Exploit turns up heat for Firefox flaw

CNet News ^ | 8 February 2006 | Joris Evers

[ShadowAce]

Computer code that could be used in cyberattacks on Firefox users has been released, increasing the urgency for people to upgrade to the latest version of the Web browser.

The two pieces of exploit code, posted online earlier this week, take advantage of a security vulnerability in Firefox that Mozilla patched in an update Thursday. In response to the exploit release, the browser maker on Tuesday upgraded the severity rating of the flaw from "moderate" to "critical," its most serious rating.

"This exploit was published after we released the 1.5.0.1 update," said Mike Schroepfer, vice president of engineering at Mozilla. "Most of our users had already been upgraded by the time this exploit was published."

The code could be used to commandeer computers running a vulnerable version of the open-source Web browser on Linux or Mac OS X systems. It has been published as part of the Metasploit Framework, a widely used hacking tool.

The specific flaw exists only in Firefox 1.5 and was fixed in Firefox 1.5.0.1. The problem could cause a memory corruption an outsider could use to run code on a vulnerable PC, according to a Mozilla advisory. The corruption would come from calling the "QueryInterface" method of the Location and Navigator objects in the browser.

Firefox users have already been urged to install the patched version of the browser. Security monitoring company Secunia last week rated the Firefox update "highly critical," and Mozilla has pushed out updates.

If for some reason users have not upgraded, they should definitely do so, Schroepfer said.

[ShadowAce]

"This exploit was published after we released the 1.5.0.1 update," said Mike Schroepfer, vice president of engineering at Mozilla.

[ShadowAce]

[Uncle Miltie]

This is impossible because we know that open source code is invincible. We've been told. By "They".

[TexasTransplant]

Wonder if ver 1.0.7 is at risk?

[ShadowAce]

This is impossible because we know that open source code is invincible.

I keep hearing that.

< Inigo Montoya >I do not think it means what you think it means.< /Inigo Montoya >

[N3WBI3]

The specific flaw exists only in Firefox 1.5 and was fixed in Firefox 1.5.0.1

[ShadowAce]

Wonder if ver 1.0.7 is at risk?

I believe it is. I'd recommend going to 1.5.0.1

[ShadowAce]

The specific flaw exists only in Firefox 1.5...

Arrgh! I missed that. Sorry

[antiRepublicrat]

"This exploit was published after we released the 1.5.0.1 update,"

Good for them. Patch before exploits are released. Microsoft can learn from this.

[Drammach]

No problem.

Firefox automatically notified me as soon as the update was available.. ( Thursday )
My browser was updated less than 5 minutes later..

[N3WBI3]

I was wondering why fc3 is still rinning 1.0.7 until I read this article...

[Terpfen]

Probably is, but why keep using 1.0.7?

[learner]

When I try to download it the dialoge box says it must go to a disc and I cannot change it. Is there a way to download it directly? Thanks

[N3WBI3]

Some of us just want to use the one (RPM) that came with our distro to centralize the update service..

[N3WBI3]

What OS are you patching it on?

[rightwingextremist1776]

For all those complaining about IE and Microsoft flaws...It just goes to show that ANYTING can be exploited....it's just a matter of time and popularity.

[Primetimedonna]

FYI

[learner]

Windows XP

[N3WBI3]

Except that nobody ever said that OSS software is immune to flaws, thats just something people say they hear when they want to bring a red herring to the discussion.

But I have heard people say that the architecture of a program does not matter *ONLY* its popularity and that is flat out wrong.

[N3WBI3]

Well Im using Linux (Fedora) right now so I cant try the update but Ill see if I get time tomorrow..