain, but did not make sure that the password information was being sent back to a MySpace server.

"From a programming point of view, this is almost like a typo," he said. "Ironically I think that's why it hasn't been discovered until now. It was just way too obvious."

Chapin has posted an analysis of this type of attack, which he has dubbed a Reverse Cross-Site Request, as well as a demonstration of how it works.

Microsoft Corp.'s Internet Explorer (IE) is also susceptible to these type of attacks because, like Firefox, it does not ensure that password information is being sent to the same server that requests it, Chapin said.

But IE is less likely to be tricked because it does a more thorough job in checking to see where the log-in form is coming from before it automatically submits password and user information, he added.

Keep the browser up to date with the season

Like your house should be ready for the holidays, get a new look to your firefox browser...

Tinseltown is a Christmas theme with holiday imagery including Christmas lights, snow, reindeer, presents and more. This theme is made eve better with great Christmas icons from Watiworks and a semi-transparent URL bar. Get in the holiday spirit with Tinseltown.

Get it here

And when you'll find a IE skin, let me know(in post coments)