Feeds

Firefox loses its shine

Spate of vulns raises security questions

  • alert
  • submit to reddit

5 things you didn’t know about cloud backup

The Mozilla Foundation's Firefox web browser has made security a major part of its marketing, but a spate of vulnerabilities found over the last nine months had sullied that message.

In the latest incident, a 16-year-old security researcher - who asked only to be identified by his first name, Paul - found three vulnerabilities in the Firefox browser that together could be exploited to run arbitrary code. The incident is the latest black eye for the open-source software project's security image. While vulnerability researchers frequently flogged Microsoft for the number of security holes found in its Internet Explorer browser, now flaw finders are pinpointing more security holes in Firefox and, in many cases, using the same techniques.

"Much of what we learned security-wise from Internet Explorer is being applied to Firefox to find vulnerabilities," said Paul in an email interview. For example, Internet Explorer had its own Javascript flaw that allowed one page to execute scripts by navigating to another page that had higher privileges, he said. "That is one of the vulnerabilities used in this exploit."

The Mozilla Foundation changed its update server last week to prevent the exploit from working in the browser's default configuration, and on Thursday, the project released version 1.0.4 - a more permanent fix for the hole, said Chris Hofmann, director of engineering for the Mozilla Foundation.

"That was the main reason for this update," he said. "Though, as far as we know, this has not been actively exploited on the Web."

The security issues come as Firefox has rewritten the Cinderella story for the browser market by succeeding in gaining market share against the juggernaut of Microsoft's Internet Explorer.

Last month, the Firefox campaign announced that more than 50 million people had downloaded the browser. Almost seven per cent of visitors to major websites use the Firefox browser, an increase of more than a percentage point over two months, analysis firm WebSideStory announced on Tuesday.

However, the open-source software browser's security story has had to deal with some hiccups.

For the last six months of 2004, researchers found more vulnerabilities in Mozilla's Firefox than Microsoft's Internet Explorer, according to Symantec's bi-annual Internet Security Threat Report. The report tallied 21 vulnerabilities for Mozilla Firefox versus 13 for Internet Explorer. However, a smaller percentage of the vulnerabilities found in Firefox were considered a severe security threat, said Symantec's Oliver Friedrichs, senior manager with the company's security response team.

"Severe vulnerabilities in general allow for drive-by installs," he said. "So just by visiting a website, you could have [anything from] spyware to malware to Trojan horses installed on your system."

Friedrichs stressed that the number of vulnerabilities found by researchers is not necessarily a good indication of product security. He pointed to the Mozilla Firefox's relatively young age, the browser's increasing popularity, and commercial software vendors tendency to silently fix vulnerabilities as factors that could affect the vulnerability count.

Microsoft, for example, changed more than 50 features of Internet Explorer in its major security update, known as Service Pack 2, which the company released last August. In total, the software giant changed more than 428 features in Windows XP, including eliminating two classes of vulnerabilities on which the company has yet to provide details.

Those changes have made Internet Explorer a tougher target for vulnerability researchers, said one flaw finder.

"The assumption that Internet Explorer is easier to exploit is a common misconception," Paul said. "Internet Explorer has become quite tough, and it is very difficult to find vulnerabilities in it."

Microsoft did not immediately comment for this article, but tackled the issue on the company's Internet Explorer developer's blog.

"Security is an industry-wide problem," wrote one Microsoft developer. "It's not limited or unique to operating systems or applications, or client or server software. It's not limited or unique to commercial software or open source."

Whether the Mozilla Foundation will find that its original development focus on security will mean fewer security updates remains to be seen. However, their is no question that the project has its work cut out for it, said Mozilla's Hoffman.

"There is definitely engineering work to do," he said. "We work towards integrating security -- that's a critical part of our mission and what we want to accomplish with the browser and engage people that can help us secure the application and help us build a better browser."

Copyright © 2004, SecurityFocus logo

Related stories

Firefox exploit targets zero day vulns
Opera downloads reach 2m
Firefox doubles market share as IE slips

The essential guide to IT transformation

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
HP: NORKS' cyber spying efforts actually a credible cyberthreat
'Sophisticated' spies, DIY tech and a TROLL ARMY – report
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Why cloud backup?
Combining the latest advancements in disk-based backup with secure, integrated, cloud technologies offer organizations fast and assured recovery of their critical enterprise data.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?