Critical Updates for Firefox Versions 3.6 and 4.0

Updates released yesterday by Mozilla for both Firefox versions 3.6 and 4.0 included critical security updates.  To get the update, click Help > About Firefox > check for updates.

Fixed in Firefox 3.6.17

MFSA 2011-18 XSLT generate-id() function heap address leak
MFSA 2011-16 Directory traversal in resource: protocol
MFSA 2011-15 Escalation of privilege through Java Embedding Plugin
MFSA 2011-14 Information stealing via form history
MFSA 2011-13 Multiple dangling pointer vulnerabilities
MFSA 2011-12 Miscellaneous memory safety hazards (rv:2.0.1/ 1.9.2.17/ 1.9.1.19)

Fixed in Firefox 4.0.1

MFSA 2011-18 XSLT generate-id() function heap address leak
MFSA 2011-17 WebGLES vulnerabilities
MFSA 2011-12 Miscellaneous memory safety hazards (rv:2.0.1/ 1.9.2.17/ 1.9.1.19)

References:

• Mozilla Firefox 3.6.17 Release Notes
• Mozilla Firefox 4.0.1 Release Notes

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

MSRT Update Includes Additional Coreflood (Afcore) Variants

Earlier this month, the FBI and the Justice Department disabled the Coreflood botnet.  The botnet was reportedly comprised of more than two million computers infected with malicious code.

The April 11 release of the Malicious Software Removal Tool  (MSRT) added Win32/Afcore (Coreflood) malware detection to support the take-down operation.  This addition was at the request of the FBI and the Department of Justice.

Although the regular schedule for releasing updates to the MSRT accompanies the monthly security updates, as explained in my article, Understanding Microsoft Anti-Malware Software, additional updates are added as needed to respond to security incidents. 

In continuing support for the take-down activities of the the Coreflood botnet, Microsoft released a second edition of MSRT.  In an MMPC Blog post, Jeff Williams, Principal Group Program Manager, MMPC explained that the updated version includes variants of Afcore released by the criminals behind it at approximately the same time as the previous edition of MSRT.

The updated MSRT also includes additional malware families, already included in the definitions for Microsoft Security Essentials and Forefront.  

The MSRT works on Windows 7, Windows Vista, Windows XP, Windows Server 2003, or Windows Server 2008 and is available from Microsoft Update, Windows Update and the Microsoft Download Center.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Insecure Wi-Fi Results in Police Raid

Do you know what can happen to someone whose neighbor uses their insecure Wi-Fi connection to distribute pornography?  How about Homeland Security I-C-E  agents breaking down the door to the house at 6:20 AM, an agent throwing the home owner down the stairs...

"Lying on his family room floor with assault weapons trained on him, shouts of "pedophile!" and "pornographer!" stinging like his fresh cuts and bruises, the Buffalo homeowner didn't need long to figure out the reason for the early morning wake-up call from a swarm of federal agents.

That new wireless router. He'd gotten fed up trying to set a password. Someone must have used his Internet connection, he thought."

It took several days for the agents to complete the examination of the home owner's computer as well as his and his wife's iPad and iPhone to determine that he was not downloading child pornography.  About a week later, authorities discovered that it was a neighbor using his insecure wireless signal.

Don't let something like that happen to your family.  Ensure that you have properly secured your wireless connection. Having a network security key or passphrase can help protect your wireless network from this type of unauthorized access.


If you have an older router that uses WEP (Wired Equivalent Privacy) and does not support WPA or WPA2 (Wi‑Fi Protected Access), I strongly suggest replacing it with a new router.  WEP security is relatively easy to crack and routers are not that expensive. 


Additional information is available in this Microsoft help document, Set up a security key for a wireless network.  Also see the below-linked instructions for configuring wireless security the some of the most popular routers.
Negear

• Belkin
• D-Link
• Linksys
• Netgear

If you still aren't convinced about the importance of securing your wireless connection, read the full story about the visit described above and the man who received a visit from the FBI after someone used a potato chip can as an antenna to boost his wireless signal and downloaded 10 million images of child porn:    NY case underscores Wi-Fi privacy dangers.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...