Security
Subscribe to this site with RSS
Mozilla rushes out second Firefox patch this month
Mozilla has patched a pair of nasty flaws in its Firefox browser, two weeks after security researchers first started posting code that showed how the flaws could be exploited in attacks.
Related links
No results were found for your search.
Your query is too restrictive.
You might want to try: security
Story tools
Sponsored by:
E-Mail article
|
|
Print article
|
|
Contact author
|
|
AIM article
|
del.icio.us |
Reddit
|
Digg
|
Stumble
|
Slashdot It!
|
The 2.0.0.6 version of Firefox, released Monday, fixes a pair of related flaws in the URL protocol handler component of Firefox, which is used to launch programs when a user clicks on certain specially crafted Web links.
Mozilla rates these problems critical, meaning they are a serious security risk. But they have also proven to be an embarrassment for the open-source project.
Earlier in the month security researcher Thor Larholm showed how to exploit this type of problem in order to make Internet Explorer and Firefox jointly launch software on a user's machine without authorization. To make the attack work, IE would load malformed data from a Web site, and would then send it to Firefox, which would launch the unauthorized software
Microsoft and Mozilla disagreed about who was to blame, however, with Mozilla initially saying that the attack wouldn't work on Firefox alone.
But last week, Mozilla's security chief Window Snyder admitted that her team was wrong. "We thought this was just a problem with IE. It turns out, it is a problem with Firefox as well," she said in ablog posting. "We should have caught this scenario."
The URL protocol handler flaw will also be patched in Thunderbird 2.0.0.6, Thunderbird 1.5.0.13 and SeaMonkey 1.1.4, Mozilla said.
The 2.0.0.6 Firefox release also fixes a third security flaw, that Mozilla considers to be less-critical than the URL protocol handler bugs.
The IDG News Service is a Network World affiliate.
| Use this form to start a public discussion with other Linux World users on this article. Log In | Register for an account (Why you should) |
Note: Register to have your user name appear; otherwise your comment will show up as "Anonymous."
*Anonymous comments will only appear once they are approved by the moderator.
• Dell puts Linux and Atom in Vostro PCs
• Mozilla names best Firefox 3 add-ons
• Torvalds: Fed up with the 'security circus'
• Dell Latitude ON - big win for Linux
• Open source advocates hail appeals court ruling
LinuxWorld Conference and Expo San Francisco, August 4-7, 2008.
Linux Plumbers Conference Portland, OR, Sept. 16-19, 2008.
FreedomHEC Santa Monica, November 8-9, 2008.