Firefox 2.0.0.10 coming next week

Posted on Thursday, Nov 22 2007 @ 00:10 CET by Thomas De Maesschalck
A new update of Firefox will arrive next week. Firefox version 2.0.0.10 will finally fix a long-standing cross-site scripting vulnerability:
The issue was first reported last February by Jesse Ruderman, but it gained widespread attention earlier this month when researcher Petko Petkov pointed out on his blog that the flaw could be used to launch a cross-site scripting attack against the Firefox browser.

The flaw has to do with the fact that Firefox does not properly check files that are compressed using the .jar (Java Archive) format. Attackers could sneak malicious code into the Jar-compressed documents, which would then be run by the victim.

A few days after Petkov posted his findings, a researcher going by the name "Bedford" showed how this attack could be launched against Google users, giving them access to victims' Gmail accounts, Google searches and other sensitive data stored on the Google Web site.

"This means that attackers can get to any place on Google and do whatever they want with your profile and your online presence," Petkov wrote in a blog posting.
Source: InfoWorld


About the Author

Thomas De Maesschalck

Thomas has been messing with computer since early childhood and firmly believes the Internet is the best thing since sliced bread. Enjoys playing with new tech, is fascinated by science, and passionate about financial markets. When not behind a computer, he can be found with running shoes on or lifting heavy weights in the weight room.



Loading Comments