Firefox update postponed by newest bug
Mozilla is still testing a fix for a flaw made public last week
Computerworld - Mozilla Corp. will delay the next security update for Firefox so it can test a fix for a flaw that could be used by attackers by skirt security restrictions.
The flaw, disclosed Feb. 14 by Polish researcher Michal Zalewski on the Full-Disclosure security mailing list, could let a malicious site manipulate the authentication cookies for other sites' pages. It is present in the most recent version of the open-source browser, 184.108.40.206.
According to Zalewski, the bug might allow hackers to "tamper with the way these [third-party] sites are displayed or how they work."
Mozilla developers jumped on the bug and produced a fix by the next day. However, adding the patch to the Firefox 220.127.116.11 and 18.104.22.168 updates, which are still under development, will require more work. "We had to respin for [the patch] and now have Firefox 22.214.171.124 rc4 and 126.96.36.199 rc2 builds," wrote Firefox developer Jay Patel on the Mozilla.dev.planning forum. "We are [now] shooting for a target ship date of Thursday 2/22."
Mozilla had earlier pegged Feb. 21 as its target release date.
The vulnerability was rated as "moderately critical" by Danish bug tracker Secunia. Symantec's DeepSight threat network rated it 7.1 out of a possible 10. For his part, Zalewski posted a demonstration of the flaw online.
Yesterday, Zalewski made note of a new Firefox bug that could give cybercriminals a leg up when running phishing attacks. Firefox can be forced to spawn a window with blank address bar with the Reload button disabled, Zalewski said. "This can be used to evoke a false sense of security or authority in casual users," he wrote in his warning. Hackers would have to dupe users into visiting a malicious site to pull this off this kind of attack, however.
Mozilla, security vendors and even Zalewski ranked this more recent flaw as minor; Mozilla has not yet patched the problem, and it's unclear whether it will be fixed in the 188.8.131.52 and 184.108.40.206 updates.
Mozilla also said that the week's Firefox updates would include Windows Vista-related changes, including one that allows Vista users to update the browser without having to download and reinstall the entire browser.
Read more about Security in Computerworld's Security Topic Center.
- EndPoint Interactive eGuide In this eGuide, Network World, Computerworld, and CIO examine two endpoint trends - BYOD and collaboration - and offer tips and advice on...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- Cybersecurity Imperatives: Reinvent your Network Security The Rise of CyberSecurity
- Surescripts Case Study- Securing Keys and Certificates Surescripts implemented Venafi's Trust Protection Platform™ to secure digital keys and certificates, ensure the privacy and confidentiality of electronic clinical information for its...
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities.
- Deep Dive into Advanced Networking and Security with Hybrid Cloud Security and networking are among the top concerns when moving workloads to the cloud. VMware vCloud® Hybrid Service™ enables you to extend your... All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!