Critical Firefox security flaw discovered
115827
Blog: Critical security flaw found in Firefox 2.0 and later versions potentially puts users' systems at risk of a remote attack.
721339
(InfoWorld) - The security team at Mozilla Corp. is looking into a flaw in its Firefox Web browser that hackers exposed at a conference in San Diego over the weekend. In a presentation at theÂ ToorCon hacker conference on Saturday, hackers Mischa Spiegelmock and Andrew Wbeelsoi demonstrated exploit code for a vulnerability in the way Firefox handles Javascript. On Monday, Mozilla said it was busy investigating the flaw, and did not offer any security researchers for comment because, according to spokeswoman Mary Colvig, they were all "heads down" on the problem. The company also said it will patch the flaw if it deems that action necessary. The vulnerability could allow someone to execute a memory corruption attack on Firefox if a user browsed to a Web site that contained the exploit code, said Ken Dunham, director of the rapid response team at security services company iDefense, a VeriSign company. "If you were to go to a Web site that contained the exploit code, it would fill up the available memory on the computer," he said. This would create an environment in which an attacker could take over the computer to do something harmful, he added. Dunham said that iDefense labs tested the exploit code, and it was "unreliable" and crashed the Firefox browser. Because of this, he does not consider the exploit to be a critical threat to Firefox. However, "someone could make some changes to the exploit code and make it more reliable," Dunham said. He added that there are other, more critical unpatched flaws in both Firefox and Microsoft Corp.'s Internet Explorer browser that are currently under attack by hackers.
79115
The Mozilla Foundation&#39;s Firefox stand-alone browser, which has been riding a wave of defectors from the security-plagued Internet Explorer, has a bug of its own, the open-source group recently announced.
588768
InfoWorld - Mozilla has released a critical security update to Firefox, taking a third shot at patching bugs in the way the browser can be used to launch programs from Web links.
533617
(InfoWorld) - With the release of its latest Firefox 2.0.0.5 browser, open-source software maker Mozilla claims to have fixed a number of potentially serious vulnerabilities in its flagship product. According to the firm's chief security officer, the company is working harder than ever to keep its users protected. Through the launch of Firefox 2.0.0.5 late on July 17, Mozilla moved to patch nine individual flaws resident in previous iterations of the program. Patches built into 2.0.0.5 included those meant to address multiple memory corruption bugs, a cross-site scripting vulnerability, and a flaw that could give attackers access to the browser's cache. Among the other problems the company addressed in the update was even an unusual vulnerability that could cause malicious code to run on a PC if the browser is launched using Microsoft's rival Internet Explorer software -- a flaw that Mozilla could have easily pinned on Microsoft, despite denials from the software maker that it is at all responsible for mending the issue. And while some security experts still maintain that open-source products are ill-fitted for use inside enterprise businesses as they may leave the door open to savvy attackers who can take advantage of the readily-available nature of the products' widely-published source code, Window Snyder, whose official title is "chief security something-or-other" at Mozilla, claims that the firm's very makeup has led Firefox and the vendor's other products to offer stronger protection for end-users than proprietary systems with which they compete. "Transparency has been one of the key factors to our success in improving security; some see doing development with the whole world watching as an obstacle, and at times it can be a challenge, but we see it as a unique strength," Snyder said. The security expert, herself a former employee of Microsoft, said that Mozilla currently enlists more than 10,000 people in regular security testing of its nightly product builds. Compared to a standard Web browser development team operating under one company's roof, the virtual legion of open-source contributors provides a far deeper pool of talent to try to assault its products to find any vulnerabilities, she said. Companies including Microsoft often point to the comparatively large numbers of bugs reported in Mozilla products by security researchers as an indicator that the technologies are less secure than their own. However, the volume of issues being uncovered in Firefox and other open-source products is actually an illustration of the high level of scrutiny such applications receive, which is more than their proprietary counterparts, Snyder maintains. Microsoft sends out a set of patches only once every month, but the virtual Firefox security testing team is helping Mozilla turnaround updates almost as quickly as it receives reports of any flaws, she said. Patching vulnerabilities as quickly as possible is a more effective approach to thwarting attacks as hackers often have longer periods of time to craft assaults on proprietary systems before they are fixed, according to the expert. Mozilla has also added real-time vulnerability updates for its users in the past year, easing the burden on people to stay abreast of any fixes on their own. "This community approach is the reason we're able to ship patches so quickly. It's more important to communicate with people and let them know what is going on versus waiting and sitting on the information," said Snyder. "If people start looking at the amount of time it takes for companies to get updates out as the best measurement of overall security versus the number of problems that may be identified, more people are going to change their minds about whether open source is indeed the most secure model." Questioned as to whether it becomes a challenge to respond to 10,000 independent security contributors helping in the review of its programs, Snyder said that an unofficial hierarchy has created itself among the people who regularly make helpful suggestions to Mozilla. "It's a challenge and an opportunity trying to do development with that many different voices, and often the most adamant people make significant contributions, but people also make points and build a consensus and ideas bubble up through the group that way," she said. "Even if it makes for more work, we think it's always better to listen to the voices of many than it is to limit the process to only a few."
638921
Security firm Secunia has issued an advisory regarding a newly discovered "highly critical" security flaw in Firefox 2.0 and later, which involves a special URI handler. Although the problem was initially attributed to Internet Explorer by researcher Thor Larholm, Firefox is the culprit.
14206
InfoWorld - A flaw in the pop-up blocker of the open-source browser Firefox could allow an attacker to access local files, according to security analysts.
363180
Floor by flaw The latest versions of Internet Explorer and Firefox on Windows and (in the case of Firefox) Unix systems are vulnerable to attacks that could reveal the contents of sensitive files residing on a victim's hard drives.â¦
340873
Mozilla Corp. has released a critical security update to Firefox, taking a third shot at patching bugs in the way the browser can be used to launch programs from Web links.
640391
Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim&#39;s machine.The problem is similar to other&#160;data leakage&#160;flaws found in the open-source browser, according to researcher Gerry Eisenhaur, who first reported the problem on Saturday.Eisenhaur has posted sample code that reads the contents of a Mozilla Thunderbird preferences file, but he believes that attackers could get access to more information with variations on his attack. &quot;It&#39;s possible to load any JavaScript file on a victim&#39;s machine,&quot; he wrote in his blog posting. &quot;This looks very interesting and may have bigger potential, but for now, it&#39;s just another information disclosure [flaw].&quot;&quot;It could become something more if there was an application that stored sensitive data inside JavaScript files,&quot; he said via instant message. &quot;Some plugins have been known to store usernames and passwords.&quot;&quot;Its also just a powerful way to do recon,&quot; he added.Hackers have discovered a number of flaws in recent months that take advantage of the way that browsers pass information between different components within the Windows operating system. Some of these URI (Uniform Resource Identifier) protocol handler flaws have led to serious security problems for both Firefox and Internet Explorer.This latest flaw affects only certain Firefox add-ons, such as the Download Statusbar or Greasemonkey, which store scripts in a fashion that lets them be discovered on the hard drive, said Window Snyder, Mozilla&#39;s security chief in a Wednesday blog posting.Firefox is investigating the issue and has rated it as a low-severity problem, she said.
233334
InfoWorld - Just one day after a security researcher showed how Google&#39;s&#160;Firefox toolbar could be exploited&#160;in an online attack, a similar flaw has been discovered in the Google Desktop.
98455
Mozilla's Firefox 2.0 has long been considered a safer Web browser than Microsoft's Internet Explorer, but a new flaw in the Firefox Password Manager, which lets users store usernames and passwords for trusted Web sites, could let hackers steal their login data.
725728
InfoWorld - The Mozilla Foundation has published a fix for a &quot;critical&quot; JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
624578
(InfoWorld) - Mozilla has released the first update for the Firefox 2.0 browserÂ to fix eight security vulnerabilities. According to the company, release 2.0.0.1 of Firefox fixes flaws in memory corruption as well as the way the browser executes RSS (really simple syndication), Javascript and CSS (cascading style sheets) code, among other vulnerabilities. Mozilla also patched similar flaws in its Firefox 1.5 browser. Five of the eight flaws were rated as critical, according to Firefox. A critical rating means a Firefox user would be vulnerable to attack and remote software installation on their machines just from browsing the Web in the usual fashion. Two of the flaws were rated as high, while one received a low security-risk rating, Firefox said. Mozilla's advisory and information on the update can be found on the company's Web site. Danish security firm Secunia ApS also posted information about the patches on its Web site. Mozilla released Firefox 2.0, the second major update to its open-source browser, in October.
220418
Mozilla disclosed Monday that it had opened up a vulnerability with a previous security fix for its Firefox, Seamonkey, and Thunderbird clients. According to an advisory issued Monday, a new JavaScript issue was introduced that would allow coding from Web content to be exploited to execute arbitrary code.
93571
A zero-day flaw in Firefox and third-party Windows patches turn up the heat for Net users. Plus: Buyout boom in security.
420080
An update to Firefox fixes a number of security flaws in the browser.