Mozilla says Firefox flaw could lead to data leak
640391
Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim&#39;s machine.The problem is similar to other&#160;data leakage&#160;flaws found in the open-source browser, according to researcher Gerry Eisenhaur, who first reported the problem on Saturday.Eisenhaur has posted sample code that reads the contents of a Mozilla Thunderbird preferences file, but he believes that attackers could get access to more information with variations on his attack. &quot;It&#39;s possible to load any JavaScript file on a victim&#39;s machine,&quot; he wrote in his blog posting. &quot;This looks very interesting and may have bigger potential, but for now, it&#39;s just another information disclosure [flaw].&quot;&quot;It could become something more if there was an application that stored sensitive data inside JavaScript files,&quot; he said via instant message. &quot;Some plugins have been known to store usernames and passwords.&quot;&quot;Its also just a powerful way to do recon,&quot; he added.Hackers have discovered a number of flaws in recent months that take advantage of the way that browsers pass information between different components within the Windows operating system. Some of these URI (Uniform Resource Identifier) protocol handler flaws have led to serious security problems for both Firefox and Internet Explorer.This latest flaw affects only certain Firefox add-ons, such as the Download Statusbar or Greasemonkey, which store scripts in a fashion that lets them be discovered on the hard drive, said Window Snyder, Mozilla&#39;s security chief in a Wednesday blog posting.Firefox is investigating the issue and has rated it as a low-severity problem, she said.
630854
Mozilla is working to fix a browser flaw that could give attackers unauthorized access to data on a victim's machine.
453367
With the release of its latest Firefox 2.0.0.5 browser, the chief security officer at Mozilla says they have fixed a number of potentially serious vulnerabilities.
733412
(InfoWorld) - Mozilla late yesterday patched Firefox to fix nine bugs, including the controversial critical vulnerability that involved both the open source Web browser and Microsoft's Internet Explorer. Firefox 2.0.0.5, which can be downloaded in versions for Windows, Mac OS X, and Linux in 42 localized editions, fixes the "firefoxurl://" vulnerability that can be exploited only on systems where Firefox is installed but IE is the primary browser. For the past week, researchers have quarreled over whether Mozilla or Microsoft was responsible for the flaw and which company should patch its software. In the security advisory, one of eight issued yesterday that outline the nine bugs, Mozilla again refrained from expressly putting the onus on Microsoft. But as before, it came close. "Other Windows applications can be called in this way and also manipulated to execute malicious code," read the advisory. "This fix only prevents Firefox and Thunderbird from accepting bad data. This patch does not fix the vulnerability in Internet Explorer." And more blunt was the single suggested work-around. "Mozilla highly recommends using Firefox to browse the Web to prevent attackers from exploiting this problem in Internet Explorer," it said. One of the researchers who last week pinned blame on Microsoft had not changed his tune as of yesterday. "This [Firefox patch] does not actually fix the flaw in Internet Explorer, but simply patches one of the myriads of attack vectors," said Thor Larholm, a Danish researcher who publicized the exploit. "I can definitely understand the initial reaction from Microsoft. Most of the emphasis in the public vulnerability reports were dealing with Firefox, the '-chrome' command-line argument, and how to properly escape the exploit code. "However, I can still automatically launch a wide range of external applications from Internet Explorer and provide them with arbitrary command-line arguments, [including] AcroRd32.exe (Adobe Acrobat PDF Reader), aim.exe (AOL Instant Messenger), Outlook.exe, msimn.exe (Outlook Express), netmeeting.exe, HelpCtr.exe (Windows Help Center), mirc.exe, Skype.exe, wab.exe (Windows Address Book), and wmplayer.exe (Windows Media Player), just to name a few," Larholm wrote. Microsoft's position last week has been that IE is not buggy and so wouldn't be patched. "Microsoft has thoroughly investigated the claim of a vulnerability in Internet Explorer and found that this is not a vulnerability in a Microsoft product," a spokesman said last Thursday. Other patches put into place by 2.0.0.5 included multiple memory corruption bugs. "With enough effort ... some of these could be exploited to run arbitrary code," a cross-site scripting vulnerability and a flaw that could give attackers access to the browser's cache. Mozilla picked up the pace to push Firefox 2.0.0.5 out to users earlier than scheduled. On Monday, Mozilla developers pegged the update as a "fire drill release" because of the critical nature of the firefoxurl:// bug. At the time, July 19 was the target for 2.0.0.5's release. "But we might be able to accelerate the release," notes from a weekly status meeting read. This is the first update to Firefox since support for the older 1.5.x line was discontinued. Earlier this month, users of that version were offered an automatic update to Firefox 2.0.0.4.
624578
(InfoWorld) - Mozilla has released the first update for the Firefox 2.0 browserÂ to fix eight security vulnerabilities. According to the company, release 2.0.0.1 of Firefox fixes flaws in memory corruption as well as the way the browser executes RSS (really simple syndication), Javascript and CSS (cascading style sheets) code, among other vulnerabilities. Mozilla also patched similar flaws in its Firefox 1.5 browser. Five of the eight flaws were rated as critical, according to Firefox. A critical rating means a Firefox user would be vulnerable to attack and remote software installation on their machines just from browsing the Web in the usual fashion. Two of the flaws were rated as high, while one received a low security-risk rating, Firefox said. Mozilla's advisory and information on the update can be found on the company's Web site. Danish security firm Secunia ApS also posted information about the patches on its Web site. Mozilla released Firefox 2.0, the second major update to its open-source browser, in October.
727620
A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla Corp. said it plans to patch the problem in its next Firefox software update.
444532
Ten security flaws found in Firefox browser, Thunderbird e-mail client.
712878
Mozilla has released a critical security update to Firefox, taking a third shot at patching bugs in the way the browser can be used to launch programs from Web links.The bug, rated &quot;moderate&quot; by Mozilla, lies in the URI (Uniform Resource Identifier) protocol handling technology that is used to launch programs -- an e-mail client for example -- from within the browser. Over the past few months, security researchers have been discovering an increasing number of ways that this technology can be misused, often as a way to install unauthorized software on a victim&#39;s computer.The URI patch is one of eight security bug-fixes that Mozilla has pushed out with the 2.0.0.8 update, released late Thursday.Mozilla developers originally thought that the issue lay within Microsoft&#39;s Internet Explorer software, which could be invoked in a malicious fashion via Firefox. Several days after issuing their first patch, however, they realized that there was a problem with Firefox as well, and rushed out the 2.0.0.6 update.Now, three months after that fix, they&#39;ve patched another URI bug in Firefox that will cut down on the likelihood of programs being launched maliciously through the browser. The 2.0.0.6 release &quot;did not prevent the incorrect file-handling programs from launching which left some risk,&quot; Mozilla said in its advisory . &quot;An additional fix has been applied to Firefox 2.0.0.8 that detects when Windows would mishandle these URIs so that the wrong program does not get launched.&quot;Mozilla developers weren&#39;t certain that this latest twist on the URI problem could really be exploited in Firefox, but they decided to issue this latest URI patch rather than wait to find out for certain, said Window Snyder, Mozilla&#39;s security chief. &quot;We could just say this particular vector is not an issue because we do not have proof,&quot; she said. &quot;We could leave it alone. Rather than spend our time analyzing whether this is a vector that could be vulnerable, we would rather put the block in place and eliminate the possibility. This is a defense-in-depth measure.&quot;Microsoft has said that it plans to patch underlying components in the Windows operating system in an effort to prevent URI protocol handler attacks, and that will probably go a long way in preventing new attacks from cropping up, said Andrew Storms, director of security operations, with nCircle Network Security. &quot;We have to applaud the Mozilla team for attempting to protect their users, but in the end, it&#39;s going to be a Microsoft responsibility,&quot; he said.Of the eight vulnerabilities patched Thursday, two are rated critical by Mozilla.The 2.0.0.8 release also adds support for Apple&#39;s Mac OS X 10.5 operating system, code-named Leopard, although Mozilla warns &quot;there are some known issues affecting some media plugins,&quot; on this platform.
634907
Researchers are publishing security vulnerabilities this week that could offer attackers new ways to get into the enterprise. Mozilla updated its Firefox Web browser on Tuesday to thwart attacks that target a flaw in Apple&#39;s QuickTime player. Meanwhile, security researchers detailed new vulnerabilities in Windows and Windows Media player.
47409
Mozilla works to fix a Firefox browser flaw that could give attackers unauthorized access to data on a victim's PC.
424227
While Microsoft's Internet Explorer has become the bane of computer security, switching to Mozilla may not be the simple answer after all. Security firm Secunia has issued a "highly critical" advisory that details 10 separate vulnerabilities found in Mozilla, Firefox and Thunderbird. The flaws can be exploited remotely, allowing an attacker to compromise a system and expose sensitive data. Mozilla users are urged to upgrade to the latest releases of each application, which contain the necessary fixes.
284652
Makes a change from IE Critical flaws in the way Firefox handles JavaScript code create a possible means for hackers to commandeer vulnerable PCs, according to security researchers.â¦
743455
A flaw in Mozilla&#8217;s Firefox browser makes it easy for cybercriminals to steal user information on Web sites where users create their own pages, such as MySpace.com.
581272
Mozilla Foundation says patch issued in mid-December introduced vulnerability to browser and application suite.
415939
Add-ons add security threat A security weakness in the update mechanism for third-party add-ons to the Firefox browser could give an attacker the ability to exploit unsecured downloads and install malicious code on the victim's computer, a security researcher warned on Wednesday.â¦
145367
(InfoWorld) - In a public mea culpa, Mozilla's chief security officer acknowledged Monday that Firefox includes the same flaw that the company called a "critical vulnerability" in Internet Explorer during a two-week ruckus over responsibility for a Windows zero-day bug. "Over the weekend, we learned about a new scenario that identifies ways that Firefox could also be used as the entry point," said Window Snyder of Mozilla. "While browsing with Firefox, a specially crafted URL could potentially be used to send bad data to another application. "We thought this was just a problem with Internet Explorer," Snyder continued. "It turns out, it is a problem with Firefox as well." The argument over responsibility for a flaw that involved both Internet Explorer and Firefox began two weeks ago when Danish researcher Thor Larholm argued that Internet Explorer contained an input validation bug that passes potentially malicious URLs to other applications. Larholm called out Firefox's "firefoxurl://" protocol as one that Internet Explorer mishandled. He staked out the position that Internet Explorer was to blame, while other security experts said it was Firefox's fault. As fingers pointed, Mozilla patched the Internet Explorer-Firefox interaction bug by releasing an update, Version 2.0.0.5. Even so, Snyder and others continued to argue that Internet Explorer was the problem. "Microsoft needs to patch Internet Explorer," Snyder said last Wednesday. That same day, Asa Dotzler, director of community development, contrasted what he said were the differences between Microsoft and Mozilla on the bug. "We think it's Firefox's job to ensure that users are protected from malicious Web sites when they're surfing the Web in Firefox. Apparently, Microsoft doesn't think the same for Internet Explorer," Dotzler said then. Friday, Jesper Johansson, a former Microsoft security strategist but now a security program manager at Amazon.com, spelled out how Firefox was as guilty as Internet Explorer of failing to validate input. In a post that leaned on the metaphor of "glass houses," Johansson showed how Firefox passes potentially malicious URLs to other applications, including the multiple-service instant messaging client Trillian. "Firefox is subject to the exact same flaw that they blame on Internet Explorer. Firefox also does not escape quotes in URLs before it passes them on to protocol handlers," he said. Snyder did not credit Johansson by name for alerting Mozilla to the Firefox bug, but she admitted that the flaw should have been spotted. "We should have caught this scenario when we fixed the related problem in 2.0.0.5," she said. She did not specify when a patch would be issued, but one is in the works, according to an entry in Bugzilla.
69359
PC Magazine - A public claim by hackers that Mozilla's Firefox browser is vulnerable to multiple code execution vulnerabilities may be a joke gone awry.