Microsoft and Netscape Communications are pointing fingers at each other over a browser-related security problem that neither company has any intention of fixing.
In a security scenario that lets a hostile Web site pilfer private
information, including email passwords and some browsing history, both
Netscape and Microsoft play a role. An exploit would use privileges granted
by Microsoft's Internet Explorer browser to run a script placed on the Web
site visitor's computer by Netscape's Communicator.
"This is by-design behavior, not a security vulnerability," said Scott Culp, security program manager with Microsoft's security response center. IE "allows a Web site to run any script that it trusts, including scripts placed on the (Web page visitor's) computer."
The security squabble comes as Microsoft faces renewed criticism of its liberal scripting security restrictions, which some have blamed for opening the door to the "I Love You" virus that struck computer networks worldwide yesterday. That virus, written in Microsoft's Visual Basic scripting language, targets the company's Outlook email program and other applications.
The software giant denies that the ongoing security issues are a result of problems with Visual Basic or its other scripting technologies. In regard to the IE vulnerability, Culp said the blame rested with Netscape for placing a script--written in JavaScript, in this case--in a known location on the client machine.
"The real issue is the fact that Netscape's installation is putting this script in a place that any Web site can find it," Culp said. "It exposes some fairly powerful functionality."
IE's documented security model has permitted the running of such client-side scripts since version 4, Culp said.
Web scripts are lines of code that let browsers execute actions without a person's interaction. Common uses of scripts on the Web include the launching of pop-up Windows or the running of tickers across the screen.
Netscape rejected Culp's analysis of the browser problem.
"It is ridiculous for Microsoft to blame an exploit running through their browser on code that's part of the Netscape installation on the hard disk," said Eric Krock, Netscape's group product manager for tools and components. "Netscape's users are not vulnerable to the same problem because our security model prevents this kind of inappropriate mixed execution of local code and hostile remote code."
The company called on Microsoft to take measures to protect people against the browser vulnerability.
"Rather than trying to blame Netscape for an IE exploit, we hope Microsoft will take full responsibility for the safety of its users and the data and code on their hard disks and for advising them on how to protect themselves from this exploit," Krock said.
Independent security analysts took Netscape's side in the disagreement.
"While the exploit only works on users who use Netscape as their main Web browser, the reason the exploit works is because of a hole in Internet
Explorer," said filtering activist and security enthusiast Bennett Haselton, who posted a demonstration of an exploit. The demonstration, as well as the exploit, works only for people browsing with IE who have Netscape installed on their computers.
Security consultant Richard Smith added: "I reported this same bug to Microsoft more than a year ago and got the same response. It is a bug that Microsoft needs to fix. Netscape fixed it themselves a few years back."
Smith said the next generation of Internet computing poses a similar problem with IE and XML (Extensible Markup Language) files.
"An incoming email message or Web page can read and send off the contents of XML files," Smith said. "It's no biggie right now, since the use of XML is just beginning. However, down the road, this might be a good way to steal private information kept by applications in XML files."
Microsoft could not be reached for comment on Smith's analysis of IE and XML.
EnerG2 opens a plant to make an engineered carbon that will improve performance of energy storage devices and make storage for start-stop hybrid cars less expensive.
Tommy Jordan, the man who shot his daughter's laptop for YouTube, gets a visit from police and child protection services. Oh, and Good Morning America.
As UC Berkeley students, the co-founders of "Back to the Roots" discovered they could grow mushrooms using recycled coffee grounds. Now their mushroom kit sells at grocery stores across the country.
For people who don't have time to tend a Zen garden, the Zen Table will handle the work for you. The table is filled with silicone beads and a robotic system that "rakes" images into the sand.
The Washington State Senate passed a bill that would charge electric car owners $100 per year to compensate for not paying gas taxes. The bill still has to pass the House.
Join the conversation