Firefox Flaw a Hoax, Admits Speaker
8251
One of the speakers at a Toorcon security conference session last weekend has admitted that claims he and an accomplice made regarding an "unfixable" flaw in Firefox, and a video of the two purportedly exploiting this flaw, were a not-so-elaborate hoax.
14206
InfoWorld - A flaw in the pop-up blocker of the open-source browser Firefox could allow an attacker to access local files, according to security analysts.
350003
TechWeb - The problematic fix, issued last December, affected the Firefox browser and the SeaMonkey application suite.
450989
A serious flaw in how Firefox handles log-ons could be used by identity thieves to dupe users into disclosing passwords, a noted security researcher says.
353081
Blog: Recently patched browser from Apple springs another leak.
387184
Ziff Davis - Security researchers have uncovered a spoofing flaw in Internet Explorer that could allow a scammer to display a fake Web site with all the attributes of a genuine, secure site.
450641
ZDNet Australia is reporting that Microsoft does not believe Mozilla Firefox is a threat to Internet Explorer. Steve Vamos, who heads the software giant&#39;s Austrialian operation, does not believe IE&#39;s market share is under attack from Firefox.
174102
Zawodny  threads off of Scoble  on the IE issue:  "I have to say, when I first read that I nearly fell off my chair laughing. I was thinking "how stupid ARE these IE guys?!?!?!" But we all know that Microsoft is full of smart people who care about what they're doing. So something really doesn't compute here."  "Last time I checked, IE wasn't even close to feature parity with Mozilla's browsers. No popup blocking, no tabbed browsing, etc."  "Does the IE team really not know what their product is missing?"  Perhaps.  It's highly likely that they just don't know.  The bigger issue here is that Microsoft products can't fail and they can't succeed.  Microsoft has 40-50 billion in the bank.  There ...
729334
(InfoWorld) - A vulnerability in Microsoft Internet Explorer (IE) browser could help fraudsters make phishing Web sites appear legitimate, a security researcher reported Wednesday. The flaw lies in the way IE7 processes a locally stored HTML (Hypertext Markup Language) error message page that is typically shown when the user cancels the loading of a Web page, said Aviv Raff, a security researcher based in Israel. The error message tells the user that "navigation to the webpage was cancelled," and offers the user the opportunity to "refresh the page." If the refresh link is clicked, IE can be tricked into displaying the wrong Web address for a page. Raff has published proof of concept code that shows how IE can be made to display a Web page on his Web site as if it is from the cnn.com domain. This flaw could be exploited by phishers who want to make their spoofed Web sites appear legitimate, Raff said. "I can inject a script that will display anything I want in the page when the user clicks the 'refresh' link," he said via instant message. "Combining this with the design flaw, an attacker can render in the browser whatever he wants with whatever URL he wants in the address bar." This type of bug is known as a cross-site scripting vulnerability. It affects IE 7 on Vista and Windows XP, Raff added. Microsoft could not immediately confirm Raff's findings, but the company issued a statement saying that it is investigating the issue and is "not aware of any attacks attempting to use the reported vulnerability or of customer impact at this time."
177433
Firefox attack a 'stand up comedy routine' Two presenters razzed developers of the open source Mozilla browser this weekend at the ToorCon hacking convention in San Diego with claims that the browser's Javascript implementation is flawed, but the lecture appears to have been more stand-up comedy routine than substantiative research.â¦
416887
(InfoWorld) - Makers of some of the most popular extension software used by the Firefox browser are not doing enough to secure their software, a security researcher said Wednesday. The problem is that many widely used Firefox extensions, including toolbars from Google, Yahoo, and AOL, do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher who blogged about the issue on Wednesday. Soghoian is best known as the researcher who attracted the attention of the FBI late last year after publishing a tool that could be used to print fake boarding passes. The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the SSL Web protocol. SSL Web sites, which begin with "https://," use digital certificates to provide users with some level of assurance that they're not connecting with a fake server. Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled Web site, it is common for commercial extension-makers like Google to host their software on an unsecured site, Soghoian said in an interview. This leaves users vulnerable to a "man-in-the middle" attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension. It wouldn't be easy for an attacker to pull this off, however. In one scenario, the hacker would set up a malicious wireless access point in a public area where people are using wireless connections. He could then redirect extension update traffic to a malicious computer. "An attacker who sets up a wireless access point can then infect anyone who connects to it," Soghoian said. The Del.icio.us Extension, Facebook Toolbar, Ask.com Toolbar, LinkedIn Browser Toolbar, Netcraft Anti-Phishing Toolbar, and PhishTank SiteChecker are also vulnerable to this issue, Soghoian said. Though Soghoian said Firefox users should avoid extensions that are not from the secure Firefox add-ons site, not all security researchers see this as a major issue. "It's just yet another vulnerable design among billions,"said Gadi Evron, security evangelist for Beyond Security. "I don't see it as that critical. There is no inherent vulnerability, but it does make the over-whole design weaker, and that should probably be addressed" Evron said it was "silly" that sites weren't using SSL for these extensions. Soghoian said he notified Google, Yahoo, and Facebook of the issue in mid-April, but nobody had addressed the issue as of Wednesday. Just hours after Soghoian went public with his findings, Google said it would "soon" have a fix for the problem. It's common for Web developers to ignore security in the rush to push out new and cool features, Soghoian said. "Your average Web 2.0 developer doesn't learn about security," he said. "Google has a spectacular security team ... my suspicion is that one hand wasn't talking to the other."
23136
The hacker who discovered a recently patched QuickTime flaw affecting the Firefox browser says he has found an equally serious flaw in Adobe Systems Inc.&#39;s PDF file format.
557774
The same hacker who has found recent flaws in QuickTime and Windows Media Player claims to have discovered a PDF bug.
739533
A vulnerability in the way the Firefox browser handles Javascript drew attention at a Saturday presentation at the ToorCon hacker conference, and Mozilla developers entered the week "heads down" in search of a solution.
630854
Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.
47409
Mozilla works to fix a Firefox browser flaw that could give attackers unauthorized access to data on a victim's PC.
719808
Security analysts say a flaw in the pop-up blocker in the Firefox browser could allow an attacker to access local files.