By Munir Kotadia, 18 April 2005 10:10
NEWS Multiple vulnerabilities that could allow an attacker to install malicious code or steal personal data have been discovered in the Mozilla Suite and the Firefox open source browser.
Details of the nine flaws were published on Mozilla's security website over the weekend.
Ian Latter, senior security consultant at internet security specialist Pure Hacking, said most of the vulnerabilities are based around the way the applications handle JavaScript.
"There are some permission issues related to running JavaScript at an escalated privilege level. They remove some of the security measures used to keep JavaScript sandboxed and allow it to potentially do malicious things to your computer," said Latter.
Latter said another issue could allow malicious scripts to gain access to random pieces of memory.
"This random memory may or may not contain pieces of information about where you have been browsing. The worst-case scenario is that it could contain some personal or login information," said Latter.
According to the French Security Incident Response Team (FrSIRT), attackers can potentially run malicious code on a users' system because of a flaw in the Mozilla browser's pop-up blocker.
The FrSIRT advisory said: "When a pop-up is blocked, the user is given the ability to open that one pop-upÂ… If the pop-up URL were JavaScript: selecting 'Show JavaScript:...' from the infobar or pop-up blocking status bar icon menus would run the JavaScript with elevated privileges, which could be used to install malicious software".
Another of the Firefox flaws can be exploited when a user visits a web page that requires a plug-in that has not already been installed. The FrSIRT advisory claims that if the browser's Plug-in Finder Service is used to automatically find an appropriate plug-in, the 'manual install' function can be used to "launch arbitrary code capable of stealing local data or installing malicious code".
All versions of Mozilla Suite prior to version 1.7.7 and all versions of Firefox prior to 1.0.3 are vulnerable.
Pure Hacking's Latter advises users to either disable JavaScript or download a patched version from Mozilla's website.
Munir Kotadia writes for ZDNet Australia.
Comments
There are 4 comments. Join the discussion
1. anonymous
thats more than Internet explorer this month.
FaultyFox not firefox
2. Chris Nixon
Where are the slavering hordes of 'flamebait'-watchers today? Normally, any article or news story hosted by Silicon that mentions (no matter how factually or objectively) *any* possibly negative aspects of a) Apple equipment, b) Linux/*nix or c) Mozilla/Firefox, attracts childish responses by the dozens, from people who refuse to use any and all 'tools of Satan' (read: any platform / application other than their personal favourite).
The Talkback sections of such articles while away many happy lunchtimes, I have to say, and there's an element of nostalgia too (the old Speccy vs C64 vs BBC Micro spats).
So where are they all today? I need my daily dose of zealot-driven mindless arrogance from people who aren't actually qualified to comment, usually because they have never had the need or inclination to master an eclectic group of systems in either their personal or professional lives.
Those that have, I read their comments with interest as they offer genuine perspective.
3. Mike Grello
So, there is already a fix, then? Boy, that's some buggy software, huh? I mean it would be weeks beofre ther was a fix for an IE bug!
4. anonymous
Heads up!!
Downloaded 1.0.3 Firefox and now "can't find" any web addresses.