Mozilla Duped by Hacker's 'Humorous' Presentation
2920
A Firefox 'flaw' revealed at a hacker conference over the weekend was a joke, hacker admits.
285360
Blog: Researcher shows how URLs can be spoofed and content arbitrary within Safari 3.0 beta.
526152
The Mozilla Foundation has fixed 10 security bugs in its open-source Mozilla and Mozilla Firefox browsers and Thunderbird e-mail reader, with the release of new versions of all three products this week. Some of the vulnerabilities could allow attackers to run malicious code on a user's PC via a malicious e-mail, a specially crafted vCard or a malformed graphic on a Web site, project leaders said.
206068
(InfoWorld) - Mozilla updated the preview of Firefox 3.0 to alpha 8 Thursday, unveiling for the first time to users several security features it has talked up for months. Among the security provisions debuting in the new alpha of "Gran Paradiso," the code name for Firefox 3.0, are built-in anti-malware warnings and protection against rogue extension updates, according to documentation Mozilla posted to its Web site. The malware blocker, which was first mocked up in June, will block Web sites thought to contain malicious downloads. The feature, a companion to the phishing site alert system in the current Firefox 2.0, will use information provided by Google to flag potentially-dangerous sites, warn anyone trying to reach those URLs with Firefox, and automatically block access to the site. Mozilla also pointed to a URL that demonstrates the new malware blocker for alpha 8 users. Also taking a bow is a check meant to prevent plug-ins' automatic updates from sending users to malicious sites where they might be infected by attack code or drive-by downloads. Firefox relies on small plug-ins -- called "extensions" in the Mozilla vernacular -- for much of its power and flexibility. Several thousand extensions have been written, the vast bulk of them by outside developers, that do everything from boost browsing speed to block irritating Flash animations. Firefox regularly checks to see if the installed extensions are up to date, and, if not, automatically pulls in the newest version and installs it. "Firefox automatically checks for updates to add-ons using a URL specified in the add-on's install manifest," Mozilla spells out in a developer's document. "Currently there are no requirements placed on these URLs. In particular, [they are not] required to be https. This allows either the update manifest or the update package to be compromised, potentially resulting in the injection of malicious updates. A demonstration of one form of compromise is already public." Most extensions are hosted on Mozilla's own servers -- at the servers feeding its Add-ons site -- but some are not; it's those off-site extensions that Mozilla wants to lock down. To stymie attacks through a compromised extension update, Mozilla will require updates -- both the actual update package and the much smaller "manifest," or notification of an update -- to be delivered over an SSL-secured connection. Or the update must be digitally signed. The change doesn't affect the initial installation of an extension, something Mozilla recognized. "[This] has no impact on the security of initial add-on installs," it told developers in the online guide. This newest preview, which can be downloaded in versions for Windows, Mac OS X, and Linux from the Mozilla site, still comes with a warning to end-users. "Alpha 8 is intended for Web application developers and our testing community. Current users of Mozilla Firefox should not use Gran Paradiso Alpha 8," the browser's release notes. Mozilla has not officially committed to a release date for the final version of Firefox 3.0. Computerworld is an InfoWorld affiliate
492868
TechWeb - A new proof-of-concept code is circulating for a Firefox vulnerability that was fixed in Mozilla's security update that was released last week.
732856
John Musarra, a long-time Mozilla fan, is getting ready to help launch the forthcoming release of the Firefox 1.0 browser the old-fashioned way: by throwing a party.
450989
A serious flaw in how Firefox handles log-ons could be used by identity thieves to dupe users into disclosing passwords, a noted security researcher says.
689090
Mozilla Corp. has acknowledged that hackers can drop malicious code into systems running Firefox when the browser is armed with any of several high-profile add-ons, including Google Toolbar and Yahoo Toolbar.
234529
Mozilla is trying to weave a new web. Not sure if it matters yet.
721339
(InfoWorld) - The security team at Mozilla Corp. is looking into a flaw in its Firefox Web browser that hackers exposed at a conference in San Diego over the weekend. In a presentation at theÂ ToorCon hacker conference on Saturday, hackers Mischa Spiegelmock and Andrew Wbeelsoi demonstrated exploit code for a vulnerability in the way Firefox handles Javascript. On Monday, Mozilla said it was busy investigating the flaw, and did not offer any security researchers for comment because, according to spokeswoman Mary Colvig, they were all "heads down" on the problem. The company also said it will patch the flaw if it deems that action necessary. The vulnerability could allow someone to execute a memory corruption attack on Firefox if a user browsed to a Web site that contained the exploit code, said Ken Dunham, director of the rapid response team at security services company iDefense, a VeriSign company. "If you were to go to a Web site that contained the exploit code, it would fill up the available memory on the computer," he said. This would create an environment in which an attacker could take over the computer to do something harmful, he added. Dunham said that iDefense labs tested the exploit code, and it was "unreliable" and crashed the Firefox browser. Because of this, he does not consider the exploit to be a critical threat to Firefox. However, "someone could make some changes to the exploit code and make it more reliable," Dunham said. He added that there are other, more critical unpatched flaws in both Firefox and Microsoft Corp.'s Internet Explorer browser that are currently under attack by hackers.
490340
Browser beware Security experts are crying foul over a new supposedly secure browser application.â¦
739533
A vulnerability in the way the Firefox browser handles Javascript drew attention at a Saturday presentation at the ToorCon hacker conference, and Mozilla developers entered the week "heads down" in search of a solution.
115494
Richard Thomas comments on a "funny little PHP 'virus'" that he's noticed coming to him via emails:   Got an email that claimed to be from my host, it used a generic return address and talked about security upgrades and such and how due to new policy to help keep a secure data center I was required to upload and run 1 of 2 files in a zip attachment, the first was a php file the other was an asp file.   Of course, it wasn't from the host, so he investigated a little further to find out exactly what was going on with the file. Basically, it was a modified nsTView file with some added emailing and password discovery code. The code was "hidden" though - through a base64_encode call on one side and then decoded it on the other to cause the server to execute the code. He even posts and example of what the base64ed code might look like.
60742
On July 10, engineers at Secunia issued a security advisory, rated "Highly Critical," warning Firefox users that their browser could be tricked into executing arbitrary JavaScript code. While Internet Explorer was originally blamed for the ability to trick Firefox, as it turns out, Mozilla admitted today its own browser is to blame, even after a patch was released.
397083
Mozilla has confirmed a vulnerability in its Firefox browser that could be used by attackers to scout out a system before they undertake a more aggressive assault.
44372
A flaw in the way the Firefox and Opera browsers handle an image file could allow an attacker to see what Web sites a person has visited.
290051
Google is Mozilla's sugar daddy.  Is this cause for alarm?