Slashdot Mirror
2 Firefox Security Flaws Lead to Exploit Potential
Marthisdil points out a News.com story which reports that "Two vulnerabilities in the popular Firefox browser have been rated "extremely critical" because exploit code is now available to take advantage of them." Security firm Secunia reported the vulnerabilities (and the "extremely critical" rating is theirs), but the News.com story points out that thus far, "no known cases have yet emerged where an attacker took advantage of the public exploit code." Update: 05/09 20:20 GMT by T : Rebron of the Mozilla Foundation sends a correction; this is really the same flaw reported yesterday. He suggests that you glance at the Mozilla security alert on this hole (as well other alerts at the Mozilla Security Center), and says "The Mozilla Foundation has made changes to our update servers that will protect users from this arbitrary code execution exploit."
i dont mean to be trolling/flaimbait, but please
:/
mod me accordingly if i am.
do we really need to see it posted here, every time
a firefox sploit is found?
gettin me all excited for nothing
Exploits rise with popularity. Watch out desktop linux.
Seriously this Is getting repetitive. There are always flaws. Just update your browser and hope it doesn't become the next iexplore.
Come on, timothy. This is hardly the time to be downplaying the severity, even though we all like Firefox. There are undoubtedly people using the posted code, and they wouldn't be likely to tell News.com about it. Everyone should upgrade immediately.
Mozilla and Firefox have been recommended as alternatives to IE for security reasons. Yet, lately, it seems that there's quite a lot of security problems being uncovered in Firefox. So I'm trying to figure out how to read this.
I suspect that Firefox is somewhat more secure on the simple basis that it is not as tightly integrated with the rest of the operating system as IE is. What makes IE exploits so nasty is that they tend to become email and other exploits too.
My concern is that if Firefox gains some more ground and does become a more active target for exploits, that it may become a poster child Microsoft can use to point out that open source software's "many eyes" theory is hogwash. Maybe it is hogwash.
This sig has been temporarily disconnected or is no longer in service
What Firefox (and the rest of the suite) is a good way to upgrade the software, without installing everything as a new user would... This is something they really should fix...
It's up to MoFo to fix their software as soon as vulnerabilities are reported now. The play time is over, from now on it's going to be Browser Wars II: The Security Menace.
Bored? Browse Slashdot with a +6 modifier for Troll comme
"no known cases have yet emerged where an attacker took advantage of the public exploit code."
I appreciate this clarification. And I'm sure such a clarification will be included in the next IE bug report posted on Slashdot... Right?
PDHoss
======================================
Writers get in shape by pumping irony.
So combine this with a poisoned DNS attack. update.mozilla.org resolves as your malware server, then you use this exploit.
Sure, it makes it a little harder to execute then, say, something like Nimda that could run free across the internet, but it's still a valid security issue.
"no known cases have yet emerged where an attacker took advantage of the public exploit code."
Interesting. I have to wonder if because so many people want to see Firefox take off, they have a tendancy to leave the explots alone. After all, the people who take advantage of the exploits are more-than-likely techie people and know that if Firefox had bad press about exploits, and people taking advantage of them, Firefox would take a nose dive. Eh.. just a thought.
There is nothing in FireFox's architecture which makes it a more secure alternative to IE
except that IE is tied very tightly (I was going to say "securely," but really, it's not that secure) into Windows, whereas Firefox is not. The more levels of separation you can have between the app and the OS, the better.
the benefit of using Firefox also has to do with response times - the Moz. Foundation has been extremely quick to patch holes once detected, while critical holes in IE, if history is our guide, stay open way longer than they should.
IMHO, much of this has to do with Mozilla being far more invested in the well-being of Firefox than Microsoft is in the well-being of IE. Think about it - how many products does Microsoft have to maintain, versus the Mozilla Foundation? To Mozilla, the well-being of Firefox is not just a minor detail to contend with; it's much much bigger, so gets all the swifter attention.
-matt
Think about it - how many products does Microsoft have to maintain, versus the Mozilla Foundation?
Don't you think this is a bit of a skewed statement? MS has departments, many of them. There is probably an IE department and it's sole purpose is IE. It may not have any conversations with any other departments with the exception of "Will IE still work with the rest of Windows? It does? Great, going back to my cave."
I mod down so you can mod up. Your welcome.
Linux already supports automatic updates. No sense putting it at the application layer. In fact I'd go as far as to say that the application layer is the worst place for updates.
MS has departments, many of them. There is probably an IE department and it's sole purpose is IE. It may not have any conversations with any other departments with the exception of "Will IE still work with the rest of Windows? It does? Great, going back to my cave."
you raise a good point. MS does certainly have many more employees than the Mozilla Foundation. However, something else you said, namely the part about separate departments not communicating with each other (much), that is more salient. And also a good point, btw.
Because MS ties into Windows via ActiveX, etc., the IE team needs to be aware of what the ActiveX team is doing, and what every other team that IE touches is doing, and vice versa. There HAS to be that kind of communication, really really good communication, for things to work the way they should (e.g., without opening security holes).
so, while MS may be bigger and have many more employees to deal with issues, they have that many more employees to create the issues in the first place (too many cooks in the kitchen?), and a much larger world in which those bugs can reside and hide.
simplicity is beautiful. if I want a hammer, I'll buy one that pounds nails into wood better than any other hammer I can find. I don't need it to julienne fries and wake me up at 6:00 in the morning as well.
-matt
A serious exploit flaw has been found. So severe is the flaw that it spans all hardware and all software. It matters not if your computer is patched or unpatched. This exploit flaw is so serious that any computer that emits power from its power supply is vulnerable. The only security fix to this devastating exploit flaw involves pulling the power plug from the computer.
......Seriously though, there has always been a direct correlation between usability and security. Any time features are added to a piece of software to make it more usable, will make it more vulnerable and open to flaws that can be exploited. Firefox may have started out as a stripped down, no nonsense browser, but with its popularity rising, feature creep sets in and inherent flaws will be discovered and exploited.
The only way to make it 100% secure is to make sure nothing can be done to the system, and that's powered off with no automated way of powering on (i.e. it's unplugged). Once we accept that it MUST be plugged in to be usable, we need to accept the possibility of exploits. Given that, however, we can't accept defeatism, and must strive to fix it.
The typical rhetoric of "There see? product y is just as insecure as product x", and "Well at least the exploit count is 2, not 50!", only serves to distract us from the real goal of getting better and MORE secure software. Like the saying goes, "SHIT HAPPENS". Let's just learn from it and move on.
Security through obscurity is theoretically plausible, but not very practical. What may be firefox's saving grace is that it's open source and is not held as proprietary IP, controlled by a corporation out for profit, thus the evolution of the product is driven by its need to simply be better.
Perhaps microsoft will see these flaws as proof that open source doesn't work and will lower their own standards, making IE7 less secure or shipping earlier with less stability, or maybe they will take this opportunity to make IE7 that much better in the hopes of regaining popularity and claiming vindication. As long as firefox advances and closes those holes, we still have one extra viable choice. This would only result in a fundamentally more secure web surfing experience.
I'm surprised (or maybe I missed something). Why is noone asking the real questions here?
Sure, Firefox had two security flaws. Okay. HOW were those vulnerabilites found? Were they found because Firefox is an open-source program, and has the 'many eyes' advantage? Were the people who found them going through the code, evaluating and auditing it function-by-function is search of flaws?
Or were they testing against it in the traditional way, the way IE vulnerabilities were found? Or maybe a combination of the two?
The article doesn't say, but I believe this is more important to know than the current count on a Firefox/IE vulnerability pissing match. It's the best example (or counter-example) of open-source security in action that we have. If anyone can supply this information, I (and others, perhaps) will be most grateful.
Can you imagine what would happen if bugs in proprietary software (I'm thinking of Windows or IE) were considered "extremely critical" as soon as an exploit was solidified in code? I mean, if "extremely critical" corresponds to "it is *possible* to exploit this bug" then what is the term to describe a bug which in fact is wreaking havoc on worldwide information infrastructure (as many Windows bugs)?
Cause and effect: They don't get viruses because they don't get laid.