Mozilla Updates Firefox Several Security Flaws Fixed with Firefox 1.0.1 Tim Gray
The Mozilla Foundation has released the latest version of its popular Firefox browser, along with a series of patches intended to prevent spoofing
and phishing attacks that have caused the browser to crash.
Firefox 1.0.1 addresses numerous security vulnerabilities and approximately 40 other browser fixes, according to the not-for-profit software foundation.
The primary glitch, which the updated browser fixed, was a vulnerability found in the Internalized Domain Names (IDN) protocol, which allows the use
of certain international characters that look like other commonly used characters.
The IDN vulnerability allows hackers to spoof Web sites through phishing attacks.
The update fixes vulnerabilities that range from "moderately critical" to "not critical"; none are listed as "highly critical," according to the Mozilla Foundation, said in a statement.
"Regular security updates are essential for maintaining a safe browsing experience for our users," he said.
There are no known exploits for any of the vulnerabilities.
The security update can be downloaded at the Mozilla Web site and will be available within a few days through Firefox's automatic update feature.
"I'd encourage users to get this release, especially if they've been prone to phishing attacks or spoofing," Hofmann said in a statement. "A lot of work in this release focuses on those areas."
The Shmoo Group discovered the IDN bug and said it appeared in all browsers, with the exception of Internet Explorer.
The Firefox browser has been downloaded 27 million times since it was released on Dec. 7, according to the foundation.
Opera Software also addressed the IDN flaw this week, as well as several others, with the second beta version of its browser.
The company said the beta includes an answer to the recent security difficulties with Web site spoofing.
The latest browser displays security information inside the address bar, located next to a padlock icon that indicates the level of security present
on a site, according to the company. These anti-spoof measures help users make better decisions about the validity and security of visited Web sites.
"One of the most important measures to counter phishing attacks is the use of security certificates," Christen Krogh, Opera's vice president of engineering, said in a statement. "The challenge for browser vendors is to better explain the verification of certificates and to make the user more aware of this additional verification before entering into secure transactions."
The company also addressed the IDN flaw by displaying only domain names from certain top level names. This ensures that users who depend on IDN will
avoid spoofed sites, the company said.
