Mozilla flaws could allow attacks, data access

Apex

Skilled
Multiple vulnerabilities that could allow an attacker to install malicious code or steal personal data have been discovered in the Mozilla Suite and the Firefox open-source browser.

Details of the nine flaws were published on Mozilla's security Web site over the weekend.

Ian Latter, senior security consultant at Internet security specialist Pure Hacking, said most of the vulnerabilities are based on the way the applications handle JavaScript.

"There are some permission issues related to running JavaScript at an escalated privilege level. They remove some of the security measures used to keep JavaScript sandboxed and allow it to potentially do malicious things to your computer," Latter said.

Another issue could allow malicious scripts to gain access to random pieces of memory, he said.

"This random memory may or may not contain pieces of information about where you have been browsing. The worst-case scenario is that it could contain some personal or login information," said Latter.

On Monday, security advisory firm Secunia issued a "highly critical" rating on the flaws found in Mozilla Firefox 0.x and 1.x versions. Secunia posted its advisory on eight of the flaws.

According to the French Security Incident Response Team, attackers could run malicious code on a user's system because of a flaw in the Mozilla browser's pop-up blocker.

An advisory from the French group said, "When a pop-up is blocked, the user is given the ability to open that one pop-up...If the pop-up URL were JavaScript: selecting 'Show JavaScript:...' from the infobar or pop-up blocking status bar icon menus would run the JavaScript with elevated privileges, which could be used to install malicious software."

Another of the Firefox flaws can be exploited when a user visits a Web page that requires a plug-in that has not already been installed. The French advisory claims that if the browser's Plug-in Finder Service is used to automatically locate an appropriate plug-in, the "manual install" function can be used to "launch arbitrary code capable of stealing local data or installing malicious code."

All versions of Mozilla Suite prior to version 1.7.7 and all versions of Firefox prior to 1.0.3 are vulnerable.

Pure Hacking's Latter advises users to either disable JavaScript or download a patched version from Mozilla's Web site.

[RANK="www.zdnetindia.com/techzone/resources/security/stories/120662.html"]Source[/RANK]
 
hmm...everything has flaws...its just a matter of time before ppl discover it.

What do you mozilla users out there comment on this little article??
Edit: After reading the Next Post.
Nope i am not trying to flame here.

P.S : This post reflects my opinion alone. No offence meant.
 
XTerminator said:
What do you mozilla users out there comment on this little article??

err..

XTerminator said:
everything has flaws...its just a matter of time before ppl discover it.
isnt that a good enough answer? or u flaming here? :p
and to continue with ur words, its also a matter of popularity.. its only when a software has a substantial number of users that hackers try to find fault/flaws with it so that its easier for them to inflict damage quickly and largely.
(perhaps Opera/Maxthon's flaws have not been "discovered" yet b'coz they aint as popular as Firefox?)
 
Back
Top