Firefox update postponed by newest bug
Mozilla is still testing a fix for a flaw made public last week
Computerworld - Mozilla Corp. will delay the next security update for Firefox so it can test a fix for a flaw that could be used by attackers by skirt security restrictions.
The flaw, disclosed Feb. 14 by Polish researcher Michal Zalewski on the Full-Disclosure security mailing list, could let a malicious site manipulate the authentication cookies for other sites' pages. It is present in the most recent version of the open-source browser, 220.127.116.11.
According to Zalewski, the bug might allow hackers to "tamper with the way these [third-party] sites are displayed or how they work."
Mozilla developers jumped on the bug and produced a fix by the next day. However, adding the patch to the Firefox 18.104.22.168 and 22.214.171.124 updates, which are still under development, will require more work. "We had to respin for [the patch] and now have Firefox 126.96.36.199 rc4 and 188.8.131.52 rc2 builds," wrote Firefox developer Jay Patel on the Mozilla.dev.planning forum. "We are [now] shooting for a target ship date of Thursday 2/22."
Mozilla had earlier pegged Feb. 21 as its target release date.
The vulnerability was rated as "moderately critical" by Danish bug tracker Secunia. Symantec's DeepSight threat network rated it 7.1 out of a possible 10. For his part, Zalewski posted a demonstration of the flaw online.
Yesterday, Zalewski made note of a new Firefox bug that could give cybercriminals a leg up when running phishing attacks. Firefox can be forced to spawn a window with blank address bar with the Reload button disabled, Zalewski said. "This can be used to evoke a false sense of security or authority in casual users," he wrote in his warning. Hackers would have to dupe users into visiting a malicious site to pull this off this kind of attack, however.
Mozilla, security vendors and even Zalewski ranked this more recent flaw as minor; Mozilla has not yet patched the problem, and it's unclear whether it will be fixed in the 184.108.40.206 and 220.127.116.11 updates.
Mozilla also said that the week's Firefox updates would include Windows Vista-related changes, including one that allows Vista users to update the browser without having to download and reinstall the entire browser.
Read more about Security in Computerworld's Security Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts