Firefox hit with new critical flaws

A French security testing company has found two holes in the latest version of Firefox that it rates as 'critical'.

The vulnerabilities could allow hackers to implant code in a web page that would create a batch/exe file with a malicious payload such as a Trojan or key-logger on the PC of anyone viewing the site, warned testers at the French Security Incident Response Team (FrSIRT).

"The Mozilla Foundation partially patched this issue on the server side by adding random letters and numbers to the install function, which will prevent this exploit from working," said FrSIRT, which posted the alert on Saturday.

FrSIRT rates the flaws as critical and has posted proof-of-concept exploit code on its website.

The Mozilla Foundation said in a statement: "Mozilla is aggressively working to provide a more comprehensive solution to these potential vulnerabilities and will provide that solution in a forthcoming security update.

"Users can further protect themselves today by temporarily disabling JavaScript or disabling the 'Allow websites to install software' option in Tools > Options > Web Features."

See also:

Mozilla fixes Firefox flaws

Foundation responds quickly to security bug  13 May 2005

MyDoom variant opens backdoor IRC channel

Hackers able to take complete control of affected PCs  10 May 2005

Firefox piles the pressure on Explorer

Over 2.6 million downloads in March, and a claimed 44 million in total  14 Apr 2005

Mozilla fixes new Firefox flaw

Users urged to download patched version immediately  24 Mar 2005

Firefox foils phishing flaw

Security update fixes spoofing and arbitrary code execution, says Mozilla  25 Feb 2005

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!