mozilla/firefox security flaws.

kronas · 07-01-2005, 18:52

mozilla and firefox users can now join microsoft IE users in securing their browsers for new vulnerabilities found in the two 'secure' browsers.

information:

http://secunia.com/advisories/13599

a slew of infomration can be found:

http://www.internetnews.com/security...le.php/3456161

Paul K · 07-01-2005, 20:21

Saw that this afternoon but refrained from posting it in case someone thought I was Mozilla bashing

No doubt they will patch it sometime soon though.. unless they want to take the "at least Mozilla are fast to react and fix flaws" argument away from their users

nffc · 07-01-2005, 21:14

Hardly a serious issue, you don't download something unless you've asked for it, it's common sense - and anyway, it's relatively low-risk...

kronas · 08-01-2005, 02:03

A security flaw in the increasingly popular Firefox browser is exposing millions of users to phishing scams, security experts have warned.
Jakob Balle, security specialist at Secunia Research, said that the vulnerability in Firefox and Mozilla allows malicious hackers to execute phishing scams by spoofing the source URL displayed in the browser's Download Dialog box.
"The problem is that long sub-domains and paths are not displayed correctly, which can be exploited to obfuscate what is being displayed in the source field of the Download Dialog box," he said.
A Secunia Research advisory stated that the "less critical" vulnerability has been confirmed in Mozilla 1.7.3 for Linux, Mozilla 1.7.5 for Windows, and Mozilla Firefox 1.0. It added that "other versions may also be affected".
"Currently, no solution is available. However, the vendor reports that this vulnerability will be fixed in upcoming versions of the affected products," Secunia stated.
Balle urged users not to follow download links from untrusted sources.

Toto · 08-01-2005, 08:53

It's a bug yes, but many Firefox users are more security Savy, so I think that whilst millions are exposed to Phishing scams using Mozilla/Firefox, only a tiny amount of folks would be duped, IMHO.

I'm not going back to OE, no way pedro

Zest · 08-01-2005, 11:39

I don't see the problem of going back to IE. They're both the same browsers more or less, only IE actually loads pages when you want it to.

bopdude · 08-01-2005, 11:46

but just found this [img]Download Failed (1)[/img] for all you IE haters

ikthius · 08-01-2005, 16:15

Quote:

Originally Posted by Zest

I don't see the problem of going back to IE. They're both the same browsers more or less, only IE actually loads pages when you want it to.

but it does not have tabbed browsing, well not my version of IE6 anyway......

ik

I'll stick to firefox, it is one flaw so far, how many had IE had?

MadGamer · 08-01-2005, 16:59

Quote:

Originally Posted by bopdude

but just found this [img]Download Failed (1)[/img] for all you IE haters

Gareth · 08-01-2005, 21:54

Quote:

Originally Posted by Zest

I don't see the problem of going back to IE. They're both the same browsers more or less, only IE actually loads pages when you want it to.

erm, if you mean that they both display web pages for end users to view, then yeah I guess you could say that 'they're both the same browsers more or less'. However, in reality, they're 2 different beasts - they just perform the same function.

To me, the main differences are...

Firstly, Firefox is open source so you're free to inspect the code to understand what it's doing and how it does the things it does. From a security perspective, this is enough of a reason to use it! As US-CERT have stated:

Quote:

There are a number of significant vulnerabilities in technologies relating to the IE domain/zone security model, local file system (Local Machine Zone) trust, the Dynamic HTML (DHTML) document object model (in particular, proprietary DHTML features), the HTML Help system, MIME type determination, the graphical user interface (GUI), and ActiveX... IE is integrated into Windows to such an extent that vulnerabilities in IE frequently provide an attacker significant access to the operating system.

It is possible to reduce exposure to these vulnerabilities by using a different web browser, especially when viewing untrusted HTML documents (e.g., web sites, HTML email messages).

Admittedly, Firefox has security issues too. The link in the original post confirms this. However, they are, imo, less critical than those frequently found in IE.... so far.

Firefox is also a much smaller footprint than IE, yet has just as many features... if not more. For example, it has tabbed browsing and a very good pop-up blocker installed by default. The search bar is integrated into the browser, although the browser itself is not restricted to just one particular search engine. It has some excellent themes and extensions - ForecastFox, ChatZilla, Smiley Xtra, etc... And it also has RSS integration by default to allow you to read the latest headlines or updates to your favourite sites.

Richard M · 08-01-2005, 23:29

It'll be fixed within a week.

poolking · 08-01-2005, 23:38

Quote:

Originally Posted by bopdude

but just found this

for all you IE haters

Like the smilie.

Toto · 09-01-2005, 14:45

Wow, here's an argument for Firefox, FireFTP, what a cracking little FTP program you can bolt onto Firefox, AND it can be opened in a tab window

nffc · 09-01-2005, 14:57

Quote:

Originally Posted by Toto

Wow, here's an argument for Firefox, FireFTP, what a cracking little FTP program you can bolt onto Firefox, AND it can be opened in a tab window

Have to admit that is w00t.

georgepomone · 09-01-2005, 16:58

Hi All,
I see mentioned over and over again about wanting tabbed browsing for IE. Just download Avant and it will give you all you want. I've used it since it came out and have had no trouble with it. It uses the IE engine and gives it the extras you want. I've seen it mentioned by Microsoft so they don't get worked up about it. Looking at it there is no need for any new version of IE because Avant is just like that.
George.