Another day, another Firefox security fix

Keywords: Match:

Nov. 27, 2007

Once upon a time, Firefox was known for being far less prone to security bugs than Internet Explorer. Things have changed. On Nov. 27, Mozilla released the newest, security-patched version of the popular Web browser, Firefox 2.0.0.10.

The vast majority of Firefox users will have the latest and greatest automatically installed on their systems. This latest update includes fixes for three security bugs.

Perhaps the most important of these fixes is one that prevents an XSS (Cross-Site Scripting) attack. This particular XSS fix prevents the "jar: URI" hazard, which is a mechanism that had been designed to support digitally signed Web pages. This in turn enabled Web administrators to set up sites that could load pages that had been packaged in .zip archives containing signatures in Java archive format.

The problem was that Firefox couldn't identify the true source of the jar: content. Here's how it might work in practice. Many Web 2.0 applications allow the upload of jar/.zip files. For example, Web mail clients, collaboration systems and document sharing systems all allow such uploads. You see such popular document formats as OpenWriter's .odt (OpenDocument Text) and Microsoft Office 2007 Open XML use the .zip format to space.

You're probably beginning to see where this goes. All an attacker need do is create a document in one of those formats, change its extension to .zip and, ta-da, instant Trojan horse. The attacker can then change the extension of the .zip file to an innocent-looking .odt or .doc. When the file is next opened, it can present an unsuspecting user with a malicious page with a client- or server-side that will evade most security filters.

In short, it's a nasty flaw. It's also been around for nine months. Fortunately, while proof-of-concept programs exist, the flaw does not appear to have been exploited on the Web.

Firefox 2.0.0.10 also contains stability fixes for three bugs. When Firefox crashed because of any of these bugs, the crashes sometimes left corrupted memory behind. If a cracker could find a way to predictably make Firefox crash due to one of these flaws, he could conceivably exploit the corrupt memory to run his own attack code on your system.

Last, but not least, CSRFs are potentially every bit as dangerous. Many major sites are exploitable by CSRF attacks. In real life, a CSRF attack could be used to send fake instructions to a Web site you trust. So, for example, when you click on a site to pay a bill, the attack might use this opportunity to tell your banking site that you want to pay your attacker instead.

That would be a silly attack, since it would be easy to trace, but the potential for serious abuse is clearly there. With this new fix, however, Firefox will no longer be vulnerable to CSRF shenanigans.

-- Steven J. Vaughan-Nichols

Do you have comments on this story?

Talkback here
NOTE: Please post your comments regarding our articles using the above link. Be sure to use this article's title as the "Subject" in your posts. Before you create a new thread, please check to see if a discussion thread is already running on the article you plan to comment on. Thanks!

Related Stories:

(Click here for further information)

7 Advantages of D2D Backup
For decades, tape has been the backup medium of choice. But, now, disk-to-disk (D2D) backup is gaining in favor. Learn why you should make the move in this whitepaper.

4 Legal Reasons to Control Internet Access
The Internet is obviously a valuable resource for many organizations. However, many are exposed to legal liability concerns because they fail to control Internet access. Learn if you're safe in this white paper.

Rapidly Resolve J2EE Application Problems
Whether you are in the process of building J2EE applications or have J2EE applications already running in production, you must ensure that they deliver the expected ROI. Learn how in this white paper.

Load Testing 2.0 for Web 2.0
There are many unknowns in stress testing Web 2.0 applications. Find out how to test the performance of Web 2.0 in this white paper.

Build Better Games Online
For the game infrastructure providers, life is complex. Making money from games has become more complicated. Why? Find out in this white paper.

Building a Virtual Infrastructure from Servers to Storage
This white paper discusses the virtual storage solutions that reduce cost, increase storage utilization, and address the challenges of backing up and restoring Server environments.

Gaining Faster Wireless Connections with WiMAX
Welcome to what is quickly becoming the hyperconnected world where anything that would benefit from being connected to the network will be connected. Learn more in this white paper.

Is Your Desktop a Security Threat?
The new wave of sophisticated crimeware not only targets specific companies, but also targets desktops and laptops as backdoor entryways into those business’ operations and resources. Learn how to stay safe in this white paper.

Increasing SAN Reliability by 100 Percent
Storage area networks (SAN) are a strong part of storage plans. Learn how to increase your reliability and uptime by 100 percent in this case study.

Got a HOT tip? please tell us!

ADVERTISEMENT
(Advertise here)

Desktop Linux books Join our Desktop Linux discussion forums: • Moving to Linux • Linux/Windows debate! • Linux Q&A . . . and more Linux vs. Windows • in the enterprise • in gadgets & devices	Most popular recent stories: • A Vista vs. Linux matchup • Choosing a desktop Linux distro • Linus versus GNOME • Why Windows wins and Linux loses • The best free desktop Linux • Why Windows Vista will suck • 2006 Desktop Linux year in review • The well-tempered Debian desktop • Here come the Dell Linux desktops, laptops • Seven Linux distros fight over one old ThinkPad • Putting openSUSE 10.2 through its paces • Results from the 2006 Desktop Linux Survey

BREAKING NEWS

• Graphics board vendor touts faster Linux drivers
• Private St. Louis school goes Linux
• Xandros quietly acquires Linspire
• Microsoft pushes India toward Linux
• "Intrepid Ibex" plucks up courage for alpha release
• Military-grade USB key supports Linux desktops
• CentOS 5.2 ships with enhanced virtualization
• Ubuntu "MID Edition" ships
• Gutsy Geeks take Linux to the airwaves
• OpenSUSE 11.0 arrives
• Opera 9.5 gets mad at malware
• Sample chapter available for revised Ubuntu book
• Linux jukebox app achieves first stable release
• OpenSUSE forums merge
• Desktop Linux platforms debut at Computex

Linux-Watch headlines:
• Microsoft tactics push India toward Linux
• Bell, SuperMicro sued over GPL
• "Business intelligence" software goes GPL
• Will Atom bomb?
• LF Summit videos posted
• Linux gains "embedded" maintainers
• Virtualization on tap in SLES and RHEL upgrades
• Linux gets security black eye
• Verizon chooses Linux "platform of choice"
• Hats off to Fedora 9

Visit the...

news feed

Home \| News \| Articles \| Forum \| Polls \| About \| Contact

	Ziff Davis Enterprise Home \| Contact Us \| Advertise \| Link to Us \| Reprints \| Magazine Subscriptions \| Newsletters Tech RSS Feeds \| White Papers \| ROI Calculators \| Tech Podcasts \| Tech Video \| VARs \| Channel News
	Baseline \| Careers \| Channel Insider \| CIO Insight \| DesktopLinux \| DeviceForge \| DevSource \| eSeminars \| eWEEK \| Enterprise Network Security \| LinuxDevices \| Linux Watch \| Microsoft Watch \| Mid-market \| Networking \| PDF Zone \| Publish \| Security IT Hub \| Strategic Partner \| Web Buyer's Guide \| Windows for Devices
	Developer Shed \| Dev Shed \| ASP Free \| Dev Articles \| Dev Hardware \| SEO Chat \| Tutorialized \| Scripts \| Code Walkers \| Web Hosters \| Dev Mechanic \| Dev Archives \| igrep
Use of this site is governed by our Terms of Service and Privacy Policy. Except where otherwise specified, the contents of this site are copyright © 1999-2008 Ziff Davis Enterprise Holdings Inc. All Rights Reserved. Reproduction in whole or in part in any form or medium without express written permission of Ziff Davis Enterprise is prohibited. Linux is a registered trademark of Linus Torvalds. All other marks are the property of their respective owners.

Home \| News \| Articles \| Forum \| Polls \| About \| Contact

	Ziff Davis Enterprise Home \| Contact Us \| Advertise \| Link to Us \| Reprints \| Magazine Subscriptions \| Newsletters Tech RSS Feeds \| White Papers \| ROI Calculators \| Tech Podcasts \| Tech Video \| VARs \| Channel News
	Baseline \| Careers \| Channel Insider \| CIO Insight \| DesktopLinux \| DeviceForge \| DevSource \| eSeminars \| eWEEK \| Enterprise Network Security \| LinuxDevices \| Linux Watch \| Microsoft Watch \| Mid-market \| Networking \| PDF Zone \| Publish \| Security IT Hub \| Strategic Partner \| Web Buyer's Guide \| Windows for Devices
	Developer Shed \| Dev Shed \| ASP Free \| Dev Articles \| Dev Hardware \| SEO Chat \| Tutorialized \| Scripts \| Code Walkers \| Web Hosters \| Dev Mechanic \| Dev Archives \| igrep
Use of this site is governed by our Terms of Service and Privacy Policy. Except where otherwise specified, the contents of this site are copyright © 1999-2008 Ziff Davis Enterprise Holdings Inc. All Rights Reserved. Reproduction in whole or in part in any form or medium without express written permission of Ziff Davis Enterprise is prohibited. Linux is a registered trademark of Linus Torvalds. All other marks are the property of their respective owners.