Feeds

Firefox loses its shine

Spate of vulns raises security questions

  • alert
  • submit to reddit

Securing Web Applications Made Simple and Scalable

The Mozilla Foundation's Firefox web browser has made security a major part of its marketing, but a spate of vulnerabilities found over the last nine months had sullied that message.

In the latest incident, a 16-year-old security researcher - who asked only to be identified by his first name, Paul - found three vulnerabilities in the Firefox browser that together could be exploited to run arbitrary code. The incident is the latest black eye for the open-source software project's security image. While vulnerability researchers frequently flogged Microsoft for the number of security holes found in its Internet Explorer browser, now flaw finders are pinpointing more security holes in Firefox and, in many cases, using the same techniques.

"Much of what we learned security-wise from Internet Explorer is being applied to Firefox to find vulnerabilities," said Paul in an email interview. For example, Internet Explorer had its own Javascript flaw that allowed one page to execute scripts by navigating to another page that had higher privileges, he said. "That is one of the vulnerabilities used in this exploit."

The Mozilla Foundation changed its update server last week to prevent the exploit from working in the browser's default configuration, and on Thursday, the project released version 1.0.4 - a more permanent fix for the hole, said Chris Hofmann, director of engineering for the Mozilla Foundation.

"That was the main reason for this update," he said. "Though, as far as we know, this has not been actively exploited on the Web."

The security issues come as Firefox has rewritten the Cinderella story for the browser market by succeeding in gaining market share against the juggernaut of Microsoft's Internet Explorer.

Last month, the Firefox campaign announced that more than 50 million people had downloaded the browser. Almost seven per cent of visitors to major websites use the Firefox browser, an increase of more than a percentage point over two months, analysis firm WebSideStory announced on Tuesday.

However, the open-source software browser's security story has had to deal with some hiccups.

For the last six months of 2004, researchers found more vulnerabilities in Mozilla's Firefox than Microsoft's Internet Explorer, according to Symantec's bi-annual Internet Security Threat Report. The report tallied 21 vulnerabilities for Mozilla Firefox versus 13 for Internet Explorer. However, a smaller percentage of the vulnerabilities found in Firefox were considered a severe security threat, said Symantec's Oliver Friedrichs, senior manager with the company's security response team.

"Severe vulnerabilities in general allow for drive-by installs," he said. "So just by visiting a website, you could have [anything from] spyware to malware to Trojan horses installed on your system."

Friedrichs stressed that the number of vulnerabilities found by researchers is not necessarily a good indication of product security. He pointed to the Mozilla Firefox's relatively young age, the browser's increasing popularity, and commercial software vendors tendency to silently fix vulnerabilities as factors that could affect the vulnerability count.

Microsoft, for example, changed more than 50 features of Internet Explorer in its major security update, known as Service Pack 2, which the company released last August. In total, the software giant changed more than 428 features in Windows XP, including eliminating two classes of vulnerabilities on which the company has yet to provide details.

Those changes have made Internet Explorer a tougher target for vulnerability researchers, said one flaw finder.

"The assumption that Internet Explorer is easier to exploit is a common misconception," Paul said. "Internet Explorer has become quite tough, and it is very difficult to find vulnerabilities in it."

Microsoft did not immediately comment for this article, but tackled the issue on the company's Internet Explorer developer's blog.

"Security is an industry-wide problem," wrote one Microsoft developer. "It's not limited or unique to operating systems or applications, or client or server software. It's not limited or unique to commercial software or open source."

Whether the Mozilla Foundation will find that its original development focus on security will mean fewer security updates remains to be seen. However, their is no question that the project has its work cut out for it, said Mozilla's Hoffman.

"There is definitely engineering work to do," he said. "We work towards integrating security -- that's a critical part of our mission and what we want to accomplish with the browser and engage people that can help us secure the application and help us build a better browser."

Copyright © 2004, SecurityFocus logo

Related stories

Firefox exploit targets zero day vulns
Opera downloads reach 2m
Firefox doubles market share as IE slips

Mobile application security vulnerability report

More from The Register

next story
NEW, SINISTER web tracking tech fingerprints your computer by making it draw
Have you been on YouPorn lately, perhaps? White House website?
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
LibreSSL RNG bug fix: What's all the forking fuss about, ask devs
Blow to bit-spitter 'tis but a flesh wound, claim team
Black Hat anti-Tor talk smashed by lawyers' wrecking ball
Unmasking hidden users is too hot for Carnegie-Mellon
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
Own a Cisco modem or wireless gateway? It might be owned by someone else, too
Remote code exec in HTTP server hands kit to bad guys
British data cops: We need greater powers and more money
You want data butt kicking, we need bigger boots - ICO
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.