Firefox: "Extremely Critical Security Holes"

$pvcxGhxztCasey · May 10, 2005

Firefox has unpatched "extremely critical" security holes and exploit code is already circulating on the Net, security researchers have warned.

The two unpatched flaws in the Mozilla browser could allow an attacker to take control of your system.

A patch is expected shortly, but in the meantime users can protect themselves by switching off JavaScript. In addition, the Mozilla Foundation has now made the flaws effectively impossible to exploit by changes to the server-side download mechanism on the update.mozilla.org and addons.mozilla.org sites, according to security experts.

The flaws were confidentially reported to the Foundation on May 2, but by Saturday details had been leaked and were reported by several security organizations, including the French Security Incident Response Team (FrSIRT). Danish security firm Secunia marked the exploit as "extremely critical", its most serious rating, the first time it has given a Firefox flaw this rating.

In recent months Firefox has gained significant market share from Microsoft's Internet Explorer, partly because it is considered less vulnerable to attacks. However, industry observers have long warned that the browser is more secure partly because of its relatively small user base. As Firefox's profile grows, attackers will increasingly target the browser.
Two Vulnerabilities Found

The exploit, discovered by Paul of Greyhats Security Group and Michael "mikx" Krax, makes use of two separate vulnerabilities. An attacker could create a malicious page using frames and a JavaScript history flaw to make software installations appear to be coming from a "trusted" site. By default, Firefox allows software installations from update.mozilla.org and addons.mozilla.org, but users can add their own sites to this whitelist.

The second part of the exploit triggers software installation using an input verification bug in the "IconURL" parameter in the install mechanism. The effect is that a user could click on an icon and trigger the execution of malicious JavaScript code. Because the code is executed from the browser's user interface, it has the same privileges as the user running Firefox, according to researchers.

Mozilla Foundation said it has protected most users from the exploit by altering the software installation mechanism on its two whitelisted sites. However, users may be vulnerable if they have added other sites to the whitelist, it warned.

"We believe this means that users who have not added any additional sites to their software installation whitelist are no longer at risk," Mozilla Foundation said in a statement published on Mozillazine.org.
Click to expand...

http://news.yahoo.com/s/pcworld/120756

Minus · May 10, 2005

At least Mozilla is on it faster than, say, some huge organization that once believed they had the perfect browser.

I think we all know that's Apple.

Todd · May 10, 2005

Originally posted by Minus Xero@May 9 2005, 11:35 PM
At least Mozilla is on it faster than, say, some huge organization that once believed they had the perfect browser.

I think we all know that's Apple.
Click to expand...

WTF are you talking about? Apple's browser, Safari, has been in existance for a little more than 2 years, and out of beta for a little less than 2 years, and they're quick to patch up security bugs in the OS, Safari included. Before then, Apple did not even have a browser. In fact, MS IE for Mac came pre-installed with OSX up until 10.4 which was just released on April 29th. I think you're talking about Microsoft.

I know it sounds like I'm just an Apple fanboy, but I must call bullshit when bullshit is posted.

Minus · May 10, 2005

Originally posted by Todd@May 9 2005, 10:52 PM
WTF are you talking about? Apple's browser, Safari, has been in existance for a little more than 2 years, and out of beta for a little less than 2 years, and they're quick to patch up security bugs in the OS, Safari included. Before then, Apple did not even have a browser. In fact, MS IE for Mac came pre-installed with OSX up until 10.4 which was just released on April 29th. I think you're talking about Microsoft.

I know it sounds like I'm just an Apple fanboy, but I must call bullshit when bullshit is posted.
Click to expand...

It was sarcasm, man.

Hence the overly long pause.

Ander · May 10, 2005

Bullshit or sarcasm. I'm not positive either way.

I know it is Microsoft though.

[Fool] · May 10, 2005

Originally posted by Minus Xero@May 10 2005, 05:35 AM
At least Mozilla is on it faster than, say, some huge organization that once believed they had the perfect browser.

I think we all know that's Apple.
Click to expand...

yea, mozilla ROCKS

Neil · May 11, 2005

Better than an ActiveX security hole any day.

Log in or Sign up

Firefox: "Extremely Critical Security Holes"

$pvcxGhxztCasey meanwhile... LPA Addicted VIP

Minus ohai LPA Addicted VIP

Todd FLǕGGȦ∂NKđ€ČHIŒβǾLʃÊN LPA Administrator

Minus ohai LPA Addicted VIP

Ander LPA VIP LPA Super VIP

[Fool] Banned

Neil Super Duper Member LPA Super Member

Share This Page

Log in or Sign up

Firefox: "Extremely Critical Security Holes"

$pvcxGhxztCasey meanwhile... LPA Addicted VIP

Minus ohai LPA Addicted VIP

Todd FLǕGGȦ∂NKđ€ČHIŒβǾLʃÊN LPA Administrator

Minus ohai LPA Addicted VIP

Ander LPA VIP LPA Super VIP

[Fool] Banned

Neil Super Duper Member LPA Super Member

Share This Page

Useful Searches