Firefox Bug Could Be Serious - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
News
News
4/25/2006
01:53 PM
50%
50%

Firefox Bug Could Be Serious

A security firm fears that a zero-day vulnerability in a fully patched and most current version of Mozilla Corp.'s Firefox could be exploited.

A zero-day vulnerability in a fully-patched and most-current version of Mozilla Corp.'s Firefox could be exploited to crash the browser at the least, and at the worst, possibly introduce malicious code, a security company warned Tuesday.

The bug, which first appeared on Mozilla's Bugzilla listing a week ago on April 18, could be used by an attacker to crash Firefox by feeding it malformed JavaScript code.

Proof of concept code has been made public that crashes Firefox 1.5.0.2, the open-source browser's newest edition.

Although Danish vulnerability tracker Secunia ranked the threat as "low," its weakest warning, U.S.-based security vendor Symantec said the danger may be more dire.

"It does appear that triggering the vulnerability using the proof of concept results in the execution of data somewhere in anonymous memory, possibly in a portion of the heap," Symantec told customers of its DeepSight threat alert system Tuesday. "If this memory were somehow populated by an attacker with a malicious payload, this condition could likely be exploited to execute arbitrary code."

Firefox developers have come up with a patch -- one is listed in the Bugzilla report -- but has not been pushed out to users. Typically, Mozilla releases Firefox updates that include several security patches as it did recently when it rolled out version 1.5.0.2 with fixes for 24 bugs.

JavaScript-based vulnerabilities aren't new to Firefox -- nor to its rival, Internet Explorer. Several of the flaws fixed in the April 14 release of Firefox 1.5.0.2, for instance, were associated with JavaScript.

Internet Explorer's biggest threat of late -- the "createTextRange" vulnerability that was used by malicious Web sites to infect PCs with spyware and adware before Microsoft unveiled a patch on April 11 -- was also JavaScript-based.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
State of the Cloud
State of the Cloud
Cloud has drastically changed how IT organizations consume and deploy services in the digital age. This research report will delve into public, private and hybrid cloud adoption trends, with a special focus on infrastructure as a service and its role in the enterprise. Find out the challenges organizations are experiencing, and the technologies and strategies they are using to manage and mitigate those challenges today.
Commentary
Study Proposes 5 Primary Traits of Innovation Leaders
Joao-Pierre S. Ruth, Senior Writer,  11/8/2019
Slideshows
Top-Paying U.S. Cities for Data Scientists and Data Analysts
Cynthia Harvey, Freelance Journalist, InformationWeek,  11/5/2019
Slideshows
10 Strategic Technology Trends for 2020
Jessica Davis, Senior Editor, Enterprise Apps,  11/1/2019
Register for InformationWeek Newsletters
Video
Current Issue
Getting Started With Emerging Technologies
Looking to help your enterprise IT team ease the stress of putting new/emerging technologies such as AI, machine learning and IoT to work for their organizations? There are a few ways to get off on the right foot. In this report we share some expert advice on how to approach some of these seemingly daunting tech challenges.
White Papers
Slideshows
Twitter Feed
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.
Sponsored Video
Flash Poll