Posted on Thursday, November 22 2007 @ 0:10 CET by Thomas De Maesschalck
A new update of Firefox will arrive next week. Firefox version 2.0.0.10 will finally fix a long-standing cross-site scripting vulnerability:
The issue was first reported last February by Jesse Ruderman, but it gained widespread attention earlier this month when researcher Petko Petkov pointed out on his blog that the flaw could be used to launch a cross-site scripting attack against the Firefox browser.
The flaw has to do with the fact that Firefox does not properly check files that are compressed using the .jar (Java Archive) format. Attackers could sneak malicious code into the Jar-compressed documents, which would then be run by the victim.
A few days after Petkov posted his findings, a researcher going by the name "Bedford" showed how this attack could be launched against Google users, giving them access to victims' Gmail accounts, Google searches and other sensitive data stored on the Google Web site.
"This means that attackers can get to any place on Google and do whatever they want with your profile and your online presence," Petkov wrote in a blog posting.
Source: InfoWorld
