Mozilla Updates Security for Firefox, SeaMonkey

 
 
By Chris Preimesberger  |  Posted 2007-03-21 Email Print this article Print
 
 
 
 
 
 
 

The updated browser and Internet application suite eliminate a minor port-scanning vulnerability.

Mozilla on March 20 released new security and stability updates for both versions of its Firefox browser and for its Internet application suite, SeaMonkey. The new updates eradicate a minor FTP PASV port-scanning vulnerability, a Mozilla spokesperson said. A malicious Web page hosted on a specially coded FTP server could exploit this weakness to perform a rudimentary port-scan of machines inside the firewall of the victim.
By itself this causes no harm, but information about an internal network may be useful to an attacker should there be other vulnerabilities present on the network, the spokesperson said.
The FTP protocol includes the PASV (passive) command, which is used by Firefox to request an alternate data port. The specification of the FTP protocol allows the server response to include an alternate server address as well, although this is rarely used in practice. With the update, Mozilla clients will now ignore the alternate server address, the spokesperson said. Read the full story on DesktopLinux.com: Firefox 2.0.0.3 Updates Security, Stability
Check out eWEEK.coms Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEKs Security Watch blog.
 
 
 
 
Chris Preimesberger Chris Preimesberger was named Editor-in-Chief of Features & Analysis at eWEEK in November 2011. Previously he served eWEEK as Senior Writer, covering a range of IT sectors that include data center systems, cloud computing, storage, virtualization, green IT, e-discovery and IT governance. His blog, Storage Station, is considered a go-to information source. Chris won a national Folio Award for magazine writing in November 2011 for a cover story on Salesforce.com and CEO-founder Marc Benioff, and he has served as a judge for the SIIA Codie Awards since 2005. In previous IT journalism, Chris was a founding editor of both IT Manager's Journal and DevX.com and was managing editor of Software Development magazine. His diverse resume also includes: sportswriter for the Los Angeles Daily News, covering NCAA and NBA basketball, television critic for the Palo Alto Times Tribune, and Sports Information Director at Stanford University. He has served as a correspondent for The Associated Press, covering Stanford and NCAA tournament basketball, since 1983. He has covered a number of major events, including the 1984 Democratic National Convention, a Presidential press conference at the White House in 1993, the Emmy Awards (three times), two Rose Bowls, the Fiesta Bowl, several NCAA men's and women's basketball tournaments, a Formula One Grand Prix auto race, a heavyweight boxing championship bout (Ali vs. Spinks, 1978), and the 1985 Super Bowl. A 1975 graduate of Pepperdine University in Malibu, Calif., Chris has won more than a dozen regional and national awards for his work. He and his wife, Rebecca, have four children and reside in Redwood City, Calif.Follow on Twitter: editingwhiz
 
 
 
 
 
 
 

Submit a Comment

Loading Comments...

 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel