Posted on 04/18/2005 12:36:00 PM PDT by infocats
Multiple vulnerabilities that could allow an attacker to install malicious code or steal personal data have been discovered in the Mozilla Suite and the Firefox open-source browser.
Details of the nine flaws were published on Mozilla's security Web site over the weekend.
Ian Latter, senior security consultant at Internet security specialist Pure Hacking, said most of the vulnerabilities are based on the way the applications handle JavaScript.
"There are some permission issues related to running JavaScript at an escalated privilege level. They remove some of the security measures used to keep JavaScript sandboxed and allow it to potentially do malicious things to your computer," Latter said.
Another issue could allow malicious scripts to gain access to random pieces of memory, he said.
"This random memory may or may not contain pieces of information about where you have been browsing. The worst-case scenario is that it could contain some personal or login information," said Latter.
On Monday, security advisory firm Secunia issued a "highly critical" rating on the flaws found in Mozilla Firefox 0.x and 1.x versions. Secunia posted its advisory on eight of the flaws.
According to the French Security Incident Response Team, attackers could run malicious code on a user's system because of a flaw in the Mozilla browser's pop-up blocker.
An advisory from the French group said, "When a pop-up is blocked, the user is given the ability to open that one pop-up...If the pop-up URL were JavaScript: selecting 'Show JavaScript:...' from the infobar or pop-up blocking status bar icon menus would run the JavaScript with elevated privileges, which could be used to install malicious software."
Another of the Firefox flaws can be exploited when a user visits a Web page that requires a plug-in that has not already been installed. The French advisory claims that if the browser's Plug-in Finder Service is used to automatically locate an appropriate plug-in, the "manual install" function can be used to "launch arbitrary code capable of stealing local data or installing malicious code."
All versions of Mozilla Suite prior to version 1.7.7 and all versions of Firefox prior to 1.0.3 are vulnerable.
Pure Hacking's Latter advises users to either disable JavaScript or download a patched version from Mozilla's Web site.
ping
Darn that Bill Gates!
His minions are everywhere inserting malicious code into competing browsers just to make them vulnerable.
Will he stop at nothing to achieve his nefarious ends ???????
attention all internet users: nothing is secure. if you want a terminal that stores data securely, unplug it from the internet, period.
thread over. no further discussion neccessary.
Netscape, Thunderbird and Firefox are built on top of the Mozilla "engine" ... vulnerabilities vary by release version....
So, if you have kept your "update" function on, this is not a problem? ;o)
See, guys, this is what happens when you become a major force in the internet world ... more people notice you and the hackers come out of their caves and try to hack it.
Welcome to the Big-Time guys, now you'll see what MS puts up with every single day.
Fun ain't it?
But at least we can modify our code and recompile, rather than wait for Bill and his friends to get around to it.
This was not a virus attack. This was the discovery of a vulnerbility.
Well, once the new Pope takes office, I am sure he'll put an end to all these shenanigans.
IE has no security flaws.
Mozilla is being dropped, and firefox updates are already out...
!!!
And? Your point is? Everytime MS finds a vulnerablity, it's exploited by the anti-MS crowd as proof that MS sucks and Bill Gates is Satan.
Ping for later.
IE ought to come with a bottle of lube to make things less painful for users. The vulnerabilities I've seen for Firefox are almost trivial by comparison. Forinstance, here are these two in a nutshell:
1. If you try to unblock a blocked popup ad, and if that ad had malicious java code, it might "expose some arbitrary pieces of heap memory." Or, according to some French security guys, you could end up installing malicious Java code on your PC.
2. If you browse a site that requires a plugin that is not already installed, and you use Mozilla's Plug in Finder Service, and you select manual install... well, surprise, you could be installing malicious software.
With IE, all you need to do is browse normally and you pick up spyware like a dog picks up fleas. Unless you update, of course... just like Firefox.
I never said you couldn't. My point is, and you know this is true, everytime MS admits flaws, the anti-MS crowd hovers around like sharks with the usual rhetorical statements.
That the warning of vulnerabilities is not something that MS "puts up with" every single day. Usually, we learn of a vulnerability after the virus, worm etc..
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.