Is your graphics card driver an Internet attack vector?

Apparently so, as Context, a British security consultancy, released a security bulletin this week warning that the Web Graphics Library (WebGL) is vulnerable to denial of service (DoS) attacks and cross-domain image theft.

We spoke with Chris Sather, Product Management for Network Defense at McAfee about McAfee’s next generation firewalls that analyze relationships and not protocols.

WebGL is a specification that allows Web browsers to use OpenGL–a 3-D, hardware-accelerated graphics API–with HTML5. WebGL is built into Firefox 4 and Chrome, and included with–but not enabled by default–in Safari. Many people see WebGL as a potential open source replacement for Flash, with some added benefits. Notably, WebGL is based on markup language, which means that unlike Flash, WebGL content can be indexed by search engines.

But WebGL can be compromised–causing graphics cards to lock up or execute arbitrary code–if it’s fed overly complex shading or rendering requests, or infinite-loop requests, according to Context. “It is easy to trivialize client denial of service attacks when the only affected component is the browser process–there are numerous ways of doing this already–however in this case the attack can completely prevent a user being able to access their computer, making it considerably more serious,” Context said.

via Graphics Cards Face Internet-Borne Threats — InformationWeek.