Browser Security Test

Kiitti linkistä...! Mä oon vähän etsinytkin tämmöstä selaintestisivua. Hei, onkos muita testisivuja joilla esimerkiksi pystyis testaan mahdollisia reikiä käyttiksessä?

Molemmat testit tehty ilman virustorjuntaa ja Zonealarm päällä.

Windows 98SE suomenkielinen

Internet Explorer 6

Browser Security Test Results
Dear Customer,

The Browser Security Test is finished. Please find the results below:

High Risk Vulnerabilities 3
Medium Risk Vulnerabilities 7
Low Risk Vulnerabilities 0



Opera 7.54

Browser Security Test Results

Dear Customer,

The Browser Security Test is finished. Please find the results below:
High Risk Vulnerabilities   0   
Medium Risk Vulnerabilities   0   
Low Risk Vulnerabilities   0

Mozilla Firefox 1.0

Browser Security Test Results

Dear Customer,

The Browser Security Test is finished. Please find the results below:
High Risk Vulnerabilities   1
Medium Risk Vulnerabilities   0
Low Risk Vulnerabilities   0

New bugs keep coming! Sign up for announcements of new tests.

Questions about the test? Read the FAQ.

Still having questions? Send us your feedback.

Want to know how everyone else is doing on Browser Test? Check our statistics.

Help! My browser is hijacked! Read our step by step tutorial on how to clean your computer from browser hijackers and unwanted adware.
High Risk Vulnerabilities
Sun Java Plugin Arbitrary Package Access Vulnerability / Opera Java Vulnerability (idef20041123)
Description

Java Plugin allows web browsers to run Java applets. Java plugin may be used by Internet Explorer, Mozilla (and Mozilla-base browsers, such as Firefox), and other browsers.

When a browser opens a web page that contains a Java applet the browser automatically downloads the applet and runs it locally. To protect the user from malicious applets all the applets run in so called "sandbox". The sandbox restricts what an applet can do. For example, the sandbox will not allow an applet to open local files or start programs.

This bug in Sun Java Plugin allows a web site to bypass the sandbox and execute Java code that the sandbox will normally not allow and possibly gain control over the client computer.

Opera does not use Sun Java Plugin, but has a similar bug in its interface to Java.
Technical Details

Sun Java Virtual Machine contains sun.* packages that are only supposed to be used internally, by the virtual machine itself. Some private classes allow direct access to memory or modifying private fields of Java objects. If an applet attempts to load one of those packages a security exception is thrown. If an applet could load those classes it could turn off Java Security Manager and break out of Java sandbox.

JavaScript can access properties and methods of Java applets embedded on the page. It is possible to load a private package from JavaScript as shown in the code below:

var c=document.applets[0].getClass().forName('sun.text.Utility');
alert('got Class object: ' c)

Java Reflection API allows objects to examine their own structure (for example, find out the class of the object or the available methods). Reflection API defines getClass() function that returns the object's class. forName method of Class object loads the named class. The same operation done from the Java applet instead of JavaScript would fail.

Opera allows Java applets to access sun.* classes due to configuration settings.
Recommendations

Upgrade Java Environment to version 1.4.2_06 or later. It can be downloaded from http://java.sun.com/j2se/1.4.2/download.html

Opera users should upgrade to version 7.54u1 or later to fix this vulnerability. For earlier versions of Opera the following workaround is available:

Locate the file called opera.policy in Opera installation directory and find the following lines in the file:

grant {
permission java.lang.RuntimePermission "accessClassInPackage.sun.*";


Muut selaimet, IE6, Opera Beta8, Avant Browser ja Maxthon selvisivät puhtain paperein.

High Risk Vulnerabilities   0
Medium Risk Vulnerabilities   0
Low Risk Vulnerabilities   0

Firefoxin turvallisuus näyttää olevan ylimainostettu ja liioiteltu juttu..

mulla se näytti kaikissä pyöreetä 0 joten vika on sinulla ei muilla ei kannata päästää niitä vakoiluohjelmia jotka niiät aukkoja tekee...