Researcher reports first Firefox 3.0 bug

Researcher sells critical vulnerability in browser to TippingPoint's bug bounty program

Only hours after Mozilla launched the final of Firefox 3.0, a researcher sold a critical vulnerability in the browser to TippingPoint's bug bounty program, the security company acknowledged Wedesday.

The bug has been reported to Mozilla, TippingPoint announced in a post to a company blog. "While Mozilla is working on a fix, we won't be divulging anything else until a patch is available," said TippingPoint, citing policy. "Once the issue is patched, we'll be publishing an advisory."

The Austin, Tex.-based security vendor operates the Zero Day Initiative (ZDI), one of two prominent vulnerability purchasing programs, and regularly buys bugs from independent researchers, then reports the flaws to the appropriate vendor. It's perhaps best known for sponsoring an annual hacking contest, in which researchers try to break into stock Windows, Mac OS X or Linux laptops, at the annual CanSecWest security conference.

TippingPoint released little information about the Firefox bug other than to confirm that it affects the new Firefox 3.0 as well as older 2.0 versions. TippingPoint classified the vulnerability as "critical" and said it could be used to execute remote code. There is one caveat, however, said TippingPoint. "Not unlike most browser-based vulnerabilities that we see these days, user interaction is required, such as clicking on a link in e-mail or visiting a malicious Web page."

The company didn't hint whether the vulnerability was present in all editions of Firefox 3.0, or was specific to one operating system. However, it hinted that a patch might come quickly. "Working with Mozilla on past security issues, we've found them to have a good track record and expect a reasonable turnaround on this issue as well," said TippingPoint.

Mozilla regularly touts its patch speed when it defends its security record. Last January, for instance, Window Snyder, the open-source vendor's chief security executive, rebutted a news report that claimed Firefox was less secure than Microsoft's Internet Explorer by noting that Mozilla patches faster than Microsoft. "At Mozilla we work as hard as we can to ship fixes as soon as possible to minimize the exposure to our users," she said then in a post to the company's security blog.

Mozilla was not available late Wednesday for comment or to answer questions.

Firefox 3.0, released Tuesday, was downloaded more than 8.3 million times in its first 24 hours of availability.

(Read Firefox 3.0 review here).

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Father’s Day Gift Guide

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?