Major security flaws found in Mozilla Firefox browser
<!--[[File:Mozilla Firefox Logo.png|200px|right|Mozilla Firefox]]-->
{{date|May 10, 2005}}__NOTOC__

Two serious security flaws have been found in the {{w|Mozilla Firefox}} {{w|web browser|browser}}, both rated by security analysts as being 'extremely critical'. 

An attack using a combination of the two flaws has already been posted on the Internet, which can allow an attacker to run code on a victim's computer and take control of it.

One allows for an invisible website 'frame' to navigate back to a URL in the History that contains {{w|JavaScript}}. This allows an attacker to extract sensitive information, such as passwords from that site, using the JavaScript code.

The second allows attackers to put JavaScript into the URL for the icon for downloading programs in the install confirmation dialogue box. This JavaScript code can then execute with enhanced privileges.

The flaws have been confirmed in the latest version of the browser, 1.0.3, and may well be present in older versions too.

A number of changes have been made to update.mozilla.org and addons.mozilla.org to make the example attack useless. This doesn't mean that other sites can't be used to launch the attack, so be careful what you add to the "Allowed Sites" list. The reason that update.mozilla.org and addons.mozilla.org were targeted specifically is that they are added to the "Allowed Sites" list during the install process.

The most popular browser on the web is [[Microsoft]]'s {{w|Internet Explorer}}, which has had many security exploits in the past. There are currently several outstanding security flaws, the most severe of which is rated 'Highly Critical'.

== Protecting yourself ==
On May 11, 2005, the Mozilla Foundation released Firefox 1.0.4 and Mozilla 1.7.8 with the vulnerabilities patched.

The Mozilla Foundation has published a series of steps for users using previous versions of the browser. The steps will limit their vulnerability, but which also limits browser functionality:

# Select the "Options" dialog from the "Tools" menu
# Select the "Web Features" icon
# Click the "Allowed Sites" button on the same line as the "Allow web sites to install software" checkbox
# Click the "Remove All Sites" button
# Click "OK"

To prevent the script injection exploit from stealing cookies or other sensitive data disable Javascript before visiting untrustworthy sites. In Firefox:

# Select the "Options" dialog from the "Tools" menu
# Select the "Web Features" icon
# Uncheck the "Enable Javascript" checkbox
# Click "OK"

{{haveyoursay}}
== Related news ==
* {{wikinews|title=Security flaws in Mozilla Firefox internet browser fixed|date=May 12, 2005}}
== Sister links ==
{{sisters
|b|Using Firefox
}}
== Sources ==
* [http://news.bbc.co.uk/2/hi/technology/4532127.stm  Critical flaws found in Firefox]. {{w|BBC News Online}}, May 10, 2005.
* [http://www.mozillazine.org/talkback.html?article=6590 More Details on Arbitrary Code Execution Vulnerability]. {{w|MozillaZine}}, May 9, 2005.
*John Leyden [http://www.theregister.co.uk/2005/05/09/firefox_0day_exploit/ "Firefox exploit targets zero day vulns"]. ''{{w|The Register}}'', May 9, 2005
* [http://secunia.com/advisories/15292 "Mozilla Firefox Two Vulnerabilities"]. ''{{w|Secunia}}'', May 9, 2005
* [http://www.mozilla.org/security/announce/mfsa2005-42.html "Mozilla Foundation Security Advisory 2005-42"]. ''{{w|Mozilla Foundation}}'', May 9, 2005
* [http://secunia.com/product/11/ "Microsoft Internet Explorer 6.x"]. ''{{w|Secunia}}'', 2005
 
{{publish}}
{{archived}}

[[Category:Science and technology]]
[[Category:Internet]]
[[Category:Mozilla]]
[[Category:Mozilla Firefox]]

[[es:Dos graves fallos de seguridad encontrados en Mozilla Firefox]]
[[pt:Duas falhas graves encontradas no navegador Firefox]]
__NOTOC__

Two serious security flaws have been found in the web browser|browser, both rated by security analysts as being 'extremely critical'. 

An attack using a combination of the two flaws has already been posted on the Internet, which can allow an attacker to run code on a victim's computer and take control of it.

One allows for an invisible website 'frame' to navigate back to a URL in the History that contains . This allows an attacker to extract sensitive information, such as passwords from that site, using the JavaScript code.

The second allows attackers to put JavaScript into the URL for the icon for downloading programs in the install confirmation dialogue box. This JavaScript code can then execute with enhanced privileges.

The flaws have been confirmed in the latest version of the browser, 1.0.3, and may well be present in older versions too.

A number of changes have been made to update.mozilla.org and addons.mozilla.org to make the example attack useless. This doesn't mean that other sites can't be used to launch the attack, so be careful what you add to the "Allowed Sites" list. The reason that update.mozilla.org and addons.mozilla.org were targeted specifically is that they are added to the "Allowed Sites" list during the install process.

The most popular browser on the web is Microsoft's , which has had many security exploits in the past. There are currently several outstanding security flaws, the most severe of which is rated 'Highly Critical'.

The Mozilla Foundation has published a series of steps for users using previous versions of the browser. The steps will limit their vulnerability, but which also limits browser functionality:

# Select the "Options" dialog from the "Tools" menu
# Select the "Web Features" icon
# Click the "Allowed Sites" button on the same line as the "Allow web sites to install software" checkbox
# Click the "Remove All Sites" button
# Click "OK"

To prevent the script injection exploit from stealing cookies or other sensitive data disable Javascript before visiting untrustworthy sites. In Firefox:

# Select the "Options" dialog from the "Tools" menu
# Select the "Web Features" icon
# Uncheck the "Enable Javascript" checkbox
# Click "OK"


es:Dos graves fallos de seguridad encontrados en Mozilla Firefox
Duas falhas graves encontradas no navegador Firefox
Science and technology Internet Mozilla Mozilla Firefox