Another Day, Another Firefox Security Fix

 
 
By Steven Vaughan-Nichols  |  Posted 2007-11-27 Email Print this article Print
 
 
 
 
 
 
 

The upgrade to Firefox 2.0.0.10 fixes yet more security problems. (DesktopLinux.com)

Once upon a time, Firefox was known for being far less prone to security bugs than Internet Explorer. Things have changed. On Nov. 27, Mozilla released the newest, security-patched version of the popular Web browser, Firefox 2.0.0.10. The vast majority of Firefox users will have the latest and greatest automatically installed on their systems. This latest update includes fixes for three security bugs.
Perhaps the most important of these fixes is one that prevents an XSS (Cross-Site Scripting) attack. This particular XSS fix prevents the "jar: URI" hazard, which is a mechanism that had been designed to support digitally signed Web pages.
This in turn enabled Web administrators to set up sites that could load pages that had been packaged in .zip archives containing signatures in Java archive format. The problem was that Firefox couldnt identify the true source of the jar: content. Click here to read about the beta of Firefox 3. Heres how it might work in practice. Many Web 2.0 applications allow the upload of jar/.zip files. For example, Web mail clients, collaboration systems and document sharing systems all allow such uploads. You see such popular document formats as OpenWriters .odt (OpenDocument Text) and Microsoft Office 2007 Open XML use the .zip format to space.
Youre probably beginning to see where this goes. All an attacker need do is create a document in one of those formats, change its extension to .zip and, ta-da, instant Trojan horse. Read the full story on DesktopLinux.com: Another Day, Another Firefox Security Fix Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.
 
 
 
 
Steven J. Vaughan-Nichols is editor at large for Ziff Davis Enterprise. Prior to becoming a technology journalist, Vaughan-Nichols worked at NASA and the Department of Defense on numerous major technological projects. Since then, he's focused on covering the technology and business issues that make a real difference to the people in the industry.
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...
 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Thanks for your registration, follow us on our social networks to keep up-to-date
Rocket Fuel