Mozilla: Security remains on front burner
504591
InfoWorld - With the release of its latest Firefox 2.0.0.5 browser, open-source software maker Mozilla claims to have fixed a number of potentially serious vulnerabilities in its flagship product.
116046
Help on the way Mozilla's chief of security has confirmed a vulnerability that could cause fully patched versions of Firefox to expose a user's private data.â¦
547455
As the number of downloads of Mozilla Foundation&#39;s open source browser Firefox 1.0 continues to soar (4.7 hits by Nov. 19), people are asking what will established browsers do in response?
347081
While Mozilla may get all the credit for finally dethroning Internet Explorer as the only dominant Web browser with its development of Firefox, the man behind the curtain continues to be Google, which provides the vast majority of the cash that keeps Mozilla going.
221126
The Firefox browser offers superior security features over Internet Explorer -- and as long as IE drives more than 90 percent of the world&#39;s computers, hackers will continue to make it a target.
238632
The future appears rosy for Firefox. Just two years after its start, and even before reaching version 1.0 (now imminent), the little open source browser has already left behind its elder
750620
(InfoWorld) - Mozilla Corp. developers have released an updated version of their Firefox browser that fixes a number of security issues, four of them rated critical. The update was released late Thursday, and Firefox users should receive the 1.5.0.7 patches via the browser's automatic update system over the next few days, according to Mozilla. Research firm Secunia rates the flaws as "highly critical," saying that they can be exploited to "conduct man-in-the-middle, spoofing, and cross-site scripting attacks, and potentially compromise a user's system," according toÂ this Secunia alert. In addition to the four critical patches, the software also fixes three less-critical issues and offers some stability enhancements according to the Mozilla Web site, which also includesÂ details about the security vulnerabilities. Browser hackers have traditionally focused on Microsoft Corp.'s Internet Explorer, but as Firefox's market share has grown it has become a more attractive target. Firefox is now used by about 13 percent of Web surfers, according to research firm OneStat.com. It has been a busy week for IT administrators looking to stay on top of security. Important security patches were also released by Microsoft Corp. and Apple Computer Inc. On Tuesday, Microsoft releasedÂ its monthly set of security patches, fixing a critical bug in its Publisher product. The company also re-released two of its August patches to fix bugs in the updates. That was followed Wednesday by Apple's fix for its QuickTime multimedia software. This update, rated as highly critical by Secunia, fixes six bugs in the product. More details on the QuickTime update can be found onÂ this page of Apple's Web site. Â
755201
TechWeb - Mozilla may be leveraging insight from Microsoft. They are considering implementing a security feature in the upcoming OS to better protect future versions of Firefox from attack.
128986
Users of the Mozilla and Firefox browsers and the Thunderbird e-mail client may be vulnerable to flaws that could allow an attacker to spy on or take over a system, according to security researchers.
739533
A vulnerability in the way the Firefox browser handles Javascript drew attention at a Saturday presentation at the ToorCon hacker conference, and Mozilla developers entered the week "heads down" in search of a solution.
7483
Every time a new IE security flaw is announced, or whenever someone gets fed up with hackers manipulating their Web browser, Firefox and other Mozilla-based browsers get a bump in the marketplace.
363317
Mozilla has issued 10 patches including three for critical vulnerabilities.
721339
(InfoWorld) - The security team at Mozilla Corp. is looking into a flaw in its Firefox Web browser that hackers exposed at a conference in San Diego over the weekend. In a presentation at theÂ ToorCon hacker conference on Saturday, hackers Mischa Spiegelmock and Andrew Wbeelsoi demonstrated exploit code for a vulnerability in the way Firefox handles Javascript. On Monday, Mozilla said it was busy investigating the flaw, and did not offer any security researchers for comment because, according to spokeswoman Mary Colvig, they were all "heads down" on the problem. The company also said it will patch the flaw if it deems that action necessary. The vulnerability could allow someone to execute a memory corruption attack on Firefox if a user browsed to a Web site that contained the exploit code, said Ken Dunham, director of the rapid response team at security services company iDefense, a VeriSign company. "If you were to go to a Web site that contained the exploit code, it would fill up the available memory on the computer," he said. This would create an environment in which an attacker could take over the computer to do something harmful, he added. Dunham said that iDefense labs tested the exploit code, and it was "unreliable" and crashed the Firefox browser. Because of this, he does not consider the exploit to be a critical threat to Firefox. However, "someone could make some changes to the exploit code and make it more reliable," Dunham said. He added that there are other, more critical unpatched flaws in both Firefox and Microsoft Corp.'s Internet Explorer browser that are currently under attack by hackers.
562962
(InfoWorld) - The Mozilla Foundation has published a fix for a "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite. The fix, released Monday, targets Firefox versions 2.0.0.2 and 1.5.0.10, as well as SeaMonkey versions 1.1.1 and 1.0.8. An earlier fix for a JavaScript problem allowed scripts from Web content to execute arbitrary code, the Mozilla Foundation said in a security update. The vulnerability allowed uniform resource identifiers in image tags to be executed even if JavaScript was disabled in the program preferences, Mozilla said. Disabling JavaScript does not protect against the flaw, so the foundation recommended that users upgrade the applications to new versions. Mozilla's Thunderbird e-mail client was not affected by the vulnerability, it said. The fix comes on the heels ofÂ criticism from independent security researcher Michael Zalewski regarding Firefox vulnerabilities, including spoofing and phising threats aimed at the newly released Firefox version 2.0.0.2. Mozilla CSO Window SnyderÂ saidÂ she is seeing more customer feedback regarding browser security and hopes thatÂ more independent researchers and customer feedback will help the company patch flaws more quickly. "The browser is one of most critical pieces of software on the computer in terms of something attackers are going after," Snyder said. "Attacks are constantly changing and every software developer needs to recognize new threats as they emerge, but that's nothing new, we've always considered security to be a top priority." Matt Hines, a senior writer at InfoWorld, contributed to this report
640391
Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim&#39;s machine.The problem is similar to other&#160;data leakage&#160;flaws found in the open-source browser, according to researcher Gerry Eisenhaur, who first reported the problem on Saturday.Eisenhaur has posted sample code that reads the contents of a Mozilla Thunderbird preferences file, but he believes that attackers could get access to more information with variations on his attack. &quot;It&#39;s possible to load any JavaScript file on a victim&#39;s machine,&quot; he wrote in his blog posting. &quot;This looks very interesting and may have bigger potential, but for now, it&#39;s just another information disclosure [flaw].&quot;&quot;It could become something more if there was an application that stored sensitive data inside JavaScript files,&quot; he said via instant message. &quot;Some plugins have been known to store usernames and passwords.&quot;&quot;Its also just a powerful way to do recon,&quot; he added.Hackers have discovered a number of flaws in recent months that take advantage of the way that browsers pass information between different components within the Windows operating system. Some of these URI (Uniform Resource Identifier) protocol handler flaws have led to serious security problems for both Firefox and Internet Explorer.This latest flaw affects only certain Firefox add-ons, such as the Download Statusbar or Greasemonkey, which store scripts in a fashion that lets them be discovered on the hard drive, said Window Snyder, Mozilla&#39;s security chief in a Wednesday blog posting.Firefox is investigating the issue and has rated it as a low-severity problem, she said.
619489
In the very week Mozilla Firefox Version 1.0 was launched, a series of potentially nasty security holes have been uncovered in older versions of the browser.
42492
As expected, Mozilla Corp. has released an update to Firefox that eliminates 11 vulnerabilities, including four ranked as "critical" by the software developer.