Major browsers bitten by security bugs

That seemed to be Wednesday's lesson from security information provider Secunia for the developers of the major Internet browsers. The company released information on two common security issues with the tabbed browsing feature found in several flavors of the Mozilla Foundation's browsers, the Opera browser, the Konqueror browser for Linux and two third-party plug-ins that add the feature to Microsoft's Internet Explorer.

One flaw would let a malicious Web site that's open in one tabbed window have access to the information typed into another tabbed window. The other flaw lets a malicious Web site open a dialog box that seems to originate from a site displayed in a different browser tab.

"I think the issue is that they didn't consider the consequences of having all the browser tabs in one application window," said Thomas Kristensen, chief technology officer for Secunia. "That is what fooled them."

Secunia recommends that Web surfers using the tabbed feature should disable JavaScript or simply avoid visiting trusted Web sites when an untrusted Web site is open in one of the browser tabs.

The KDE Project fixed the flaws in the latest version of Konqueror, which was released Tuesday. Chris Hofmann, director of engineering for the Mozilla Foundation, said the flaws should be fixed in Firefox by the time Firefox 1.0 ships, in the next couple weeks. Opera could not immediately be reached for comment.

Microsoft's browser is also prey to two more-serious flaws found by another security researcher, who's known as "Http-equiv." The first flaw expands on a drag-and-drop vulnerability found by the researcher in August. That flaw could be used to place HTML code on the victim's computer.

According to Secunia's advisory, the second, more-serious flaw can bypass the security mechanisms put in place by Microsoft's Windows XP Service Pack 2, an update released in August that hardens the protections around the XP operating system. The latest update released this month also does not prevent an attacker from taking advantage of the flaw. The vulnerability lets an attacker execute HTML documents on the user's computer.

The two vulnerabilities, when used together, let malicious Web sites place and run code on a visitor's computer. The vulnerabilities are not completely new; they're a twist on the older vulnerabilities, Http-equiv said in an e-mail.

"It's simple, yet complicated--pretty difficult (to do), I might add," he said.

Echoing Http-equiv's assessment, Microsoft said that using the flaws for an attack would not be easy.

"Early reports indicate that significant user action is required to execute this attack," the software giant said in a statement. "An attacker would need to first entice the user to visit a specific Web site and then entice the user to take a series of specific actions on the Web site, then reboot or log off before the attack could succeed."

The company was not aware of any customers whose PCs had been compromised by the vulnerabilities.

The fact that the flaws found on Internet Explorer are more serious than the other browser vulnerabilities is par for the course, Secunia's Kristensen said.

"The impact of vulnerabilities in Internet Explorer is quite significant when compared to other browsers," he said. "The (tabbed browsing vulnerabilities) are flaws, and they are serious, and they should be fixed, but you aren't going to have your entire system compromised by them."

Yet, Http-equiv stressed that such vulnerabilities are becoming harder to find.

"The lockdown of the local zone is Microsoft's saving grace," Http-equiv said. "Anything (such as the vulnerabilities) there on in from SP2 is going to be one-off oddities." In Windows XP Service Pack 2, Microsoft added more stringent security to prevent outside programs from running unchecked on a user's machine, also known as the "local zone."