Mozilla Patches Critical Security Flaws For Firefox
Altogether, the latest version of Firefox -- Firefox 3.0.4 -- repaired a total of 11 errors, with four critical flaws, in Firefox 3.0.2 and 12 errors in the older version 2.0.0.18, six of which were considered critical. Most of the errors deemed critical in Mozilla's patch bundle could be exploited by remote attackers wanting to infiltrate a user's system to shut it down, access accounts and steal data, among other things.
Included in the Mozilla Firefox patch bundle was an error that involved a Cross Site Scripting and JavaScript privilege escalation flaw, which, if exploited, could be used by a remote attacker to run arbitrary JavaScript with chrome privileges on an unsuspecting user's computer.
Another critical fix included one that repaired a buffer overflow vulnerability in the http-index-format parser. According to the advisory, the flaw enables an attacker to execute malicious code on a victim's computer by sending a specially-crafted 200 header line in the HTTP index response, causing the system to crash. The attacker could then install malicious software giving them the power to compromise the victim's machine in order to steal information or access accounts.
Meanwhile, Mozilla tackled several stability bugs in the browser engine used in Firefox as well as other Mozilla-based products, such as Thunderbird and SeaMonkey, which share a browser engine. Some of the crashes resulting from the glitch stemmed from possible memory corruption errors that could be exploited by attackers to run arbitrary code on a user's computer.
Mozilla also updated an error that could cause the browser to lock on a non-native object after tampering with the window, which would result in a crash of the entire system. An attacker could then exploit the crash to run arbitrary code on a victim's computer and compromise a user's system.
Additionally, the security update repaired an error in Adobe Flash Player that could also lead to remote code execution, affecting Firefox version 2 as well as SeaMonkey. Specifically, the issue stems from insufficient checks performed when testing whether the Flash module was properly unloaded, according to the advisory. The vulnerability could cause a user's system to crash, which could open the door for a hacker to launch a remote attack.
Finally, a flaw in Mozilla's DOM Constructing code could be exploited if an attacker modified certain file input properties before the system finished initializing. Like the other critical errors, the nsFrameManager glitch could also be used to crash a system and execute malicious code remotely.
In addition, Mozilla also repaired three vulnerabilities that were rated "high" severity, including an image stealing error that allowed an attacker to bypass certain security restrictions and gain access to the image content from other domains. An attacker could then steal private information from a victim who is logged into a Web site that stores the data in images.
Mozilla also issued patched for two moderate vulnerabilities and one low-priority that could lead to denial of service attacks, minor data leakages or spoofs.
While many of the updates plug serious security holes in Firefox 2.0 and older versions of 3.0, Mozilla strongly recommends that users' update to the latest version of Firefox.