Here are some of the most significant bugs from the past week in the BugBlog.
Sony BMG now says they used another digital rights management (DRM) scheme on other music CDs. This software, SunnCom MediaMax 5, also has a bug that may allow for privilege elevation. Sony and SunnCom have provided a patch, but independent security researchers say the patch itself has problems and you shouldn't use it. The list of bad CDs is at http://www.sunncomm.com/support/faq/releases.asp, although it may be more effective to just avoid Sony altogether. The Electronic Frontier Foundation has a FAQ page with many details at http://www.eff.org/IP/DRM/Sony-BMG/mediamaxfaq.php#2.
There is a bug in the newly released Mozilla Firefox 1.5 that may cause it to crash if you visit a malicious website. That site would need to exploit a bug in Firefox's history.dat file, which keeps track of the pages you visited. If you visit a site that has a page with a long topic, you will crash Firefox. To get it working again, you will need to erase its histry.dat file, which will be in a users Documents and Settings folder, in Application\Mozilla\Firefox\Profiles\{active profile}. As a workaround, you could go to Tools, Options, Privacy, History, and set the days history saved to 0.
A bug in the protocol called Internet Key Exchange version 1 will cause vulnerabilities in products from a number of vendors. The key exchange is a method that Internet Security Association and Key Management Protocol (ISAKMP) may use to get computers to authenticate each other over a network. With the bug, a remote attacker may be able to gain access to a computer system. According to US CERT, these vendors may have vulnerable products: Check Point, Cisco, QNX, Stonesoft, and Sun Microsystems. More companies may be added to the list. See http://www.kb.cert.org/vuls/id/226364 for updates.
See the BugBlog for continuing coverage of bugs and other things that go wrong with your computer.
Article comments
1 - Aaman
Is there a fix for the Firefox bug yet? I installed 1.5 recently
2 - Bruce Kratofil
There is no fix yet - but there is some workaround info. That's probably where they will post news of a fix, too.
This isn't going to be a problem at 99.5% of websites- it just if you happen to visit one where they are intentionally trying to harm their visitors.