Secunia Finds New Firefox Security Exploits (GeekCoffee)
Firefox seems to be running into more and more security vulnerabilities as the Mozilla Foundation’s browser becomes a serious contender to Microsoft’s Internet Explorer. Security research company Secunia found two new vulnerabilities that can be exploited to conduct cross-site scripting attacks to compromise a user’s system.
The Mozilla Foundation stated that it is aggressively working to provide a better solution to security vulnerabilities as well as a more convenient way to publish updates to users. A temporary fix to the current vulnerabilities is to disable JavaScript.
According to Secunia, the problem is that “IFRAME” JavaScript URLs are not properly protected from being executed in context of another URL in the history list. This can be exploited to execute arbitrary HTML and script code in a user’s browser session in context of an arbitrary site. Input passed to the “IconURL” parameter in “InstallTrigger.install” is not properly verified before being used. This can be exploited to execute arbitrary JavaScript code with escalated privileges via a specially crafted JavaScript URL.
Firefox ‘supports’ security holes (IT-Observer)
Two extremely critical security vulnerabilities in FireFox, the ultimate alternative to Internet Explorer, were discovered by security researchers. The security breaches affect all versions, including the latest release, and allow an attacker to take control of the system.
[…]
The flaws were confidentially reported to Mozilla Foundation a week ago, but details had been leaked and the vulnerabilities were reported by several security research firms. The Danish security firm Secunia, reported that an exploit is already traveling around the Net.
Mozilla Foundation said it has protected most users from the exploit by altering the software installation mechanism on its two whitelisted sites. However, users may be vulnerable if they have altered the whitelist. “We believe this means that users who have not added any additional sites to their software installation whitelist are no longer at risk,” said Mozilla Foundation.
Though security holes were previously discovered in FireFox, this is the first time that a security firm gives the “extremely critical†rating to a FireFox flaw. FireFox definitely can be proud in 50 millions downloads, but who really takes care about the popularity when it comes to security breaches that risk our computers…?
This doesn’t surprise me. While Firefox quickly became my preferred browser after some initial skepticism, it has always seemed obvious to me that the main reason Microsoft’s Internet Explorer was so vulnerable was that its ubiquity made it the natural target of hackers.
Related:
