The Mozilla Foundation has shipped release candidates for a new version of its Firefox Web browser to provide a thorough fix for a known code execution security vulnerability.
The Firefox 1.0.7 makeover comes just one week after a private security researcher posted a proof-of-concept demonstration of a buffer overflow affecting users of the open-source browser.
Volunteers are putting the finishing touches to quality assurance testing, and the update is expected to ship within the next two days, a Mozilla official told Ziff Davis Internet News.
The nonprofit Mozilla Foundation had earlier posted a temporary patch and workaround for the bug, which could be exploited by a remote attacker to execute arbitrary code on an affected host.
The flaw, which carries a “highly critical” rating from security alerts aggregator Secunia Inc., is due to a buffer overflow error in the “NormalizeIDN” function when handling specially crafted URLs embedded in HREF tags.
A malicious hacker could “take complete control of an affected system” via specially crafted Web pages.
However, even as Mozilla scrambled to roll out a comprehensive fix, the researcher who originally discovered the flaw has posted a new advisory to warn that the foundations temporary fix does not provide adequate protection.
Tom Ferris, who runs the Security-Protocols.com protocol, said a new variation of the vulnerability affects Firefox 1.5 Beta 1 (Deer Park Alpha 2) build 1.8b4 with IDN disabled.
“Firefox 1.0.6 and all prior versions are not affected by this particular variant,” Ferris warned, noting that “the workaround which was provided from Mozilla does not mitigate this issue.”
Despite the negative publicity generated by the Firefox security hiccups, statistics released by a Web measurement company show that usage of the upstart browser is one the rise again after a brief slowdown in recent months.
Aliso Viejo, Calif.-based Net Applications said Firefox usage jumped up a quarter point in August 2005 to reach 8.27 percent.
America Online Inc.s Netscape and Apple Computer Inc.s Safari also enjoyed gains in overall usage to chip away at Microsoft Corp.s dominant Internet Explorer browser.
“In August 2005, Microsofts Internet Explorer continued its slow, yet steady decline in browser usage market share. IE enjoyed 92.31 percent market share in October of 2004, but is currently at 86.31 percent,” Net Applications said in a statement.
“Firefox attempted to regain its momentum with a modest increase in share from the previous month, and Safari maintained its slow, yet steady gains, improving to 2.20 percent,” the company added.
Separately, Mozilla released Camino 1.0 alpha 1, a browser upgrade that features improvements to speed, ad blocking and preferences.
Camino is a Mac OS X Web browser based on Mozilla, but it does not include Mozillas e-mail or composer components.
Camino 1.0 Alpha 1, which can be downloaded here, shares the same code base with Firefox 1.5, so it shares many of the security fixes and Gecko improvements that are in that version of Firefox, the Foundation said.
Due to changes in the feature set, Camino no longer supports Mac OS X 10.1.
Users of the Mac OS X 10.1 are advised to stay with Camino 0.8.4.
