Mozilla Updates Firefox Ahead of Black Hat Mozilla Firefox 2.0.0.6 Released with firefoxurl Security Patch Sean Michael Kerner
Mozilla has patched a pair of security vulnerabilities in its Mozilla Firefox Web browser just in time for its release of security tools at the Black Hat security conference in Las Vegas this week.
The most notable security fix is the critical fix for a flaw that Mozilla first blamed on browser rival Microsoft. Mozilla Foundation Security Advisory 2007-27 is the open source group's second attempt at fixing a flaw dealing with passing bad addresses and information to external programs.
Mozilla has been struggling with versions of the flaw since it was first when it was first reported July 10. The actual flaw involves the "firefoxurl://" uniform resource identifier (URI) handler, which enables Firefox to call on other Web resources.
In the Firefox 2.0.0.5 release issued July 18, Mozilla claimed to have fixed the flaw and noted that Microsoft still had similar issues and that the fix took care of Firefox.
However, Mozilla Chief Security Officer Window Snyder admitted that Firefox was still at risk from the flaw a week later. She pledged at the time that Mozilla would move quickly to fix the issue properly.
A week later, here it is: Firefox 2.0.0.6.
"Jesper Johansson pointed out that Mozilla did not percent-encode spaces and double-quotes in URIs handed off to external programs for handling, which can cause the receiving program to mistakenly interpret a single URI as multiple arguments," Mozilla explained in its latest advisory.
"The danger depends on the arguments supported by the specific receiving program, though at the very least we know Firefox (and Thunderbird) 2.0.0.4 and older could be used to run arbitrary script."
The second fix in Firefox 2.0.0.6 also fixes an issue in Firefox that Mozilla thought it had fixed in the Firefox 2.0.0.5 release. Mozilla Foundation Security Advisory 2007-20 describes a privilege-escalation flaw.
According to Mozilla's advisory, the flaw was introduced by the fix for a frame-spoofing flaw that was fixed in the 2.0.0.5 release.
In addition to updating Firefox, Mozilla has also updated its Thunderbird e-mail client for the same issues, to version 2.0.0.6 as well. The future of Thunderbird itself is currently in question.
In a series of blog posts over the last week, Mozilla's CEO Mitchell Baker has indicated that she would like to see Thunderbird spun out from under the auspices of the Mozilla Corporation. No decisions have yet been made, nor has a timeline been published as to when Thunderbird might be moved.
The Mozilla release notes for the 2.0.0.6 releases do not indicate whether any flaws were fixed in Mozilla's products as a result of the open source groups own security scanning.
