November 27, 2007 5:32 AM PST

Mozilla patches three Firefox security vulnerabilities

Font size
Print
E-mail
Share
9 comments

Mozilla on Monday released Firefox version 2.0.0.10. The update addresses three high-impact security vulnerabilities. Two concern cross-site request forgeries, which can be used to steal personal information while visiting certain sites, and one concerns memory corruption.

The update is being pushed out to all current Firefox users. New users can download the current Firefox release from the Mozilla site (or download the English versions for Windows or Mac from CNET Download.com).

The first cross-site request forgery vulnerability could allow an attacker to generate a fake HTTP referer header by exploiting a timing condition when setting the window location property.

Mozilla says the referer header is supposed to reflect the address of the content that initiated the script. "Instead, the referer was set to the address of the window (or frame) in which the script was running, and this vulnerability arises from that tiny difference." It credits Gregory Fleischer with reporting the issue.

The second cross-site request forgery vulnerability concerns the JAR ZIP format, which enables Web sites to load pages packaged in ZIP archives containing signatures in Java archive format.

According to Mozilla, a Beford.org blogger noted that redirects confused Mozilla browsers about the true source of the JAR content: it was "wrongly considered to originate with the redirecting site rather than the actual source. This meant that an XSS attack could be mounted against any site with an open redirect, even if it didn't allow uploads."

A proof of concept demonstrates how to exploit this vulnerability to steal a user's Gmail contact list. Mozilla credits security researchers Jesse Ruderman and Petko D. Petkov with reporting the issue.

The final update concerns memory corruption, and Mozilla says there are three specific fixes that improve the stability of Firefox. The concern here is that with enough effort, some of these memory crashes could be exploited to run arbitrary code.

As CNET's resident security expert, Robert Vamosi has been interviewed on the BBC, CNN, MSNBC, and other outlets to share his knowledge about the latest online threats and to offer advice on personal and corporate security. Listen to his podcast at securitybites.cnet.com or e-mail Robert with your questions and comments.

Topics:: Security

Tags:: security,; Mozilla,; Firefox,; cross-site request forgeries,; Web 2.0

Share:: Digg; Del.icio.us; Reddit; Facebook; Twitter

About News Blog

Recent posts on technology, trends, and more.

Add this feed to your online news reader

Inside CNET News

Scroll Left Scroll Right

The Wisdom of Clouds
Application packaging for cloud computing: A proposal
Cloud computing promises new ways to build and deploy distributed applications. So why are we so hung up on the old ones?
Gallery
En route to GPS-based air traffic control (images)
Technically Incorrect
AT&T, Luke Wilson try smaller coverage number
In a new Luke Wilson ad, AT&T claims its 3G network covers 230 million people. This contrasts with ads from November that featured total coverage rather than just 3G.
Beyond Binary
Visual Studio launch delayed by 'a few weeks'
Microsoft says it's still working to resolve some performance issues related to the Visual Studio 2010 developer tool suite, which was slated for a March release.
Video
Deep-sea volcanic explosion--part 2 (video)
Digital Media
China arrests thousands in Web porn crackdown
The Chinese government says it arrested more than 5,000 people in 2009 in an effort to crack down on Web porn use, according to Reuters.
Video
Deep-sea volcanic explosion--part 1 (video)
The Social
For eBay sellers, a holiday hamster hangover
The gift frenzy over Zhu Zhu Pets leaves some power sellers feeling like they've just run a marathon--but the steep price tags driven by scarcity lead to some impressive profits.
Cutting Edge
NASA's next frontier: Venus, the moon, or an asteroid
Agency selects three finalists in a competition to help determine where to focus its attention to get the most scientific value out of research into our solar system.
Gallery
NASA trains WISE eye on the sky (photos)
Crave
Robots in 2009: The wackier, the better
No surprise here--some of the silliest and oddest robots of the year gone by were to be found in Japan. But who could top Taiwan's kissing bots?
Green Tech
Green-tech venture investing cools off in 2009
Green tech is still attracting billions of dollars a year, but the amount of money has shrunk significantly as investors began to focus on start-ups with the most potential.