Feeds

Firefox loses its shine

Spate of vulns raises security questions

  • alert
  • submit to reddit

The Essential Guide to IT Transformation

The Mozilla Foundation's Firefox web browser has made security a major part of its marketing, but a spate of vulnerabilities found over the last nine months had sullied that message.

In the latest incident, a 16-year-old security researcher - who asked only to be identified by his first name, Paul - found three vulnerabilities in the Firefox browser that together could be exploited to run arbitrary code. The incident is the latest black eye for the open-source software project's security image. While vulnerability researchers frequently flogged Microsoft for the number of security holes found in its Internet Explorer browser, now flaw finders are pinpointing more security holes in Firefox and, in many cases, using the same techniques.

"Much of what we learned security-wise from Internet Explorer is being applied to Firefox to find vulnerabilities," said Paul in an email interview. For example, Internet Explorer had its own Javascript flaw that allowed one page to execute scripts by navigating to another page that had higher privileges, he said. "That is one of the vulnerabilities used in this exploit."

The Mozilla Foundation changed its update server last week to prevent the exploit from working in the browser's default configuration, and on Thursday, the project released version 1.0.4 - a more permanent fix for the hole, said Chris Hofmann, director of engineering for the Mozilla Foundation.

"That was the main reason for this update," he said. "Though, as far as we know, this has not been actively exploited on the Web."

The security issues come as Firefox has rewritten the Cinderella story for the browser market by succeeding in gaining market share against the juggernaut of Microsoft's Internet Explorer.

Last month, the Firefox campaign announced that more than 50 million people had downloaded the browser. Almost seven per cent of visitors to major websites use the Firefox browser, an increase of more than a percentage point over two months, analysis firm WebSideStory announced on Tuesday.

However, the open-source software browser's security story has had to deal with some hiccups.

For the last six months of 2004, researchers found more vulnerabilities in Mozilla's Firefox than Microsoft's Internet Explorer, according to Symantec's bi-annual Internet Security Threat Report. The report tallied 21 vulnerabilities for Mozilla Firefox versus 13 for Internet Explorer. However, a smaller percentage of the vulnerabilities found in Firefox were considered a severe security threat, said Symantec's Oliver Friedrichs, senior manager with the company's security response team.

"Severe vulnerabilities in general allow for drive-by installs," he said. "So just by visiting a website, you could have [anything from] spyware to malware to Trojan horses installed on your system."

Friedrichs stressed that the number of vulnerabilities found by researchers is not necessarily a good indication of product security. He pointed to the Mozilla Firefox's relatively young age, the browser's increasing popularity, and commercial software vendors tendency to silently fix vulnerabilities as factors that could affect the vulnerability count.

Microsoft, for example, changed more than 50 features of Internet Explorer in its major security update, known as Service Pack 2, which the company released last August. In total, the software giant changed more than 428 features in Windows XP, including eliminating two classes of vulnerabilities on which the company has yet to provide details.

Those changes have made Internet Explorer a tougher target for vulnerability researchers, said one flaw finder.

"The assumption that Internet Explorer is easier to exploit is a common misconception," Paul said. "Internet Explorer has become quite tough, and it is very difficult to find vulnerabilities in it."

Microsoft did not immediately comment for this article, but tackled the issue on the company's Internet Explorer developer's blog.

"Security is an industry-wide problem," wrote one Microsoft developer. "It's not limited or unique to operating systems or applications, or client or server software. It's not limited or unique to commercial software or open source."

Whether the Mozilla Foundation will find that its original development focus on security will mean fewer security updates remains to be seen. However, their is no question that the project has its work cut out for it, said Mozilla's Hoffman.

"There is definitely engineering work to do," he said. "We work towards integrating security -- that's a critical part of our mission and what we want to accomplish with the browser and engage people that can help us secure the application and help us build a better browser."

Copyright © 2004, SecurityFocus logo

Related stories

Firefox exploit targets zero day vulns
Opera downloads reach 2m
Firefox doubles market share as IE slips

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Secure microkernel that uses maths to be 'bug free' goes open source
Hacker-repelling, drone-protecting code will soon be yours to tweak as you see fit
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.