Mozilla Under Fire Version 1.07 Released Amidst Heightened Security Concerns Sean Michael Kerner
As allegations of malicious code and heightened insecurity swirl around, Mozilla has updated its Firefox Web browser in what is being termed, "a security and stability release."
Mozilla today released version 1.07 of Firefox, which includes numerous security fixes. Security firm Secunia has rated at least one as "extremely critical."
CAN-2005-2968 titled "Firefox Command Line URL Shell Command Injection" is also known as Mozilla Bugzilla Bug 307185 "URLs passed on the command
line are parsed by the shell (bash)."
According to the Bugzilla record, Mozilla has been aware of the flaw since at least Sept. 6 when the entry was created.
The vulnerability could have potentially been used by a hacker to compromise a user's system due an issue with a shell script used by Firefox. The issue only affects Linux/Unix users of Firefox.
According to Mozilla, the 1.07 release also provides a fix for a "potential buffer overflow vulnerability when loading a hostname with all soft-hyphens." As of press time, Mozilla had not yet updated its list of vulnerabilities that are repaired in 1.07, so it is currently unclear as to the total number of fixes it includes. The previous release included no fewer than 12 fixes.
The newest Mozilla Firefox update comes as Symantec's latest Internet Security Threat Report, reports that Mozilla browsers have had more vulnerabilities in the first six months of 2005 than any other browser, including Microsoft's Internet Explorer (IE).
Symantec's report noted that between January and June of 2005 there were 25 vendor confirmed vulnerabilities in Mozilla browsers, 18 of which were
deemed to be "high severity." In stark contrast, IE only had 13 vendor-confirmed vulnerabilities in the same period and only eight were considered to
be high severity.
Beyond Symantec's assertion of Mozilla's industry-leading browser vulnerability count, there has also been a recent allegation that a Mozilla site may have unwittingly served as a vehicle for malicious code.
Russian security firm Kaspersky Labs alleges that the Korean Mozilla Web site contained files infected with Virus.Linux.RST.b malicious code. Kaspersky reports that "the infected files have now been removed, but it took some time."
In June, the Korean Mozilla site was reportedly hacked, though it is unclear if the malicious code reported by Kaspersky is linked in any way to the
incident.
Mozilla's popularity apparently may also be under attack. A recent study from Web analytics firm NetApplication shows that Firefox may be losing its grip and for the first time since being launched is actually
losing marginal market share.
