Security flaw affects Firefox, Linux users
The Mozilla Foundation released an updated version of Firefox today
TechWorld.com - A serious security flaw surfaced yesterday that affects the Firefox Web browser and Linux but leaves Microsoft's Internet Explorer and Windows unscathed.
The bug is in the Linux shell scripts that Firefox and the Mozilla browser suite use to parse Web addresses supplied via the command line or by external programs such as e-mail clients. Researcher Peter Zelezny discovered that commands included in the URL and enclosed in backticks (') were executed by the Linux or Unix shell.
The flaw doesn't require Web interaction to be effective. If a user with affected versions of Firefox or Mozilla set as the default browser clicks on a maliciously crafted URL in an e-mail program, for example, malicious commands would be executed before the browser was launched.
Security advisory firms Secunia and FrSIRT both gave the flaw their most severe ratings.
The Mozilla Foundation, which develops Firefox and other Mozilla-based software such as the Thunderbird e-mail client, today released a Firefox update -- Version 1.0.7 -- fixing the flaw, as well as a week-old security bug in the handling of international domain names (IDN). The update can be found on the Firefox Web site.
The flaw arrives amid mounting challenges for Firefox, which has gained a significant user base in the past few months, mostly at the expense of Internet Explorer. A report from Symantec Corp. earlier this week revealed that nearly twice as many flaws had been discovered in Firefox as in Explorer over the first six months of this year (see "Symantec report sparks safe-browser debate"). A few days earlier, developers were forced to rush out a patch for a critical hole in Firefox involving IDN parsing.
Linux is also generally seen as a lower-risk platform than Windows, partly because it is less widely used on the desktop and therefore isn't targeted as often. The security picture is changing, though, according to the Symantec report, with platforms like Linux and Mac OS X coming under increasing scrutiny by potential attackers.
Tristan Nitot, president of Mozilla Europe, has said Symantec's figures don't tell the whole story. For one thing, Firefox patches arrive faster than those for Explorer, he said, pointing out that Microsoft won't even issue its monthly patch in September. More flaws are being discovered in Firefox in the short term because of its newfound popularity, but overall, Nitot said, Explorer's flaws are more numerous and more severe.
- 2013 Cyber Risk Report The "Cyber risk report 2013 Executive summary" presents the major findings of HP Security Research's comprehensive dive into today's cyber vulnerability and threat...
- Why You Need a Next-Generation Firewall This white paper explores the reasons for implementing next-generation (NG) firewalls and lays out a path to success for overburdened IT organizations.
- The New Business Case for Video Conferencing: 7 Real-World Benefits Beyond Cost-Savings This whitepaper provides insight into the value of video conferencing in today's business environment, and how organizations are using visual collaboration to find...
- Gartner Magic Quadrant for Client Management Tools The client management tool market is maturing and evolving to adapt to consumerization, desktop virtualization, and an ongoing need to improve efficiency.
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Malware and Vulnerabilities White Papers | Webcasts