New Mozilla Flaws Exposed Three New Vulnerabilities Discovered This Week Sean Michael Kerner
A trio of newly exposed flaws in Mozilla browsers (including Firefox) was announced this week by a number of different security researchers.
The download spoofing flaw was reported by security firm Secunia this week. This flaw could allow a malicious user to make a downloaded file appear to be coming from a different source than it actually is, which could be used to trick users into downloading something that they're not expecting.
Bugzilla, Mozilla's bug tracking system, has assigned repair responsibility to Mozilla staffer Ben Goodger. According to Mozilla, the bug carries a "normal" severity rating; Secunia has currently rated it as "less critical." Users are warned not to download material from untrusted sources.
Polish security research firm iSEC Perhaps reported a buffer overflow bug with the NNTP (newsgroup protocol). The vulnerability could allow an attacker to potentially execute arbitrary code when a news:// connection is triggered. The bug exists on at least Mozilla 1.7.3 and, according to the Mozilla Foundation, has been fixed in version 1.7.5.
According to iSEC's advisory, Mozilla developer Dan Veditz claimed that the bug cannot be exploitable in a Bugzilla posting. ISEC researcher Maurycy Prodeus, who wrote the advisory, issued proof of concept code that worked in his test bed environment.
"On my RedHat 9.0 with Mozilla 1.7.3, attached proof of concept code overflows the buffer using attacker-supplied data," Prodeus wrote. "I decided to make this bug public because Mozilla Team hasn't warned users."
A third Mozilla vulnerability reported by security firms ptraced.net
and Gentoo Foundation has revealed a potential problem with the way Mozilla Thunderbird and Firefox handle temporary files. Martin from ptraced.net discovered that temporary files in Thunderbird 0.8 and 0.9.3 were stored with predictable names in a world-readable format, which could potentially expose a user to risk.
Based on five advisories issued by security research firm Secunia since August 2004, 80 percent currently remain unpatched. Secunia stats also illustrate a small level of user risk, with 80 percent of advisories in the same period bearing a "Less Critical" label and 0 percent of them being rated as extremely critical (20 percent were rated as moderately critical).
