http://news.com.com/Exploit+heightens+risk+from+old+Firefox+flaw/2100-1002_3-5776978.html By Joris Evers July 6, 2005 Computer code that could be used to attack systems with older versions of Firefox has been released on the Internet, security experts have warned. The exploit code takes advantage of a security vulnerability in Firefox 1.0.1 and earlier versions of the open-source Web browser, the French Security Incident Response Team, or FrSIRT, said in an advisory posted Wednesday. The bug exists because of an error in the way the older versions of Firefox handle GIF images. An attacker could gain control of a PC by luring the user to a Web page or sending an e-mail containing a specially crafted image, according to FrSIRT, which rates the issue "critical." Only Firefox 1.0.1 and earlier are vulnerable. The image-parsing problem was fixed in Firefox 1.0.2, which was released in March. Since then, two more Firefox updates have been released, mostly to address security issues. The most recent version is Firefox 1.0.4, which was released in May. Because the security bug was quashed more than three months ago, the exploit release is less of a concern, said Michael Sutton, a lab director at security company iDefense. "Given the length of time during which patches have been available, I would consider the release of this exploit to be a credible threat, but not critical," he said. A representative for the Mozilla Foundation, the maker of Firefox, said most of the browser's users have upgraded to version 1.0.4. Mozilla encourages people to check for updates regularly and update their browser when a new version is available, the representative said. Previous Next Since the debut of Firefox 1.0 in November, its usage has grown at a rapid pace. Security has been a main selling point for Firefox over Microsoft's rival Internet Explorer. The number of downloads of the software is close to passing the 70 million mark, according to the download counter Spread Firefox Web site. That total represents downloads of all versions, so it doesn't necessarily represent individual users. Firefox has demonstrated that the mature Web browser market, dominated by Internet Explorer, can be shaken up. IE has begun to see its market share dip slightly--a first in a number of years. Firefox U.S. usage share reached nearly 7 percent at the end of April, according to tracking company WebSideStory. Copyright ©1995-2005 CNET Networks, Inc. All rights reserved. _________________________________________ Attend the Black Hat Briefings and Training, Las Vegas July 23-28 - 2,000+ international security experts, 10 tracks, no vendor pitches. www.blackhat.com
This archive was generated by hypermail 2.1.3 : Thu Jul 07 2005 - 00:05:55 PDT