Mozilla seals off URI flaws again

By

Firefox developers have released a security update that they hope will fix a lingering security threat in the popular open source browser.

Mozilla seals off URI flaws again
The Firefox 2.0.0.6 update fixes a problem in the way Firefox handles the uniform resource indicators (URI) that are used to launch other applications when an unsupported file type is loaded.

The URI vulnerability was originally discovered as a "cross-browser" flaw in which an attacker could use a specially crafted internet address in Internet Explorer to launch Firefox without security protections and run malicious code.

Mozilla had pointed out the flaw in the 2.0.0.5 update, claiming that any further fixes would be the responsibility of Microsoft.

Following the 2.0.0.5 release, however, security researcher Jesper Johansson pointed out that the URI handler in Firefox remained just as vulnerable as Internet Explorer.

The problem, noted Johannson, was that Firefox did not properly format the URI address, allowing an attacker to potentially insert multiple malicious instructions.

In addition to fixing the way URI addresses are displayed, the 2.0.0.6 update also repairs a vulnerability that would allow an attacker escalate privileges through a specially crafted about:blank window. That vulnerability is listed as "moderate," the second of Mozilla's four alert levels.

No other security or performance fixes were included in the update.
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

Australia's super funds told to assess authentication controls

Australia's super funds told to assess authentication controls

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

CBA looks to GenAI to assist 1200 'security champions'

CBA looks to GenAI to assist 1200 'security champions'

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Log In

  |  Forgot your password?