Pop-up blocker problem found in Firefox
111507
(InfoWorld) - A flaw in the pop-up blocker of the open-source browser Firefox could allow an attacker to access local files, according to security analysts. The flaw, however,Â does not affect Firefox 2.0, the latest version of the browser, but version 1.5.0.9, according to Beyond Security, which credited the find to Michal Zalewski. The attack could occur if a user manually allows a pop-window to appear. The browser normally blocks access to local files, but when a pop-up is manually allowed, "normal URL permission checks are bypassed," Beyond Security said. To make the hack work, however, a malicious file containing the exploit code would have to already be on the system, the advisory said. The file could be planted on the system by enticing a user to click on a link that would download the file. The malicious file could then enable access to other files, which could be transferred to a remote server. Mozilla, the distributor of Firefox, could not immediately comment on the report. Â
562962
(InfoWorld) - The Mozilla Foundation has published a fix for a "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite. The fix, released Monday, targets Firefox versions 2.0.0.2 and 1.5.0.10, as well as SeaMonkey versions 1.1.1 and 1.0.8. An earlier fix for a JavaScript problem allowed scripts from Web content to execute arbitrary code, the Mozilla Foundation said in a security update. The vulnerability allowed uniform resource identifiers in image tags to be executed even if JavaScript was disabled in the program preferences, Mozilla said. Disabling JavaScript does not protect against the flaw, so the foundation recommended that users upgrade the applications to new versions. Mozilla's Thunderbird e-mail client was not affected by the vulnerability, it said. The fix comes on the heels ofÂ criticism from independent security researcher Michael Zalewski regarding Firefox vulnerabilities, including spoofing and phising threats aimed at the newly released Firefox version 2.0.0.2. Mozilla CSO Window SnyderÂ saidÂ she is seeing more customer feedback regarding browser security and hopes thatÂ more independent researchers and customer feedback will help the company patch flaws more quickly. "The browser is one of most critical pieces of software on the computer in terms of something attackers are going after," Snyder said. "Attacks are constantly changing and every software developer needs to recognize new threats as they emerge, but that's nothing new, we've always considered security to be a top priority." Matt Hines, a senior writer at InfoWorld, contributed to this report
29646
Users of Firefox yesterday began receiving notices of the availability of version 2.0.0.7, which the Mozilla organization said addresses a vulnerability involving Apple's QuickTime plug-in. In BetaNews tests of the new version this afternoon, the vulnerability in question appears to have been fully patched.
206068
(InfoWorld) - Mozilla updated the preview of Firefox 3.0 to alpha 8 Thursday, unveiling for the first time to users several security features it has talked up for months. Among the security provisions debuting in the new alpha of "Gran Paradiso," the code name for Firefox 3.0, are built-in anti-malware warnings and protection against rogue extension updates, according to documentation Mozilla posted to its Web site. The malware blocker, which was first mocked up in June, will block Web sites thought to contain malicious downloads. The feature, a companion to the phishing site alert system in the current Firefox 2.0, will use information provided by Google to flag potentially-dangerous sites, warn anyone trying to reach those URLs with Firefox, and automatically block access to the site. Mozilla also pointed to a URL that demonstrates the new malware blocker for alpha 8 users. Also taking a bow is a check meant to prevent plug-ins' automatic updates from sending users to malicious sites where they might be infected by attack code or drive-by downloads. Firefox relies on small plug-ins -- called "extensions" in the Mozilla vernacular -- for much of its power and flexibility. Several thousand extensions have been written, the vast bulk of them by outside developers, that do everything from boost browsing speed to block irritating Flash animations. Firefox regularly checks to see if the installed extensions are up to date, and, if not, automatically pulls in the newest version and installs it. "Firefox automatically checks for updates to add-ons using a URL specified in the add-on's install manifest," Mozilla spells out in a developer's document. "Currently there are no requirements placed on these URLs. In particular, [they are not] required to be https. This allows either the update manifest or the update package to be compromised, potentially resulting in the injection of malicious updates. A demonstration of one form of compromise is already public." Most extensions are hosted on Mozilla's own servers -- at the servers feeding its Add-ons site -- but some are not; it's those off-site extensions that Mozilla wants to lock down. To stymie attacks through a compromised extension update, Mozilla will require updates -- both the actual update package and the much smaller "manifest," or notification of an update -- to be delivered over an SSL-secured connection. Or the update must be digitally signed. The change doesn't affect the initial installation of an extension, something Mozilla recognized. "[This] has no impact on the security of initial add-on installs," it told developers in the online guide. This newest preview, which can be downloaded in versions for Windows, Mac OS X, and Linux from the Mozilla site, still comes with a warning to end-users. "Alpha 8 is intended for Web application developers and our testing community. Current users of Mozilla Firefox should not use Gran Paradiso Alpha 8," the browser's release notes. Mozilla has not officially committed to a release date for the final version of Firefox 3.0. Computerworld is an InfoWorld affiliate
659755
Mozilla blocks those un-requested and annoying &quot;pop-up&quot; windows. It also has the ability to open new Web pages in a &quot;tabbed&quot; interface, as is common to most Windows-based programs.
479220
Over the past year, spyware has become an increasing problem. Every time that you visit a web site, you must run the gauntlet of a variety of pop-up adverts, any of which can be programmed to place spyware on your computer.
6528
Mozilla browser is less complete than Internet Explorer but is much more than just an anti-Microsoft statement. Is computing not making the progress it used to, or did I just read a story
435582
Blog: Updates address some critical vulnerabilities in the popular browser.
514013
MyPhish.com The latest versions of both Firefox and Internet Explorer are vulnerable to an unpatched flaw that allows hackers to snaffle users' login credentials via automated phishing attacks.â¦
437595
Hackers can drop malicious code into systems running Firefox when the browser is armed with Google Toolbar, Yahoo Toolbar, or other add-ons.
313870
You are seeing this message because you are using an older or unsupported browser, or because your browser does not recognize stylesheets.
372712
Mozilla Corp. may add a tool to the next version of its Firefox browser that would block Web sites identified by Google as potentially harboring malware.
657731
Google is working to fix a bug in the Google Toolbar that could allow criminals to steal data or install malicious software on a system, a security researcher warned Tuesday.The flaw lies in the mechanism Google Toolbar uses to add new buttons on the browser. Because the toolbar does not perform adequate checks when new buttons are being installed, a hacker could make his button appear as though it was being downloaded from a legitimate site when in fact it came from somewhere else. By spoofing the origin of the toolbar button, an attacker could download malicious files or launch a phishing attack against the victim, wrote security researcher Aviv Raff in a blog post on the issue.Raff has posted proof of concept code, showing how such an attack would work with the Internet Explorer browser. A Google spokeswoman confirmed Tuesday that the company is working to fix the problem.The attack requires many steps. First, the victim would have to be tricked into clicking on a Web link that would then pop up a window asking the user if he wants to install a custom button on his toolbar. Because of the flaw, this alert could look like it was downloading the button from a legitimate site, such as Google.com, even if it were not. Once the button was installed on the toolbar, the victim would then have to click on it and, finally, agree to download and run an executable file for the malicious software to be installed.Because the user would have to go through so many steps in order to fall victim to the attack, the bug isn&#39;t a critical one, said Marc Maiffret, an independent security researcher. &quot;While it is interesting, it&#39;s probably a low threat compared to other flaws out there,&quot; he said.Still, it was sloppy work on Google&#39;s part to miss such a simple attack, he said. &quot;They should definitely assess how it slipped through the cracks,&quot; he said.This is not the first obvious Google flaw that Raff has found. Last month, he showed how a simple Web programming error on the Google.com Web site could allow attackers to launch what&#39;s known as a cross-site scripting attack.Because Google&#39;s programmers didn&#39;t properly check the HTML generated by the Google search engine, Raff was able to create a specially crafted Google link that, when clicked by the victim, would trick the browser into running unauthorized scripting code. This type of link could be used to steal the victim&#39;s Google account or conduct phishing attacks, Raff saidThis error was fixed by Google just hours after Raff notified the company of the problem, but a demo of the flaw being exploited can be seen online.
721294
Dec 10, 2004: A new web browser security hole has been uncovered by a security firm, which could provide scammers with the means to launch phishing attacks from pop-up windows on genuine, trusted websites.
350003
TechWeb - The problematic fix, issued last December, affected the Firefox browser and the SeaMonkey application suite.
131973
Looking for an alternative to Internet Explorer that addresses IE's notorious security flaws and has killer search capabilities to boot?  Look no farther: Firefox is truly a searcher's browser.
689090
Mozilla Corp. has acknowledged that hackers can drop malicious code into systems running Firefox when the browser is armed with any of several high-profile add-ons, including Google Toolbar and Yahoo Toolbar.