FireFox Browsers Suceptible to Malicious Code... Here's the temp fix...
 

The fix: Users can protect themselves by temporarily disabling JavaScript, according to Mozilla.




The problem:


May 9, 2005
Two Holes Poke Firefox Veneer
By Tim Gray


It seems Mozilla's Firefox, the undisputed darling of the alternative browser set, isn't immune after all to the slings and arrows suffered by other popular interfaces.

On Saturday the Greyhats Security Group punctured the browser's aura of invincibility after it released details of two flaws that allow a malicious site to execute arbitrary code.

The advisory explains that the successful attacks involve two elements. The first flaw fools the browser into thinking software is being installed by a "whitelisted site." The second flaw occurs when the software installation trigger does not sufficiently check icon URLs containing JavaScript code.

Users can protect themselves by temporarily disabling JavaScript, according to Mozilla.

Less than a week after the foundation trumpeted breaking the 50 million download mark, the browser is dealing with what has been called by Danish security firm Secunia its first "extremely critical" bug.

The Mozilla Foundation said there are currently no known active exploits of these vulnerabilities, although a "proof of concept" has been reported.

Greyhats said an attacker can first use frames and a JavaScript history flaw to make it appear that a software installation is being triggered from add-ons.update.mozilla.org.

As the JavaScript is executed from the chrome, it has "full chrome privileges" and can "do anything that the user running Firefox can."

"Mozilla is aggressively working to provide a more comprehensive solution to these potential vulnerabilities and will provide that solution in a forthcoming security update," the foundation said on its Web site.

Numerous security outfits agree with the foundation's suggestions of disabling JavaScript as a workaround.

"We believe this means that users who have not added any additional sites to their software installation whitelist are no longer at risk," Mozilla Foundation said in a statement.


http://www.internetnews.com/security...le.php/3503506

You probably won't have to worry about it if you don't surf for porn, warez, or serialz.

No shit I am glad I didn't post this. He rips me every time when I mention FireFox.

Anyway shouldn't this be in Geeksplanet?

It will be, Dirk... IT WIIIIILLL BEEEEEEEE. [/ yoda]

ROFL

Yeah, what am I, made of stone?

Thanks for the heads up.

Thanks Yoda!

russ or parker ... who shows themselves first?




"buh,buh, but ... everyone here says firefox is perfect"

"everyone knows that only IE has security issues ..."

"only the geniouses says that ..."


:rolleyes:

The invincible Firefox, busted AGAIN!!! :)

(Sorry, wanted to be the first to do that.)

I believe the MAC Safari browser was shown to have a mighty huge whole in it as well.

http://it.slashdot.org/it/05/05/08/2...&tid=179&tid=3

I still love me some Firefox.

Gotta agree.

Anyone blind enough to still think IE is better than FireFox is a fool. A damn fool.

The greater the distribution of the product, the more likely flaws/security 'holes' will be uncovered. It's the nature of the beast.

I use Camino and don't have any problems.