Posted on 01/05/2005 10:21:20 AM PST by ShadowAce
A newly discovered flaw in Firefox could allow cybercriminals to take advantage of Web surfers
A vulnerability in Firefox could make users of the open source browser more likely to fall for phishing scams.
The flaw in Mozilla Firefox 1.0, details of which were published by Secunia on Tuesday, allows malicious hackers to spoof the URL in the download dialog box which pops up when a Firefox user tries to download an item from a Web site. This flaw is caused by the dialog box incorrectly displaying long sub-domains and paths, which can be exploited to conceal the actual source of the download.
Mikko Hyppönen, director of antivirus research at F-Secure, said this bug could make Firefox users vulnerable to cybercriminals. "The most likely way we could see this exploited would be in phishing scams," said Hyppönen.
To fall victim to such a scam, a Firefox user would have to click on a link in an email that pointed to a spoofed Web site and then download malware from the site, which would appear to be downloaded from a legitimate site.
This flaw was given a severity rating of two out of a possible five by Secunia.
David Emm, a senior technology consultant at antivirus company Kaspersky Labs, said it is unlikely that phishers will take advantage of this exploit in Firefox because Microsoft's Internet Explorer still dominates the browser market.
"I think it's unlikely that we'll see hackers rush to exploit this vulnerability," said Emm. "After all, Firefox has a much, much smaller install base than IE and it's likely that hackers will continue to pay more attention to [IE] instead."
This may change in the future as Firefox has attracted a lot of interest in the past few months. A survey at the end of November found that Mozilla-based browsers, including Firefox, accounted for 7.4 percent of browsers in November 2004, up 5 percent from May.
The download vulnerability has been confirmed in Mozilla 1.7.3 for Linux, Mozilla 1.7.5 for Windows, and Mozilla Firefox 1.0. No solution is available at present, but Mozilla developers plan to fix this bug in an upcoming version of the product.
The Secunia advisory and Mozilla bug report are available online.
Search is your friend.
And aparently unbacked exaggeration is yours..
That's basically been my mantra for the past 25 years as a computer user.
Would you please add me to your Firefox ping list?
And that is what 99.9999% of the OSS folks on this board will say but constantly I see people saying that OSS folks claim their software is unbreakable when I have *never* seen that said..
The favorite mantra of the Microsoft Apologist.
This is one relatively minor problem with FF, versus how many serious issues with IE? Granted, IE has been around longer, so it has a head start, and is fundamentally flawed to begin with. But popularity has nothing to do with it.
There is no comparison.
Actually I'm not a Microsoft Apologist. Popularity does play a part in this vulnerability in FF.
You ever run critter checks?
I'm sure you can post some proof which backs up your theory then.
If you're that clueless, then I won't bother.
I'm never surprised when a MS kneepadder backs away from a challenge.
C'mon, seriously. I want to know why you think the patrons of the most popular restaurant in town are more likely to come down with ptomaine poisoning... just because the restaurant is popular.
Sure, if you don't mind being pinged to other technical items as well.
OK, thanks.
IIRC, Firefox has an extension that takes care of this problem. At least i seem to run across it when downloading ad-ons.
Second that. Do you know if the actual URL will show with the spoofstick extension?
Mel
Ping to #58
Have it already. i believe i might have been thinking of the multi line url addon that also exists.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.