Attack code out for old Firefox bug

If you haven't updated your Firefox or Mozilla Web browser lately, now might be a good time to do so.

Computer code that demonstrates how a known flaw in an older version of the browsers can be exploited in a potentially crippling attack was published on the Web over the weekend. The vulnerability was fixed in Firefox 1.0.5, released in July, and in Mozilla Suite 1.7.9, according to Mozilla.

The code was published by Aviv Raff, a developer in Israel. "I think it's been enough time for people to upgrade from v1.0.4 of Firefox," he wrote on his blog Sunday. Raff's code doesn't do much harm, but he notes that it would be easy to turn it into malicious code that commandeers a vulnerable system.

The vulnerability is in the way the Web browsers handle JavaScript, according to a Mozilla alert dated July 12, the day Firefox 1.0.5 was released. An attacker could craft a malicious Web site that, when accessed by a vulnerable PC, could let a attacker run code on that system without the owner realizing it.

Mozilla has released several updates to both Firefox and the Mozilla Suite since July. The latest version of Firefox is 1.5, released late last month. A security vulnerability that could cause the browser to appear to hang has already been pinpointed in that version, but Mozilla says it is a minor problem.

In other browser news, Microsoft on Tuesday released a patch that fixes four vulnerabilities in Internet Explorer. The software maker deems two of the flaws "critical." One is already being used to attack IE users, Microsoft said in a bulletin.

Secunia is warning of a security flaw in version 8.01 of the Opera Web browsers. Earlier versions may also be affected, the security monitoring company said in an alert Tuesday. The flaw lies in the way the browser handles mouse clicks in new windows and in how it displays a dialog box for downloads, according to Secunia's advisory.

The Opera flaw could be exploited to trick people into downloading malicious programs, Secunia said. The company advised people to upgrade to Opera 8.0.2, which has been available since late July. Several other releases have since followed.

[SqlserverCode]

Most Firefox users

Most Firefox users are a little smarter than IE users and should have updated their version of Firefox unless....it has been installed by the geeky grandson etc etc. I just hope he came by again and patched/updated to the latest version

http://otherthingsnow.blogspot.com

[John.Q.Public]

or installed by corporations

Our company "standardized" on v.093 of Mozilla. Finally this year they upgraded to v1.5 of Mozilla. Yes there are 30,000 pc's to update via an automatic push process, but they like to be one version behind so all the bugs are known. They are now looking at going to Firefox v1.5 in 2006.

[The user with no name]

Most Firefox Users

Would make a comment such as yours to discount the FACT that even FIREFOX has security issues. Furthermore these 'issues' will only become more apparent, and numerous, if more people switch to it.

So looks like the Holy Grail of Anti-MS browsers continues to reveal it's faults, and the "geeky grandson" continues to justify his denial by minimistic statements such as yours.

:-)

Sidenote: I am not against FireFox or Opera or even MS.... only against those who fanatically are. lol