Contact Us Today! (215) 853-2266

Bardissi Enterprises Blog

Bardissi Enterprises has been serving the Hatfield area since 2000, providing IT Support such as technical helpdesk support, computer support, and consulting to small and medium-sized businesses.

Mozilla Stomps Out Ten Security Vulnerabilities with Firefox 2.0.0.13

Severity: Medium

27 March, 2008

Summary:

  • This vulnerability affects: Firefox 2.0.0.x for Windows, Linux, and Macintosh
  • How an attacker exploits it: Multiple vectors of attack, including enticing one of your users to visit a malicious web page
  • Impact: Various results; in the worst case, attacker executes code on your user’s computer, gaining complete control of it
  • What to do: Upgrade to Firefox 2.0.0.13

Severity: Medium

27 March, 2008

Summary:

  • This vulnerability affects: Firefox 2.0.0.x for Windows, Linux, and Macintosh
  • How an attacker exploits it: Multiple vectors of attack, including enticing one of your users to visit a malicious web page
  • Impact: Various results; in the worst case, attacker executes code on your user’s computer, gaining complete control of it
  • What to do: Upgrade to Firefox 2.0.0.13

Exposure:

Yesterday, the Mozilla Foundation released Firefox 2.0.0.13, fixing ten security vulnerabilities (based on CVE-IDs) in the popular web browser. We summarize three of the more critical vulnerabilities below:

  • Memory corruption vulnerabilities (2008-015). Firefox suffers from several unspecified crash bugs, which corrupt memory. Mozilla presumes that, with enough effort, some of these memory corruption flaws could be exploited to run arbitrary code. To exploit these flaws, an attacker would first have to trick one of your users into visiting a maliciously crafted web page. If your user took the bait, the attacker could execute code on that user’s machine, with that user’s privileges. And if the user happened to be a local administrator or had root privileges, the attacker would gain total control of the victim’s computer.
    Mozilla Impact rating: Critical
  • JavaScript privilege elevation and code execution vulnerabilities (2008-014). Firefox suffers from various vulnerabilities involving the way it handles specially crafted JavaScript. By enticing one of your users to a web page containing malicious JavaScript, an attacker could exploit these flaws to elevate privileges, execute a Cross-Site Scripting (XSS) attack, or even execute code on your user’s machine, with your user’s privileges. Depending on your user’s level of privilege, an attacker could exploit this flaw to gain complete control of the user’s computer.
    Mozilla Impact rating: Critical
  • Java socket connection vulnerability (2008-018). Mozilla’s alert describes a security vulnerability that Sun has recently fixed. By enticing one of your users to a malicious web site containing specially crafted Java code, an attacker could exploit this JRE vulnerability to gain direct access to ports on your computer. Even if your firewall blocks access to those particular ports, the malicious web site’s code — which would travel over port 80 — could locally access any port on your user’s computer, bypassing your firewall policies. If you’ve already applied the JRE update we mentioned in our previous JRE alert, this vulnerability won’t affect you; for those who haven’t installed the JRE update yet, Mozilla’s update patches this flaw on Firefox’s side.
    Mozilla Impact rating: High

The remaining vulnerabilities include popup spoofing, information disclosure, and Cross-Site Request Forgery (CSRF) flaws. If you’d like to know more about them, check out Firefox’s known issues page. However, the vulnerabilities described above should be enough to convince you to upgrade your Firefox users to the fixed version at your earliest convenience.

Solution Path:

Mozilla has updated Firefox, correcting these security vulnerabilities. If you use Firefox in your network, we recommend that you download and deploy version 2.0.0.13 as soon as possible. Mozilla no longer supports the 1.5.x branch of Firefox; we recommend that 1.5.x users migrate to 2.0.0.13 now.

Note: The latest versions of Firefox 2.0 automatically inform you when a Firefox update is available. We highly recommend you keep this feature enabled so that Firefox receives its updates as soon as Mozilla releases them. To verify that you have Firefox configured to automatically check for updates, click Tools => Options => Advanced tab => Update tab. Make sure that “Firefox” is checked under “Automatically check for updates.” In this menu, you can configure Firefox to always download and install any update, or only to inform the user that the update exists.

For All WatchGuard Users:

Some of these attacks arrive as normal-looking HTTP traffic, which you must allow through your firewall if your network users need to access the World Wide Web. Therefore, the patches above are your best solution.

Status:

The Mozilla Foundation has released Firefox 2.0.0.13, fixing these security issues.

References:

 

Comments

No comments made yet. Be the first to submit a comment
Already Registered? Login Here
Guest
Friday, 29 March 2024
If you'd like to register, please fill in the username, password and name fields.

Captcha Image

Mobile? Grab this Article!

QR-Code dieser Seite

Blog Archive

Recent Comments

Tip of the Week: Which Headphones are Right for Your Needs?
23 April 2018
I will recommend Plantronics Backbeat Pro 2 SE Noise cancelling Headset with it's Great features.
Gamification: Make Business Fun for Everyone
27 January 2017
The world is based on the games. There are many types of games as per the aussie essay writing servi...
Let's Talk Tablets
12 January 2017
The concept of tablet is far better than that of PC because you can bring them with you everywhere a...
Tip of the Week: Tweak Your Workday in These 4 Ways and See Major Results
12 January 2017
The only thing will I will say regarding this blog is that it is very helpful at least for me. As I ...
WatchGuard Releases Version 10.2.7 for WSM, Edge, Fireware, and Fireware Pro
23 December 2016
I really needed to know about the fireware but i was confused that where can i find information abou...