Firefox Hit With Spoofing Bug
450989
A serious flaw in how Firefox handles log-ons could be used by identity thieves to dupe users into disclosing passwords, a noted security researcher says.
188255
Pass the parcel bug binned Mozilla has pushed out a new version of Firefox that fixes a number of security bugs, including a high-profile bug involving launching Firefox from Internet Explorer.â¦
111507
(InfoWorld) - A flaw in the pop-up blocker of the open-source browser Firefox could allow an attacker to access local files, according to security analysts. The flaw, however,Â does not affect Firefox 2.0, the latest version of the browser, but version 1.5.0.9, according to Beyond Security, which credited the find to Michal Zalewski. The attack could occur if a user manually allows a pop-window to appear. The browser normally blocks access to local files, but when a pop-up is manually allowed, "normal URL permission checks are bypassed," Beyond Security said. To make the hack work, however, a malicious file containing the exploit code would have to already be on the system, the advisory said. The file could be planted on the system by enticing a user to click on a link that would download the file. The malicious file could then enable access to other files, which could be transferred to a remote server. Mozilla, the distributor of Firefox, could not immediately comment on the report. Â
561018
It's raining security updates Mozilla pushed out a new update of Firefox on Thursday that fixes ten security vulnerabilities, three of which are deemed critical.â¦
416887
(InfoWorld) - Makers of some of the most popular extension software used by the Firefox browser are not doing enough to secure their software, a security researcher said Wednesday. The problem is that many widely used Firefox extensions, including toolbars from Google, Yahoo, and AOL, do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher who blogged about the issue on Wednesday. Soghoian is best known as the researcher who attracted the attention of the FBI late last year after publishing a tool that could be used to print fake boarding passes. The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the SSL Web protocol. SSL Web sites, which begin with "https://," use digital certificates to provide users with some level of assurance that they're not connecting with a fake server. Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled Web site, it is common for commercial extension-makers like Google to host their software on an unsecured site, Soghoian said in an interview. This leaves users vulnerable to a "man-in-the middle" attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension. It wouldn't be easy for an attacker to pull this off, however. In one scenario, the hacker would set up a malicious wireless access point in a public area where people are using wireless connections. He could then redirect extension update traffic to a malicious computer. "An attacker who sets up a wireless access point can then infect anyone who connects to it," Soghoian said. The Del.icio.us Extension, Facebook Toolbar, Ask.com Toolbar, LinkedIn Browser Toolbar, Netcraft Anti-Phishing Toolbar, and PhishTank SiteChecker are also vulnerable to this issue, Soghoian said. Though Soghoian said Firefox users should avoid extensions that are not from the secure Firefox add-ons site, not all security researchers see this as a major issue. "It's just yet another vulnerable design among billions,"said Gadi Evron, security evangelist for Beyond Security. "I don't see it as that critical. There is no inherent vulnerability, but it does make the over-whole design weaker, and that should probably be addressed" Evron said it was "silly" that sites weren't using SSL for these extensions. Soghoian said he notified Google, Yahoo, and Facebook of the issue in mid-April, but nobody had addressed the issue as of Wednesday. Just hours after Soghoian went public with his findings, Google said it would "soon" have a fix for the problem. It's common for Web developers to ignore security in the rush to push out new and cool features, Soghoian said. "Your average Web 2.0 developer doesn't learn about security," he said. "Google has a spectacular security team ... my suspicion is that one hand wasn't talking to the other."
29234
Security researchers have uncovered a spoofing flaw in Internet Explorer that could turn out to be the perfect holiday gift for scammers.
743763
Tabbed browsing, one of the more popular features built into alternative Web browsers, contains a security flaw that puts users at risk of spoofing attacks, research firm Secunia warned on Wednesday.
576682
A year-old QuickTime bug that hackers to hijack PCs and Macs with Firefox installed,  has Mozilla Corp. scrambling for a fix, according to Mozilla's chief security officer.
381411
A flaw in the way Firefox handles log-ons could be used by identity thieves to fool users into disclosing passwords, security researcher Aviv Raff said yesterday.
148612
Attackers can trick browsers into releasing password information.
191229
A bug in Microsoft&#39;s Internet Security and Acceleration (ISA) Server 2000 and Proxy Server 2 can let hackers spoof Web content, such as a trusted site, with their own fake content, the Redmond
614724
The Firefox browser is vulnerable to a flaw related to its pop-up blocker technology that could give access to local files, security analysts said.
634907
Researchers are publishing security vulnerabilities this week that could offer attackers new ways to get into the enterprise. Mozilla updated its Firefox Web browser on Tuesday to thwart attacks that target a flaw in Apple&#39;s QuickTime player. Meanwhile, security researchers detailed new vulnerabilities in Windows and Windows Media player.
290860
Security researchers can't decide whether it's in IE or Firefox A serious vulnerability that causes Internet Explorer to launch Firefox and execute a malicious payload is sparking debate about exactly who is responsible for the flaw.â¦
619489
In the very week Mozilla Firefox Version 1.0 was launched, a series of potentially nasty security holes have been uncovered in older versions of the browser.
16648
Opt-out button in spam used to run exploit
69359
PC Magazine - A public claim by hackers that Mozilla's Firefox browser is vulnerable to multiple code execution vulnerabilities may be a joke gone awry.