Skip to comments.Unpatched Firefox flaw lets fox into henhouse
Posted on 07/14/2009 9:47:04 AM PDT by ShadowAce
An unpatched memory corruption flaw in the latest version of Firefox creates a means for hackers to drop malware onto vulnerable systems.
Older versions of the popular alternative browser might also be affected, Secunia warns.
Exploit code has been uploaded onto recently revived security exploit website milw0rm, a factor that could hasten the development of more attack code.
Secunia advises Firefox users to avoid browsing untrusted websites or following untrusted links pending the availability of a fix from Mozilla (there's nothing in the pipeline just yet).
The appearance of an unpatched vulnerability in Firefox could hardly have come at a worse time because it coincides with confirmation from Microsoft on Monday of a second unpatched ActiveX flaw affecting users of its Internet Explorer software.
Only one of these two security bugs is likely to be fixed later on Tuesday, when Microsoft publishes its monthly Patch Tuesday update. That prompted some security researchers, including those at the SANS Institute's Internet Storm Centre, to consider the use of an alternative browser on the grounds of security.
Selecting Firefox over IE when both have unresolved security problems fails to make much sense, leaving Windows users looking for more secure surfing software alternatives with a choice limited to Opera, Safari and Google Chrome. ®
Well, that does it, I’m switching to IE.
opera was my browser of choice until I tried FF. I may go back as either were good once setup to your preference.
I’m enjoying Omniweb these days.
< /geriatric geek >
I’m still using 3.0.11.
I am digging Chrome. Of course I still have to use IE and/or FF for certain websites.
Oh, come on, live a little! :O)
Isn’t this the whole point of installing NoScript?
I was going to— but I think I’ll wait a little longer.
Man, you are OLD!
...and adblock plus...
This just in... unpatched software leads to problems
paging Captain Obvious... you have a call on line 1
If you're running NoScript in FF 3.5, is that enough?
Posted by: WashingtonDame | July 14, 2009 12:20 PM | Report abuse
I'm not trying to say the sky is falling, here, because I'm not aware of any sites using this vulnerability yet. Just trying to answer your question.
Posted by: BTKrebs | July 14, 2009 12:28 PM | Report abuse
Thanks. I'd say that >95% of the sites I visit are sites where I do not allow scripting to run. If they hack my bank I'm in serious trouble. :) At least I know that I'm protected from new links that I may want to peek at.
So, is Linux a 'vulnerable system'?
Considering that the malware has to be written for a type of OS, I'd say it is unlikely.
However, if the malware was written for Linux, only the user and his files would be affected. Since Linux systems typically do not run as root, the system itself would not be vulnerable.
Thanks...that’s exactly what I thought (you may have already told me so on an old thread). Articles like these just assume everyone uses Windows, so they don’t even mention the OS.
That’s it, I’m going back to lynx..