Mozilla: Security remains on front burner
681769
With the release of its latest Firefox 2.0.0.5 browser, open-source software maker Mozilla claims to have fixed a number of potentially serious vulnerabilities in its flagship product.
416887
(InfoWorld) - Makers of some of the most popular extension software used by the Firefox browser are not doing enough to secure their software, a security researcher said Wednesday. The problem is that many widely used Firefox extensions, including toolbars from Google, Yahoo, and AOL, do not use secure connections to update themselves, according to Christopher Soghoian, a security researcher who blogged about the issue on Wednesday. Soghoian is best known as the researcher who attracted the attention of the FBI late last year after publishing a tool that could be used to print fake boarding passes. The Indiana University doctoral student discovered the Firefox issue last month while examining network traffic on his computer. He noticed that many of the most popular Firefox extensions are not hosted on servers that use the SSL Web protocol. SSL Web sites, which begin with "https://," use digital certificates to provide users with some level of assurance that they're not connecting with a fake server. Although the corporation behind Firefox, Mozilla, hosts the majority of Firefox extensions on its own SSL-enabled Web site, it is common for commercial extension-makers like Google to host their software on an unsecured site, Soghoian said in an interview. This leaves users vulnerable to a "man-in-the middle" attack, where Firefox could be tricked into downloading malicious software from a site it mistakenly thought was hosting an extension. It wouldn't be easy for an attacker to pull this off, however. In one scenario, the hacker would set up a malicious wireless access point in a public area where people are using wireless connections. He could then redirect extension update traffic to a malicious computer. "An attacker who sets up a wireless access point can then infect anyone who connects to it," Soghoian said. The Del.icio.us Extension, Facebook Toolbar, Ask.com Toolbar, LinkedIn Browser Toolbar, Netcraft Anti-Phishing Toolbar, and PhishTank SiteChecker are also vulnerable to this issue, Soghoian said. Though Soghoian said Firefox users should avoid extensions that are not from the secure Firefox add-ons site, not all security researchers see this as a major issue. "It's just yet another vulnerable design among billions,"said Gadi Evron, security evangelist for Beyond Security. "I don't see it as that critical. There is no inherent vulnerability, but it does make the over-whole design weaker, and that should probably be addressed" Evron said it was "silly" that sites weren't using SSL for these extensions. Soghoian said he notified Google, Yahoo, and Facebook of the issue in mid-April, but nobody had addressed the issue as of Wednesday. Just hours after Soghoian went public with his findings, Google said it would "soon" have a fix for the problem. It's common for Web developers to ignore security in the rush to push out new and cool features, Soghoian said. "Your average Web 2.0 developer doesn't learn about security," he said. "Google has a spectacular security team ... my suspicion is that one hand wasn't talking to the other."
619489
In the very week Mozilla Firefox Version 1.0 was launched, a series of potentially nasty security holes have been uncovered in older versions of the browser.
238632
The future appears rosy for Firefox. Just two years after its start, and even before reaching version 1.0 (now imminent), the little open source browser has already left behind its elder
694870
InfoWorld - Window Snyder, chief security officer at open source browser maker Mozilla, is caught in the crosshairs of the raging browser vulnerability battle.
597404
Mozilla Corp. updated the preview of Firefox 3.0 to alpha 8 Thursday, unveiling for the first time to users several security features it&#39;s talked up for months.
553989
Basic authentication sucks Flaws in the way the latest version of Mozilla Firefox presents authentication dialog boxes leave the door open for cybercrooks to trick users into handing over login credentials, a leading security researcher warns.â¦
588768
InfoWorld - Mozilla has released a critical security update to Firefox, taking a third shot at patching bugs in the way the browser can be used to launch programs from Web links.
363317
Mozilla has issued 10 patches including three for critical vulnerabilities.
562962
(InfoWorld) - The Mozilla Foundation has published a fix for a "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite. The fix, released Monday, targets Firefox versions 2.0.0.2 and 1.5.0.10, as well as SeaMonkey versions 1.1.1 and 1.0.8. An earlier fix for a JavaScript problem allowed scripts from Web content to execute arbitrary code, the Mozilla Foundation said in a security update. The vulnerability allowed uniform resource identifiers in image tags to be executed even if JavaScript was disabled in the program preferences, Mozilla said. Disabling JavaScript does not protect against the flaw, so the foundation recommended that users upgrade the applications to new versions. Mozilla's Thunderbird e-mail client was not affected by the vulnerability, it said. The fix comes on the heels ofÂ criticism from independent security researcher Michael Zalewski regarding Firefox vulnerabilities, including spoofing and phising threats aimed at the newly released Firefox version 2.0.0.2. Mozilla CSO Window SnyderÂ saidÂ she is seeing more customer feedback regarding browser security and hopes thatÂ more independent researchers and customer feedback will help the company patch flaws more quickly. "The browser is one of most critical pieces of software on the computer in terms of something attackers are going after," Snyder said. "Attacks are constantly changing and every software developer needs to recognize new threats as they emerge, but that's nothing new, we've always considered security to be a top priority." Matt Hines, a senior writer at InfoWorld, contributed to this report
752478
InfoWorld - Mozilla issued 10 patches on Friday for its Firefox browser, including three for critical vulnerabilities. The latest version of Firefox is now 2.0.0.12.
693101
p2pnet.net News:- Mozilla&#39;s Firefox is still giving Microsoft&#39;s Internet Explorer grief, scoring heavily against the latter&#39;s gaping security holes.
517091
Fixes made for "critical" JavaScript vulnerability in the Firefox browser and the SeaMonkey application suite.
347081
While Mozilla may get all the credit for finally dethroning Internet Explorer as the only dominant Web browser with its development of Firefox, the man behind the curtain continues to be Google, which provides the vast majority of the cash that keeps Mozilla going.
53150
Mozilla's latest pre-release version of its browser remains buggy, but performance enhancements give us reason to get excited. In Monkey Bites.
533617
(InfoWorld) - With the release of its latest Firefox 2.0.0.5 browser, open-source software maker Mozilla claims to have fixed a number of potentially serious vulnerabilities in its flagship product. According to the firm's chief security officer, the company is working harder than ever to keep its users protected. Through the launch of Firefox 2.0.0.5 late on July 17, Mozilla moved to patch nine individual flaws resident in previous iterations of the program. Patches built into 2.0.0.5 included those meant to address multiple memory corruption bugs, a cross-site scripting vulnerability, and a flaw that could give attackers access to the browser's cache. Among the other problems the company addressed in the update was even an unusual vulnerability that could cause malicious code to run on a PC if the browser is launched using Microsoft's rival Internet Explorer software -- a flaw that Mozilla could have easily pinned on Microsoft, despite denials from the software maker that it is at all responsible for mending the issue. And while some security experts still maintain that open-source products are ill-fitted for use inside enterprise businesses as they may leave the door open to savvy attackers who can take advantage of the readily-available nature of the products' widely-published source code, Window Snyder, whose official title is "chief security something-or-other" at Mozilla, claims that the firm's very makeup has led Firefox and the vendor's other products to offer stronger protection for end-users than proprietary systems with which they compete. "Transparency has been one of the key factors to our success in improving security; some see doing development with the whole world watching as an obstacle, and at times it can be a challenge, but we see it as a unique strength," Snyder said. The security expert, herself a former employee of Microsoft, said that Mozilla currently enlists more than 10,000 people in regular security testing of its nightly product builds. Compared to a standard Web browser development team operating under one company's roof, the virtual legion of open-source contributors provides a far deeper pool of talent to try to assault its products to find any vulnerabilities, she said. Companies including Microsoft often point to the comparatively large numbers of bugs reported in Mozilla products by security researchers as an indicator that the technologies are less secure than their own. However, the volume of issues being uncovered in Firefox and other open-source products is actually an illustration of the high level of scrutiny such applications receive, which is more than their proprietary counterparts, Snyder maintains. Microsoft sends out a set of patches only once every month, but the virtual Firefox security testing team is helping Mozilla turnaround updates almost as quickly as it receives reports of any flaws, she said. Patching vulnerabilities as quickly as possible is a more effective approach to thwarting attacks as hackers often have longer periods of time to craft assaults on proprietary systems before they are fixed, according to the expert. Mozilla has also added real-time vulnerability updates for its users in the past year, easing the burden on people to stay abreast of any fixes on their own. "This community approach is the reason we're able to ship patches so quickly. It's more important to communicate with people and let them know what is going on versus waiting and sitting on the information," said Snyder. "If people start looking at the amount of time it takes for companies to get updates out as the best measurement of overall security versus the number of problems that may be identified, more people are going to change their minds about whether open source is indeed the most secure model." Questioned as to whether it becomes a challenge to respond to 10,000 independent security contributors helping in the review of its programs, Snyder said that an unofficial hierarchy has created itself among the people who regularly make helpful suggestions to Mozilla. "It's a challenge and an opportunity trying to do development with that many different voices, and often the most adamant people make significant contributions, but people also make points and build a consensus and ideas bubble up through the group that way," she said. "Even if it makes for more work, we think it's always better to listen to the voices of many than it is to limit the process to only a few."
6528
Mozilla browser is less complete than Internet Explorer but is much more than just an anti-Microsoft statement. Is computing not making the progress it used to, or did I just read a story