Free Republic
Browse · Search
General/Chat
Topics · Post Article

Skip to comments.

Unpatched Firefox flaw lets fox into henhouse
The Register ^ | 14 July 2009 | John Leyden

Posted on 07/14/2009 9:47:04 AM PDT by ShadowAce

An unpatched memory corruption flaw in the latest version of Firefox creates a means for hackers to drop malware onto vulnerable systems.

Security notification firm Secunia reports that the security bug (which it describes as extremely critical) stems from errors in handling JavaScript code. The flaw has been confirmed in the latest 3.5 version of Firefox, released in late June.

Older versions of the popular alternative browser might also be affected, Secunia warns.

Exploit code has been uploaded onto recently revived security exploit website milw0rm, a factor that could hasten the development of more attack code.

Secunia advises Firefox users to avoid browsing untrusted websites or following untrusted links pending the availability of a fix from Mozilla (there's nothing in the pipeline just yet).

The appearance of an unpatched vulnerability in Firefox could hardly have come at a worse time because it coincides with confirmation from Microsoft on Monday of a second unpatched ActiveX flaw affecting users of its Internet Explorer software.

Only one of these two security bugs is likely to be fixed later on Tuesday, when Microsoft publishes its monthly Patch Tuesday update. That prompted some security researchers, including those at the SANS Institute's Internet Storm Centre, to consider the use of an alternative browser on the grounds of security.

Selecting Firefox over IE when both have unresolved security problems fails to make much sense, leaving Windows users looking for more secure surfing software alternatives with a choice limited to Opera, Safari and Google Chrome. ®


TOPICS: Computers/Internet
KEYWORDS: firefox; mozilla

1 posted on 07/14/2009 9:47:04 AM PDT by ShadowAce
[ Post Reply | Private Reply | View Replies]

To: rdb3; Calvinist_Dark_Lord; GodGunsandGuts; CyberCowboy777; Salo; Bobsat; JosephW; ...

2 posted on 07/14/2009 9:47:20 AM PDT by ShadowAce (Linux -- The Ultimate Windows Service Pack)
[ Post Reply | Private Reply | To 1 | View Replies]

To: ShadowAce

Well, that does it, I’m switching to IE.

/sarc


3 posted on 07/14/2009 9:48:33 AM PDT by library user
[ Post Reply | Private Reply | To 1 | View Replies]

To: library user

opera was my browser of choice until I tried FF. I may go back as either were good once setup to your preference.


4 posted on 07/14/2009 9:52:21 AM PDT by Blue Highway
[ Post Reply | Private Reply | To 3 | View Replies]

To: ShadowAce

I’m enjoying Omniweb these days.


5 posted on 07/14/2009 9:54:36 AM PDT by LimaLimaMikeFoxtrot ("If you don't have my army supplied, and keep it supplied, we'll eat your mules up, sir"-Gen.Sherman)
[ Post Reply | Private Reply | To 1 | View Replies]

To: ShadowAce
I don't have to worry about all that - I only use Lynx.

< /geriatric geek >

6 posted on 07/14/2009 9:54:40 AM PDT by Billthedrill
[ Post Reply | Private Reply | To 1 | View Replies]

To: ShadowAce

I’m still using 3.0.11.


7 posted on 07/14/2009 9:56:36 AM PDT by Clara Lou (Leave children out of politics.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: ShadowAce

I am digging Chrome. Of course I still have to use IE and/or FF for certain websites.


8 posted on 07/14/2009 9:58:34 AM PDT by ChinaGotTheGoodsOnClinton (To those who believe the world was safer with Saddam, get treatment for that!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Clara Lou

Oh, come on, live a little! :O)


9 posted on 07/14/2009 9:59:08 AM PDT by library user
[ Post Reply | Private Reply | To 7 | View Replies]

To: ShadowAce

10 posted on 07/14/2009 10:00:41 AM PDT by JoeProBono (A closed mouth gathers no feet)
[ Post Reply | Private Reply | To 1 | View Replies]

Comment #11 Removed by Moderator

To: ShadowAce

Isn’t this the whole point of installing NoScript?


12 posted on 07/14/2009 10:10:40 AM PDT by MarineBrat (The New York Times is a Communist Kamikaze.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: library user

I was going to— but I think I’ll wait a little longer.


13 posted on 07/14/2009 10:13:44 AM PDT by Clara Lou (Leave children out of politics.)
[ Post Reply | Private Reply | To 9 | View Replies]

To: Billthedrill

Man, you are OLD!


14 posted on 07/14/2009 10:20:19 AM PDT by Dumpster Baby (The chair is against the wall. John has a long mustache.)
[ Post Reply | Private Reply | To 6 | View Replies]

To: ShadowAce

DL...
noscript...
https://addons.mozilla.org/en-US/firefox/addon/722
...and adblock plus...
https://addons.mozilla.org/en-US/firefox/addon/1865


15 posted on 07/14/2009 10:22:15 AM PDT by woollyone (I believe God created me- you believe you're related to monkeys. Of course I laughed at you!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: All

This just in... unpatched software leads to problems

paging Captain Obvious... you have a call on line 1


16 posted on 07/14/2009 10:35:42 AM PDT by Lucian (I am, therefore, I'll think)
[ Post Reply | Private Reply | To 1 | View Replies]

To: ShadowAce
Stopgap fix posted here:

Just Posted: "Stopgap Fix for Critical Firefox 3.5 Security Hole"

17 posted on 07/14/2009 10:38:07 AM PDT by CedarDave (Obama's EPA wants to get rid of cows: They emit CO2 from the front end and CH4 from the rear.)
[ Post Reply | Private Reply | To 1 | View Replies]

To: MarineBrat
From my link above:

If you're running NoScript in FF 3.5, is that enough?

Posted by: WashingtonDame | July 14, 2009 12:20 PM | Report abuse

It is possible that noscript would protect against this vulnerability. But then again, we all know you have to enable Javascript on some sites, otherwise they won't work. If that site you trust to run JS is hacked, it's game over.

I'm not trying to say the sky is falling, here, because I'm not aware of any sites using this vulnerability yet. Just trying to answer your question.

Posted by: BTKrebs | July 14, 2009 12:28 PM | Report abuse


18 posted on 07/14/2009 10:40:46 AM PDT by CedarDave (Obama's EPA wants to get rid of cows: They emit CO2 from the front end and CH4 from the rear.)
[ Post Reply | Private Reply | To 12 | View Replies]

To: CedarDave
It is possible that noscript would protect against this vulnerability. But then again, we all know you have to enable Javascript on some sites, otherwise they won't work.

Thanks. I'd say that >95% of the sites I visit are sites where I do not allow scripting to run. If they hack my bank I'm in serious trouble. :) At least I know that I'm protected from new links that I may want to peek at.

19 posted on 07/14/2009 11:05:43 AM PDT by MarineBrat (The New York Times is a Communist Kamikaze.)
[ Post Reply | Private Reply | To 18 | View Replies]

To: ShadowAce
An unpatched memory corruption flaw in the latest version of Firefox creates a means for hackers to drop malware onto vulnerable systems.

So, is Linux a 'vulnerable system'?

20 posted on 07/14/2009 12:04:17 PM PDT by shorty_harris
[ Post Reply | Private Reply | To 1 | View Replies]

To: shorty_harris
So, is Linux a 'vulnerable system'?

Considering that the malware has to be written for a type of OS, I'd say it is unlikely.

However, if the malware was written for Linux, only the user and his files would be affected. Since Linux systems typically do not run as root, the system itself would not be vulnerable.

21 posted on 07/14/2009 12:08:49 PM PDT by ShadowAce (Linux -- The Ultimate Windows Service Pack)
[ Post Reply | Private Reply | To 20 | View Replies]

To: ShadowAce

Thanks...that’s exactly what I thought (you may have already told me so on an old thread). Articles like these just assume everyone uses Windows, so they don’t even mention the OS.


22 posted on 07/14/2009 12:17:59 PM PDT by shorty_harris
[ Post Reply | Private Reply | To 21 | View Replies]

To: ShadowAce; All

23 posted on 07/14/2009 4:25:47 PM PDT by Kaslin (Acronym for 0bama: One Big Ass Mistake America)
[ Post Reply | Private Reply | To 1 | View Replies]

To: ShadowAce

That’s it, I’m going back to lynx..


24 posted on 07/15/2009 6:05:43 AM PDT by aetheraddict
[ Post Reply | Private Reply | To 1 | View Replies]

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
General/Chat
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794
FreeRepublic.com is powered by software copyright 2000-2008 John Robinson