Security Flaw Discovered in Firefox
By Ed Oswald | Published April 5, 2005, 3:08 PM
Security firm Secunia has discovered a "moderately critical" security flaw in the most recent versions of Firefox and the Mozilla Suite. According to the advisory, a problem in the handling of JavaScript could potentially allow a remote user access to sensitive information.
"The vulnerability is caused due to an error in the JavaScript engine, as a 'lambda' replace exposes arbitrary amounts of heap memory after the end of a JavaScript string," Secunia said in the advisory.
The company provided an example of the flaw where users can test their browsers to see if they are susceptible to the problem. So far, the vulnerabilities have been confirmed in versions 1.0.1 and 1.0.2 of Firefox, and 1.7.6 of the Mozilla Suite.
Mozilla Foundation officials declined to comment on whether or not the flaw will be fixed in version 1.0.3 of Firefox, which is due shortly, although sources confirmed that a fix for the issue will be included in the update.
The bug was first reported on April 1 and was fixed within hours by Mozilla developers who integrated a patch into the latest Firefox and Mozilla code.
Firefox has been touted as more secure than Microsoft's Internet Explorer, which has challenged several security firms to attempt to find security holes in the browser. Mozilla even offers users a monetary award of $500 for each valid bug discovered through its Bug Bounty program.
Nathan Mook contributed to this report.
Ever since I moved to Firefox, my ADware and Spyware dropped to almost nothing.
Firefox is by far the best browser I have ever used.
Score: 0
|FF patched...
So when will IE be done?
Score: 0
|Get a little market share and the hackers are willing to attack their own — open source apps. Pretty sad, but as we all know, no browser CAN be secure, so stop pretending Firefox is any different. I'm just surprised by how many holes there are. This is the third set of "critical" security flaws found in Firefox in the last eight days. Not good if like me, you use the thing all day.
Score: 0
|Well put. I couldn't agree with you more.
Score: 0
|One question.
Lately the debate is always between IE and FireFox...
i totally agree that no web browser is secure.
FF is open source and its free
IE comes with Windows.
Now the question is, anyone know where i can find flaws and vulnerabilities of Opera?
the reason for this question is because i use Opera in daily bases. thanks for letting me now.
I really wanna know, and im not being sarcastic or whatever.
tnx
Score: 0
|Pfffffff
Who said that FF is perfect?? at least is more secure than IE. IE has more holes than FF so don't talk like a Microsoft cry baby.
I don't know where you read that FF is a perfect Broswer. check out the version of FF and compare it with IE. IE is more older. so IE should be more secure but it isn't. so before you talk about a Browser try to find a correct point / comment.
Score: 0
|Firefox and Mozilla are more secure than Microsoft Browser? Umm..ok. Is masterlock more secure than Shlag locks? I depends on who is using them. The majority of people use Master to lock gates. So if all of a sudden there is a problem discovered with Master locks, there is going to a much larger epidemic. Microsoft was the least used browser when it came out, I guess everyone forgot that, and we SWITCHED because Netscape sucked. No Active X, no support for many things, like alt- and usability features, no toolbars.. I guess YOU people have a really short memory. IE made things better. But because Microsoft allowed programmers to develop for it, now Microsoft gets blamed for the inadequate programming in IE. IE by itself is not vulnerable. When you start adding things like google toolbar, yahoo, websearch, hotbar, that's when the thing becomes unstable and open to attacks, because they PASS information TO IE.
So before you go and get on your cheap a** high horse, FF is NOT more secure than IE. FF isn't utilized by more than a million people, which on the surface seems like a lot, but when you consider there are over 250 million installations of Windows worldwide, and 90% of those use IE, this is what you get, 250 times more complaints, mostly about the same damn thing.
FF is NOT more secure, or LESS secure. Its largely unnoticed, lets get the facts straight. OH, and I don't give a damn about that 25 million download thing, that's hype. Majority of users are still using Netscape and IE, period. FF is nothing but a toy, a blip, a pebble on the superhighway.
Score: 0
|Opera doesn't stay running long enough for me to find out :) And its really poorly implemented. That is a really bad program, both in design and function. I can give you a list of about 20 well known web sites, and Opera just doesn't display the page correctly at all.. nor does it have things I am used to, like toolbars..
It needs some real improvement, so you don't hear about vulnerabilities, becuase very few people use it enough to discover them.
Score: 0
|I went to Secunia's web site and ran the test after downloading and installing FF 1.0.3 RC2 and if I understand what the test results indicate they have fixed it. I never got any printable chartacters.
Score: 0
|Secunia is sure to make tens of thousands of dollars off of their "phantom" security problems they find.
Score: 0
|I'm personally disappointed that Firefox has proven to be less secure than IE over the last 8 or 9 months ... especially since Mozilla keeps the security issues secret for most users: http://www.mozilla.org/p...wn-vulnerabilities.html
Score: 0
|Of course they'll keep it secret (until a fixed release is out)--any decent company would do this, even Microsoft. That way, h4ck3rs can't 0wn someone before a fixed release is available.
But I'm not sure how you decided IE was more secure--I mean, this problem was fixed within *hours*, and a new build is due out shortly. What more can you ask for? (Except a patch update, instead of a total re-download, but they're working on that.)
Score: 0
|That's right - Mozilla is still fixing problems much quicker than the 'monthly patch' program initiated by Microsoft. You need to remember that some of these problems (IDN?) are more to do with the initial standard, rather than the program itself.
Score: 0
|what color is the sky on the planet where you live Linuxistheft? Not only is FF still more secure, but the development team fixes what flaws are found in a much more timely manner than Microspud. See my comment above.
Score: 0
|IE may be more secure, but only on planets with no internet: Firefox's dominance is so easy to verify as to be beyond argument-- just try a simple test of surfing one day with each, running Spybot, Adaware, AND Pest Patrol at the end of each day to see what malware has clambered aboard. In fact, you can run IE immunized & protected w/ a bunch of third party apps & blockers AND its security settings set so high that a lot of normal web content won't display-- and you'll still pick up malware, worse still: in large quantitities to boot.
CONVERSELY with Firefox: install no extra apps & fiddle w/ no security settings(thereby not missing out on any content / functionalities) and see what contrasting results you still obtain.
This is all so commonly known & accepted as to be past all debate stages.
Score: 0
|LOL, I didn't even notice their user name here until I read your comment. I guess we can expect someone with a user name like that to say such comments.
Score: 0
|Really? Not that I have noticed...
Score: 0
|" just try a simple test of surfing one day with each"
How about months? With IE on XP SP2. No spyware. None.
Frankly, downloading a new release of Firefox every couple of weeks is not something most ordinary users are willing to do. Therefore most installs of Firefox are probably not fully patched. And since Firefox's patching mechanism is a joke ... things will only get worse.
And the number of serious security holes in Firefox over the last 9 months is higher than for IE 6 ... and that is for IE 6 without XP SP2. Total security issues is even higher.
Of course, if you pretend to be a Mozilla developer you get to find out about hundreds of secret security issues that are kept hidden from the ordinary public. But those exploits are ravaging Firefox users today.
Score: 0
|doubtful.
even locked in an enterprise network with limited internet access, and computers locked down so only administrators can write directly to the hard drive, IE with SP2 still manages to pick up malware.
IE is required in the enterprise I work in, and it's such a piece of crap, there's nothing worse. However, there are activex application hooks at the moment, and we can't avoid it.
Big company IT only uses IE because they locked into webapps that require active x. They know the alternates are better AND safer, but atfer investing millions of dollars on web applications that require an insecure browser, they have a hard time justifying a change to the techno-inept folks who actually approve infrastructure spending, and would fire then all if they found out how they encouraged investment in IE based garbage.
IE = Inexcusable Excrement.
Score: 0
|"IE with SP2 still manages to pick up malware."
I'm getting tired of this mantra. I never caught any spyware/malware/whateverware with IE, SP2 or not, and that on several machines and type of connections, over the last *years* (i.e.: starting with, say, IE 2.0)
So either you're not very good at computing, or you're just pulling out some bs to make a point.
In any case, you're ranking quite low on the credibility level AFAIC.
Score: 0
|Man you guys are seriously dull. Everytime someone mentions firefox everyone screams SECURITY in unison until someone disagrees, then everyone starts throwing rocks instead. Seriously, if FF was the biggest browser you would see a lot more exploits than it has in its current state. Also I find everyday that something is missing in FF, like you CANNOT move ANY toolbars at all. At all. What is up with that? But I'm still sticking with FF and Opera and the occasional IE browsing.
Score: 0
|Security depends on three major things: Users, users, users. Download Kazaa using IE 6 and you get spyware (or FF for that matter). The fact is MOST SPYWARE COMES BUNDLED WITH DOWNLOADED APPS, SO COMPARING AMOUNTS OF SPYWARE BETWEEN FF AND IE IS NOT A TRUE TEST TO SEE WHICH IS BETTER.
I personally think this $500 per-vulnerability thing is cutting FF in the throat, now more and more vulnerabilities will be found. Heck, I'd love to find one for $500, you're just asking for more patches than IE. An important thing to realize is that no vulnerabilities are a threat until they are utilized, so as long as we find them before malicious users do there is no problem. The RPC vulnerability existed since Windows 2000, yet for 3 and a half years no one knew of the flaw. If MS hadn't discovered it in June of 2003, it is highly likely that the Blaster virus would not have been nearly as bad as it was. Please don't misunderstand--security flaws need to be patched as they're discovered. But if too many are discovered in a short time, Administrators can't patch fast enough, then Blaster happens. Think of the hundreds of security issues with Windows XP Gold--it had serious problems because so many flaws were found in such a short time. Again the RPC vulnerability was "just another useless ms critical update" until two months later when Blaster came out. MS was releasing too many patches. THAT IS EXACTLY WHY MICROSOFT IS DOING THE MONTHLY UPDATES NOW, PEOPLE! Microsoft is a monopoly because they are smart, not because they're Micro"spud" or Micro$oft or whatever.
The intentions are good, but FF is just hurting themselves forcing all vulnerabilities to be exposed right off the bat. Opera, as another example, fixes problems as people find them and offer little incentive. Works for them. Works for Microsoft. Maybe FF might hear me on this one. I don't care what you guys think of MS, they're still #1, and that means they aren't the idiots everyone makes them out to be.
Score: 0
|why move the toolbars?!?! is it really necessary, especially if there is only the main toolbar, and the bookmark toolbar??!?!
Score: 0
|atleast FF is willing to admit to the problem and fix it in a timely manner. The pay off is to encourage users to do just what they do, find issues so they can be fixed. Isn't that what Open Source is all about, with the help of others, enhance an application?!?!
"Open source is a philosophy of software distribution that allows anyone to read and modify the program's source code. Because anyone can modify the source code, bug fixes, improvements or implementation of new specific features occur rapidly."
www.webasyst.net/glossary.htm
Score: 0
|If open source was so quick at finding vulnerabilities, why was the FF GIF vulnerability that allowed remote code execution come from code that was in Netscape in 1998?
Score: 0
|Yes it is.
Why should there be a refresh button? Can't you just type the url again. Why do you need a velocity meter in a car, you can just count the time it takes to move between landmarks and find out your velocity. See my point? User interfaces are very important. I use more than one toolbar and half of my screen is filled up of grey dull toolbars ATM. I see your point too but...
Score: 0
|SP2 is irrelevant here: less than half of all computers are running XP sp2-- very latest IE is not for all Win versions...
and the other point is not having to have browser & related security settings set so high so as to miss out on common websites/ content / apps, nor being able to avoid constant repetitive / time-consuming steps.
A bit off-topic, but I can also do without IE crashes forcing a reboot of the computer-- & further appreciate if there is a browser crash-- re-opening browser & having the session auto-restored w/ all its windows & tabs.
Score: 0
|Preach it, Brother LinuxIsTheft.
I, for one, want Firefox to go the way of the buggy whip. Things were so much easier when there was only one real choice. Deciding what to use among several browsers creates an unpleasant cognitive dissonance that threatens to overheat my pea-sized brain!
Microsoft, hurry up with IE 7; don't make us think.
Score: 0
|