Unpatched Firefox flaw lets fox into henhouse

The Register ^ | 14 July 2009 | John Leyden

[ShadowAce]

An unpatched memory corruption flaw in the latest version of Firefox creates a means for hackers to drop malware onto vulnerable systems.

Security notification firm Secunia reports that the security bug (which it describes as extremely critical) stems from errors in handling JavaScript code. The flaw has been confirmed in the latest 3.5 version of Firefox, released in late June.

Older versions of the popular alternative browser might also be affected, Secunia warns.

Exploit code has been uploaded onto recently revived security exploit website milw0rm, a factor that could hasten the development of more attack code.

Secunia advises Firefox users to avoid browsing untrusted websites or following untrusted links pending the availability of a fix from Mozilla (there's nothing in the pipeline just yet).

The appearance of an unpatched vulnerability in Firefox could hardly have come at a worse time because it coincides with confirmation from Microsoft on Monday of a second unpatched ActiveX flaw affecting users of its Internet Explorer software.

Only one of these two security bugs is likely to be fixed later on Tuesday, when Microsoft publishes its monthly Patch Tuesday update. That prompted some security researchers, including those at the SANS Institute's Internet Storm Centre, to consider the use of an alternative browser on the grounds of security.

Selecting Firefox over IE when both have unresolved security problems fails to make much sense, leaving Windows users looking for more secure surfing software alternatives with a choice limited to Opera, Safari and Google Chrome. ®

[ShadowAce]

[library user]

Well, that does it, I’m switching to IE.

/sarc

[Blue Highway]

opera was my browser of choice until I tried FF. I may go back as either were good once setup to your preference.

[LimaLimaMikeFoxtrot]

I’m enjoying Omniweb these days.

[Billthedrill]

I don't have to worry about all that - I only use Lynx.

< /geriatric geek >

[Clara Lou]

I’m still using 3.0.11.

[ChinaGotTheGoodsOnClinton]

I am digging Chrome. Of course I still have to use IE and/or FF for certain websites.

[library user]

Oh, come on, live a little! :O)

[JoeProBono]

[MarineBrat]

Isn’t this the whole point of installing NoScript?

[Clara Lou]

I was going to— but I think I’ll wait a little longer.

[Dumpster Baby]

Man, you are OLD!

[woollyone]

DL...
noscript...
https://addons.mozilla.org/en-US/firefox/addon/722
...and adblock plus...
https://addons.mozilla.org/en-US/firefox/addon/1865

[Lucian]

This just in... unpatched software leads to problems

paging Captain Obvious... you have a call on line 1

[CedarDave]

Stopgap fix posted here:

Just Posted: "Stopgap Fix for Critical Firefox 3.5 Security Hole"

[CedarDave]

From my link above:

If you're running NoScript in FF 3.5, is that enough?

Posted by: WashingtonDame | July 14, 2009 12:20 PM | Report abuse

It is possible that noscript would protect against this vulnerability. But then again, we all know you have to enable Javascript on some sites, otherwise they won't work. If that site you trust to run JS is hacked, it's game over.

I'm not trying to say the sky is falling, here, because I'm not aware of any sites using this vulnerability yet. Just trying to answer your question.

Posted by: BTKrebs | July 14, 2009 12:28 PM | Report abuse

[MarineBrat]

It is possible that noscript would protect against this vulnerability. But then again, we all know you have to enable Javascript on some sites, otherwise they won't work.

Thanks. I'd say that >95% of the sites I visit are sites where I do not allow scripting to run. If they hack my bank I'm in serious trouble. :) At least I know that I'm protected from new links that I may want to peek at.

[shorty_harris]

An unpatched memory corruption flaw in the latest version of Firefox creates a means for hackers to drop malware onto vulnerable systems.

So, is Linux a 'vulnerable system'?