ru.linux

 
 - RU.LINUX ---------------------------------------------------------------------
 From : Pavel Vasilyev                       2:5020/1042.65 11 Sep 2005  07:17:22
 To : All
 Subject : What Firefox and Mozilla users should know about the IDN buffer overflo
 -------------------------------------------------------------------------------- 
 

 
 On September 6 a security vulnerability affecting all versions of Mozilla
 Firefox and the Mozilla Suite was reported to Mozilla by Tom Ferris and on
 September 8th was publicly disclosed.
 
 On September 9, the Mozilla team released a configuration change which, as a
 temporary measure to work around this problem, disables IDN in the browser. IDN 
 functionality will be restored in a future product update. The fix is either a
 manual configuration change or a small download which will make this
 configuration change for the user. Instructions on administering these changes
 can be found below.
 
 How to update
 
 There are two methods for resolving this problem. The first method is to install
 a small download and the second method is to manually change the browser
 configuration. You only need to do one of the two.
 Installing the Patch
 
     * To install the security patch for Firefox or the Mozilla Suite, follow
 these instructions:
          1. Firefox and Mozilla Suite users click this link:
 http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.6/patches/307259.xpi
          2. In the Software Installation window, click the "Install Now" button.
          3. Exit and restart your Mozilla or Firefox browser.
     * To verify the fix in Firefox and the Mozilla Suite, be sure to restart the
 browser and then follow these steps:
          1. In Firefox Click Help -> About Mozilla Firefox and verify that the
 user agent string contains "(noIDN)"
          2. In the Mozilla Suite Click Help -> About Mozilla and verify that the
 user agent string contains "(noIDN)"
 
 Manually Configuring the Browser
 
     * To manually change the browser configuration for Firefox or the Mozilla   
 Suite, follow these instructions:
          1. Type about:config into the address field and hit Enter.
          2. In the Filter toolbar, type network.enableIDN.
          3. Right click on the the network.enableIDN item and select toggle to  
 change value to false.
     * To verify the fix in your Firefox or Mozilla application, be sure to
 restart the browser and then follow these steps.
          1. Type about:config into the address field and hit Enter.
          2. In the Filter toolbar, type network.enableIDN.
          3. Ensure that the the value for this item is set to false.
 
 We value our users' safety and security and will continue to make all efforts to
 release secure products and respond quickly when security vulnerabilities are
 identified in our software.
  Memento morri !
 --- GoldED+ 1.1.5 (Linux 2.6.12.5 i686)
  * Origin: Just for Fun! - Hе хрена себе повесилились...=) (2:5020/1042.65)
 
 

Вернуться к списку тем, сортированных по: возрастание даты  уменьшение даты  тема  автор