Firefox hands out cookies from strangers
504112
Be careful, kids Firefox suffers from a flaw that allows attackers to manipulate the authentication cookies of virtually any website, a vulnerability Bugzilla has deemed severe. It's the second major security lapse for the open-source browser in as many days.â¦
572892
Four new unpatched vulnerabilities have been published for Internet Explorer and Firefox, with two coming for each browser.
87335
(InfoWorld) - A flaw in Mozilla Corp.'s Firefox browser makes it easy for cybercriminals to steal user information on Web sites where users create their own pages, such as MySpace.com. The flaw lies in Firefox's Password Manager software, which can be tricked into sending password information to an attacker's Web site, said Robert Chapin, president of Chapin Information Services Inc. For this attack to work, attackers need to be able to create HTML (Hypertext Markup Language) forms on the Web site, something that is allowed on blogging and social networking sites. The attack was used in aÂ MySpace phishing attack reported in late October. In that attack, users registered a MySpace account named login_home_index_html and used it to host a fake log-in page that exploited the flaw. This page sent MySpace username and password information to another Web site, and MySpace users who visited the page using Firefox could have easily had their information compromised, said Chapin. Firefox developers rate this bug critical, according to an entry in the project's Bugzilla database. The flaw arises because Firefox's Password Manager does not perform a thorough enough check when it is deciding whether to send password information, and then does not ensure that password information is being sent to the server that requested it, Chapin said. In the MySpace attack, for example, Firefox would check to see if the form was coming from the MySpace.com domain, but did not make sure that the password information was being sent back to a MySpace server. "From a programming point of view, this is almost like a typo," he said. "Ironically I think that's why it hasn't been discovered until now. It was just way too obvious." Chapin has posted an analysis of this type of attack, which he has dubbed a Reverse Cross-Site Request, as well as a demonstration of how it works . Microsoft Corp.'s Internet Explorer (IE) is also susceptible to these type of attacks because, like Firefox, it does not ensure that password information is being sent to the same server that requests it, Chapin said. But IE is less likely to be tricked because it does a more thorough job in checking to see where the log-in form is coming from before it automatically submits password and user information, he added. Â
450989
A serious flaw in how Firefox handles log-ons could be used by identity thieves to dupe users into disclosing passwords, a noted security researcher says.
289277
Much like Linux, the Firefox browser has become an open-source phenomenon. More than five million people have downloaded the preview version of the free product -- developed by the non-profit
14206
InfoWorld - A flaw in the pop-up blocker of the open-source browser Firefox could allow an attacker to access local files, according to security analysts.
479970
Blog: Researcher finds a basic cookie handling error that could compromise Windows PCs.
41813
YOU have read about the alternative Internet browser that is known as Firefox. Here&#39;s an easy guide to it. Nothing. Firefox is the collective product of volunteer programmers in what is known as the open-source community.
234529
Mozilla is trying to weave a new web. Not sure if it matters yet.
149856
InfoWorld - Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.
105359
Many users are celebrating Mozilla&#39;s release of Firefox 1.0, its open-source Web browser. The beta version was downloaded some 8 million times.
638921
Security firm Secunia has issued an advisory regarding a newly discovered "highly critical" security flaw in Firefox 2.0 and later, which involves a special URI handler. Although the problem was initially attributed to Internet Explorer by researcher Thor Larholm, Firefox is the culprit.
635199
The discovery of vulnerabilities in the Firefox Web browser might not be as critical as they were made out to be by a pair of hackers who presented their findings at a recent gathering of software and security experts.
363180
Floor by flaw The latest versions of Internet Explorer and Firefox on Windows and (in the case of Firefox) Unix systems are vulnerable to attacks that could reveal the contents of sensitive files residing on a victim's hard drives.â¦
47409
Mozilla works to fix a Firefox browser flaw that could give attackers unauthorized access to data on a victim's PC.
132488
Some prompts and websites that download browser plug-ins are turning out to be fronts for malicious programing.
381411
A flaw in the way Firefox handles log-ons could be used by identity thieves to fool users into disclosing passwords, security researcher Aviv Raff said yesterday.