Critical Flaw Found in Firefox

[RedEarth]

Firefox has unpatched "extremely critical" security holes and exploit code is already circulating on the Net, security researchers have warned.


The two unpatched flaws in the Mozilla browser could allow an attacker to take control of your system.

A patch is expected shortly, but in the meantime users can protect themselves by switching off JavaScript. In addition, the Mozilla Foundation has now made the flaws effectively impossible to exploit by changes to the server-side download mechanism on the update.mozilla.org and addons.mozilla.org sites, according to security experts.

The flaws were confidentially reported to the Foundation on May 2, but by Saturday details had been leaked and were reported by several security organizations, including the French Security Incident Response Team (FrSIRT). Danish security firm Secunia marked the exploit as "extremely critical", its most serious rating, the first time it has given a Firefox flaw this rating.

In recent months Firefox has gained significant market share from Microsoft's Internet Explorer, partly because it is considered less vulnerable to attacks. However, industry observers have long warned that the browser is more secure partly because of its relatively small user base. As Firefox's profile grows, attackers will increasingly target the browser.

http://news.yahoo.com/s/pcworld/120756

[Megahurtz]

1. Uh oh.

Oh shit.

[okieinpain]

2. thanks.

[Amich]

3. thank you for catching this article.

I have already had to wipe out the information on my computer once this year inorder to get rid of all the crap..I don't want to have to do it again..

[IChing]

4. Check your version

in your browser task bar, you need 1.0.3 for security fixes

[Stinky The Clown]

18. I have 1.0.3 ..... am I okay? Is my Java being on okay?

Thanks (I feel so stupid when it comes to this crap sometimes).

[lazarus]

5. Imagine that

:/

[Kagemusha]

6. And how do you switch off javascript for this?

Just wondering.

[bicentennial_baby]

9. Go into "Options"

Tools---->Options---->Web Features---->Enable/Disable JavaScript

[cprise]

12. My suggestion: Don't disable it.

If you agree to installation dialogs that just randomly appear, then I guarantee you have bigger problems than anything Javascript could cause.

[bicentennial_baby]

14. I agree with you there

most definitely...

[Kagemusha]

21. I'm a very realistic guy and totally understand your point there...

Once I actually read the article in full and saw the way this would be exploited... well, they're idiot traps, for the most part. Bad if you fall into one, but as usual e-mail popups probably will end up snaring a lot more people.

Thanks for the advice, though if I hold off I'm going to a) be extra careful, b) patch as soon as I can.

[CabalPowered]

22. And if a Windows user, make sure you're not logged in as admin..

If the user account has admin privileges, you could still be vulnerable to registry edits w/o user knowledge.

[Megahurtz]

7. I have a DSO Exploit patch:

(if they are talking about "DSO Exploit")

You can download a patch, and you can set it up to protect your computer: (I think it will work regardless of Firefox):

http://www.nsclean.com/dsostop.html

[Bush_Blows]

8. I'm sure Microsoft has helped find those holes...

They need to divert attention from the myriad of holes in their own crap.

[cprise]

10. Yeah, you have to manually install the attacker's software first.

If you've already installed the malicious software on Windows, then it can do anything it wants. Why would an attacker try to even use Firefox to do the deed at that point?

That's why actual attacks via Firefox haven't come about. It's like building a Trojan horse, and when the victim accepts it you come out and attack with butter-knives and thumbtacks (Javascript).

"users may be vulnerable if they have added other sites to the whitelist"

So you add a sleazebag site to your installation whitelist and you still want Firefox to protect you from it?

WhatEVER.

[Oreo]

11. Check your options

You're not vulnerable as long as you haven't added sites to the Allow web sites to install software option

To get there click Tools -> Options -> and look at the Allowed Sites for software installs. Mine only has update.mozilla.org which they supposedly patched.

Goes to show you there are going to be flaws in every software package. The more popular it is... the more people try to hack it.

Makes you feel safe with e-voting huh?

[Nomad559]

13. :-)

http://www.democraticunderground.com/discuss/duboard.php?az=view_all&address=105x3212420

[UCLA Dem]

15. boo. now what will we use?

[Daphne08]

16. I have Spy Bot Search & Destroy on my computer.

Will it prevent this problem?

[Massacure]

17. Just disable javascript unless your on a site that requires it.

And also make sure you don't add any sites to your whitelist for installation. If you don't have any whitelisted sites, everysite that tries to install something has to ask first. Only an idiot would say yes to a random installer.

I'll bet 10 brownie points Mozilla fixes it by the end of the week.

[Eloriel]

20. Didn't prevent the problems I'm having.

Nor does it detect any problems. :-(

[CatholicEdHead]

19. When is 1.0.4 due out?

to fix this problem.

[pop goes the weasel]

23. use Opera n/t