News
News
11/27/2007
02:54 PM
Connect Directly
LinkedIn
Twitter
Google+
RSS
E-Mail
50%
50%

Firefox Fixes Three Security Flaws, Though More Remain

The vulnerabilities could be used to gather sensitive data from sites in other windows or inject data or code into those sites, Mozilla said.

Mozilla has released Firefox 2.0.0.10, an update that address three security flaws.

The update issued Monday fixes a Java Archive handling vulnerability found in February that allows an attacker to hide exploit code in a Java Archive (.jar) file. It also fixes a memory corruption bug and a flaw that allowed an attacker to generate a fake HTTP Referer header for conducting a Cross-site Request Forgery (CSRF) attack.

Each of the three vulnerabilities is rated "high" by Mozilla, meaning the flaws could be used "to gather sensitive data from sites in other windows or inject data or code into those sites, requiring no more than normal browsing actions."

The Mozilla Community called for help testing the update last week and said improved code would be released this week. Firefox 3 Beta 1 was released last week as a developer preview.

Not fixed in Firefox 2.0.0.10 is a QuickTime flaw reported last week that affects both Mac and Windows users.

"An attacker can lure a victim to load a Web page with an embedded media object or a file in an e-mail, triggering a bounds checking error in QuickTime that may allow execution of arbitrary code," the Mozilla Security Blog explains. "This issue impacts QuickTime on Windows and on Mac OS and there is proof-of-concept code publicly available. If QuickTime is set as the default media player, Firefox will send the request directly to QuickTime. Mozilla is currently investigating this issue to identify ways to protect Firefox users."

In a report released today, the SANS Institute listed Web browser vulnerabilities among other top security issues in 2007. The SANS list cites 14 security vulnerabilities in Firefox in 2007 and 21 in Internet Explorer.

"The browser is really the main gateway today for malware," said Johannes Ullrich, CTO of the SANS Internet Storm Center, on a Tuesday morning conference call.

Comment  | 
Print  | 
More Insights
The Business of Going Digital
The Business of Going Digital
Digital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
Register for InformationWeek Newsletters
White Papers
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join InformationWeek’s Lorna Garey and Mike Healey, president of Yeoman Technology Group, an engineering and research firm focused on maximizing technology investments, to discuss the right way to go digital.
Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.