Firefox update postponed by newest bug

Mozilla is still testing a fix for a flaw made public last week

Mozilla will delay the next security update for Firefox so it can test a fix for a flaw that could be used by attackers by skirt security restrictions.

The flaw, disclosed Feb. 14 by Polish researcher Michal Zalewski on the Full Disclosure security mailing list, could let a malicious site manipulate the authentication cookies for other sites' pages. It is present in the most recent version of the open-source browser, 2.0.0.1.

According to Zalewski, the bug might allow hackers to "tamper with the way these [third-party] sites are displayed or how they work."

Mozilla developers jumped on the bug and produced a fix by the next day. However, adding the patch to the Firefox 2.0.0.2 and 1.5.0.10 updates, which are still under development, will require more work. "We had to respin for [the patch] and now have Firefox 2.0.0.2 rc4 and 1.5.0.10 rc2 builds," wrote Firefox developer Jay Patel on the Mozilla.dev.planning forum. "We are [now] shooting for a target ship date of Thursday 2/22."

Mozilla had earlier pegged Feb. 21 as its target release date.

The vulnerability was rated as "moderately critical" by Danish bug tracker Secunia. Symantec's DeepSight threat network rated it 7.1 out of a possible 10. For his part, Zalewski posted a demonstration of the flaw online.

On Monday, Zalewski made note of a new Firefox bug that could give cybercriminals a leg up when running phishing attacks. Firefox can be forced to spawn a window with blank address bar with the Reload button disabled, Zalewski said. "This can be used to evoke a false sense of security or authority in casual users," he wrote in his warning. Hackers would have to dupe users into visiting a malicious site to pull this off this kind of attack, however.

Mozilla, security vendors and even Zalewski ranked this more recent flaw as minor; Mozilla has not yet patched the problem, and it's unclear whether it will be fixed in the 1.5.0.10 and 2.0.0.2 updates.

Mozilla also said that the week's Firefox updates would include Windows Vista-related changes, including one that allows Vista users to update the browser without having to download and reinstall the entire browser.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Matthew Stivala

HP OfficeJet 250 Mobile Printer

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?