Firefox 3.6.13 Released

Modzilla has released an update to Firefox to address various security and stability issues. 

Fixed in Firefox 3.6.13

MFSA 2010-84 XSS hazard in multiple character encodings
MFSA 2010-83 Location bar SSL spoofing using network error page
MFSA 2010-82 Incomplete fix for CVE-2010-0179
MFSA 2010-81 Integer overflow vulnerability in NewIdArray
MFSA 2010-80 Use-after-free error with nsDOMAttribute MutationObserver
MFSA 2010-79 Java security bypass from LiveConnect loaded via data: URL meta refresh
MFSA 2010-78 Add support for OTS font sanitizer
MFSA 2010-77 Crash and remote code execution using HTML tags inside a XUL tree
MFSA 2010-76 Chrome privilege escalation with window.open and <isindex> element
MFSA 2010-75 Buffer overflow while line breaking after document.write with long string
MFSA 2010-74 Miscellaneous memory safety hazards (rv:1.9.2.13/ 1.9.1.16)

APPLE-SA-2010-12-07-1 QuickTime 7.6.9

Apple has released an update to QuickTime to address several vulnerabilities related to Leopard 10.5.x. This update is to address the ability of an attacker to craft a malicious QuickTime file to gain access to a user system. The update was part of a larger package for Mac OSX users for OSX 10.6.x. 

Google Releases Version 8.0.552.215 of Chrome

Google's Chrome has generated a browser security defensive arms race and the recent update that address 800 bug fixes and include new security layers demostrates Google is in it to win it. Users and administrators should be overjoyed at the inclusion of built in PDF viewer within a sandbox. Adobe's Reader X also currently will perform much of its tasks within a sandbox as well, however including this layer as a defacto standard in browsers is an excellent move. Google is currently working with Adobe to place to run Flash within the Chrome sandbox and a release is available for Windows at this stage. Sandboxes are not a cure all but just another layer of defense, what is interesting is that browsers now are addressing extension/plugin security with the us of a sandbox. 

Ultimately we must continue to demand higher quality of code from extension/plugin developers and not place all our defenses in sandboxing. (Developers must still ensure secure coding principles such as verification, validation and unit testing and not fall into the trap, "Oh the sandbox will take care of that.") Chrome is an excellent browser for the Mac Platform, has a robust set of extensions, and should be considered an alternative to using Firefox especially on Windows systems in dual office deployments. Safari is still hard to beat in Mac OSX but I think that Google really is producing a quality product in Chrome which users should really consider using. 

APPLE-SA-2010-11-22-2 Apple TV 4.1

Two critical Common Vulnerabilities and Exposures in FreeType and libpng. libpng has been updated to version 1.4.3, a malicious user can execute arbitrary code. FreeType has been updated to version 2.4.2 to address issues related to processing of a maliciously crafted font. This vulnerability has been present in other Apple products.

One important thing to keep in mind is that devices such as Apple TV, xBox 360 and the WII all are devices that if online have to be part of a risk assessment. Just as mobile devices and the way in which users use them is important to understand so are these devices.

APPLE-SA-2010-11-22-1 iOS 4.2

Apple has released iOS 4.2 which addresses security issues in addition to allowing iPad users to take advantage of features such as multi-tasking. 

Major security issues in WebKit have been addressed including vulnerability and/or bugs related to pre-fetching DNS, memory corruption, CSS counter un-initialized pointer, design issues in handling visited pseudo class, input validation and color cast issues related to SVG documents. Other fixes related to iAd, ImageIO, libxml, CoreGraphics and FreeType have also been addressed. In all a total of 26 Common Vulnerabilities and Exposures are address in the WebKi alone. 

Users should update to the latest version but make sure to backup your device before the upgrade.