Browser Security Check

[Richard M]

http://bcheck.scanit.be/bcheck/

Mozilla Firefox passed with flying colours of course.

[Shaun]

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

In IE with SP2 and Kaspersky AV

[Millay]

Originally Posted by FireFox 1.0 XP Pro SP2

The Browser Security Test is finished. Please find the results below:
High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

and

Originally Posted by IE 6 XP Pro SP2

High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

I think it shows that IE is a perfectly acceptable browser.

I only went to firefox because It feels slick and has tabbed browsing so makes a more rounded browser in my eyes, whereas after netsscape 5 I hated the offering coz it was just plain silly to look at and use.

[bopdude]

0 problems here IE6 on XP Home SP2

But what was / is the notepad popup ??? and all the gobbldy gook ??

[MadGamer]

Originally Posted by Mozilla Firefox

The Browser Security Test is finished. Please find the results below:
High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

Originally Posted by IE6 SP2

The Browser Security Test is finished. Please find the results below:
High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

Passed with flying colours

[Bifta]

IE6 under SP2, again

High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

[Stuart W]

XP Pro, *NO* Service Pack

Firefox 1.0

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities0
Medium Risk Vulnerabilities0
Low Risk Vulnerabilities0

[MetaWraith]

Originally Posted by Millay

I only went to firefox because It feels slick and has tabbed browsing so makes a more rounded browser in my eyes, whereas after netsscape 5 I hated the offering coz it was just plain silly to look at and use.

If that's all you want, then why not use Myie2 / Maxthon
http://www.maxthon.com/

Its a skin for IE, giving tabbed browing, ad/popup blocking, mouse gestures, proxy pick list, and other goodies. Even some of the IE vulnerabilites are fixed, couldnt say if all are though.

[MetaWraith]

I've just run Maxthon on my system and it passed
(IE v6.0, XP SP1 fully patched, but no SP2),

The Browser Security Test is finished. Please find the results below:
High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

Also I noted that my configuration of the ad/popup/content filter for Maxthon blocked 22 items, and my firewall detected 2 intrusion attempts.

I can also confirm that Firefox passes, as others have already said.

[Raistlin]

Hmm, just tested with FF and got this:

High Risk Vulnerabilities1 Medium Risk Vulnerabilities0 Low Risk Vulnerabilities0
High Risk Vulnerabilities

Sun Java Plugin Arbitrary Package Access Vulnerability (idef20041123)

Description

Java Plugin allows web browsers to run Java applets. Java plugin may be used by Internet Explorer, Mozilla (and Mozilla-base browsers, such as Firefox), Opera and other browsers.

When a browser opens a web page that contains a Java applet the browser automatically downloads the applet and runs it locally. To protect the user from malicious applets all the applets run in so called "sandbox". The sandbox restricts what an applet can do. For example, the sandbox will not allow an applet to open local files or start programs.

This bug in Sun Java Plugin allows a web site to bypass the sandbox and execute Java code that the sandbox will normally not allow and possibly gain control over the client computer.

Technical Details

Sun Java Virtual Machine contains sun.* packages that are only supposed to be used internally, by the virtual machine itself. Some private classes allow direct access to memory or modifying private fields of Java objects. If an applet attempts to load one of those packages a security exception is thrown. If an applet could load those classes it could turn off Java Security Manager and break out of Java sandbox.

JavaScript can access properties and methods of Java applets embedded on the page. It is possible to load a private package from JavaScript as shown in the code below:



var c=document.applets[0].getClass().forName('sun.text.Utility');
alert('got Class object: '+c)
Java Reflection API allows objects to examine their own structure (for example, find out the class of the object or the available methods). Reflection API defines getClass() function that returns the object's class. forName method of Class object loads the named class. The same operation done from the Java applet instead of JavaScript would fail.

Recommendations

Upgrade Java Environment to version 1.4.2_06 or later. It can be downloaded from http://java.sun.com/j2se/1.4.2/download.html

[Raistlin]

Just updated the JAVA so that should sort that out

[Raistlin]

Won't even run the tests on my IE

[Mal]

I got this...

Medium Risk Vulnerabilities
Microsoft Internet Explorer file:javascript: Cross Domain Scripting Vulnerability (ldy20030910-01)
Description
This bug allows a web site to read the contents of any file on your computer. The web site has to know the exact path and name of the file. A malicious website may also be able to exploit this vulnerability to delete mail from your webmail account or to spoof trusted websites.

Note: Opera browser is not vulnerable to this problem. If you are running Opera you don't need to patch.

Technical Details
It is possible to inject JavaScript code into Search bar and Media bar in Internet Explorer using "file:javascript:.." URL. The code will be execurted in the domain context of the document that was loaded in the bar.

A malicious web site can first open a document from any domain in Search bar and then execute JavaScript code getting access to the document.

There is a technique that allows injecting JavaScript code into Local Computer zone using this vulnerability. This allows a malicious web site to get access to local files and even execute arbitrary code. See "Additional Information" for details.

From what I can gather, from Google, there's no patch You seem to have to turn off javascript. Do you lot have this turned off?

Windows 2K Pro, SP4 with IE 6, SP1:

High Risk Vulnerabilities 0
Medium Risk Vulnerabilities 0
Low Risk Vulnerabilities 0

That's good enough for me

It just crashes my IE when I run the test.