Google Chrome update fills in parsing bug
Browser engine gets security tune-up
SaaS data loss: The problem you didn’t know you had
Google has published a update to its Chrome browser that addresses a newly discovered high risk security hole.
Chrome version 3.0.195.24 sorts an error in processing long floating point numbers that creates a means for hackers to execute malware within the Google Chrome sandbox. The flaw in the dtoa() component of Chrome's engine is of a type that might lend itself to drive-by download attacks, as explained in Google's advisory here.
Although any malware would only run inside Chrome's sandbox, Google still defines the flaw as "high risk". Security notification firm Secunia goes further and describes the flaw, discovered by Maksymilian Arciemowicz of SecurityReason (advisory here), as "highly critical". ®
COMMENTS
Interesting balance of comments
"Critical security problem in browswer promoted as 'inherently secure'" - 4 comments
"Wales adopts wider use of average speed cameras" - 109 comments.
C'mopn guys, it's WALES. It's not as if anyone actually goes there.
AC to avoid the attentions of the Llu Llux Llan.
How damage
I'm curious, how much damage could someone actually from the sandbox? Disk access? Unrestricted Memory access to the chrome processes space? Anyone have a link?
Misses the point of sandboxing
The point of the sandbox is that it generally prevents drive-by downloads. The sandbox works to stop any persistent changes to local disk. This makes bugs inside the Chrome sandbox relatively uninteresting. In the current economies, malware authors are targeting "Critical" vulnerabilities. Thanks to the sandbox, Chrome has relatively fewer of those.
IT infrastructure monitoring strategies
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
Data control in the cloud
Cloud based data management
Enabling efficient data center monitoring
