SHARE
Follow this article on Twitter Facebook LinkedIn Bookmark and Share
Home >> Security

Mozilla patches Firefox to prep for Pwn2Own

Mozilla patches Firefox to prep for Pwn2Own

By:  Gregg Keizer  On: 03 Mar 2011 For: ComputerWorld (US) Creator
 

The open source browser maker is following Google, quashing 11 bugs, including a CSRF flaw that worried Adobe. The updates were the first for Firefox since December

Mozilla Corp. on Tuesday fixed 11 security flaws in Firefox, following in rival Google's footsteps in patching its browser before a hacking contest kicks off next week.

Nine of the 11 flaws were rated "critical," a threat rating that implies hackers could use the vulnerabilities to compromise a computer or infect it with malware. Of the two remaining bugs, one was labeled "high" and the second was tagged as "moderate."

The updates, which brought the open-source browser to versions 3.6.14 and 3.5.17, were the first since December, a longer-than-usual span between Mozilla patch shipments. Part of the reason was that Tuesday's updates were delayed. They had been slated to show in mid-February, but Mozilla held them to investigate a non- security bug that caused some users'browsers to crash.

The patches in Tuesday's updates addressed three JavaScript flaws, two bugs in Firefox's browser engine, a JPEG rendering vulnerability that could be exploited by serving a malicious image to users, and a cross-site forgery request (CSRF) bug.

An Adobe security researcher reported the CSRF vulnerability, which was the issue rated high, Mozilla said in its patch notes . According to information posted on a security mailing list last month, the CSRF bug can be exploited in several browsers -- Firefox, Apple 's Safari and Google's Chrome -- using a malformed Flash file.

Previously, Mozilla developers had reported that Adobe was pressing them to issue a patch for the CSRF bug.

Tuesday's security update reached users eight days before Pwn2Own, the annual hacking contest held at the CanSecWest security conference in Vancouver, British Columbia. Pwn2Own begins March 9 , when security researchers will compete for $65,000 in prizes by trying to take down the most up-to-date production editions of Firefox, Chrome, Safari and Microsoft 's Internet Explorer.

Google patched 19 bugs in Chrome on Monday, making Firefox the second of the four targeted browsers to get a last-minute security polish before the challenge.

Last year, Google and Apple updated their browsers just days before Pwn2Own, but Mozilla did not. Instead, Mozilla acknowledged a critical vulnerability in Firefox less than a week before 2010's contest, but said it wouldn't fix the flaw until after its conclusion. Pwn2Own organizers then ruled that hackers would not be allowed to use the vulnerability to exploit Firefox.

Firefox 3.6.14, the version that will be attacked at Pwn2Own, will soon be displaced by Firefox 4, which entered its final beta Monday. Mozilla is moving toward a "release candidate" build, and unless unexpected problems pop up, will probably ship the browser this month.

Users can update to Firefox 3.6.14 by downloading the new edition or by selecting "Check for Updates" from the Help menu in the browser. Firefox 3.5 users can obtain version 3.5.17 with the update tool.

Sign up for our Newsletters
Tags: Mozilla, Firefox

 
Close X












Close X
Print |  Views: 1897   |   Rating:offoffoffoffoff  (0 votes)
Rate this article on a scale of
1 to 5 stars,5 being the best.



Close X
Page 1

gregg keizer Gregg Keizer is a contributor to the International Data Group (IDG) News Service, which publishes global technology stories from bureaus around the world to more than 300 publications in more than 60 countries.

Recent Canadian IT Jobs


more: IT Jobs , Post A Job


Related Content

Mozilla to skip CSRF bug patch in next Firefox update
Mozilla to skip CSRF bug patch in next Firefox updateOriginally slated for release on Feb. 14, the security updates for the cross-site request forgery bug was held while Mozilla developers investigated a bug that affected some, though not all, users of the betas. Find out more
Critical Firefox bug fixed one month after disclosure
Critical Firefox bug fixed one month after disclosureOpen source browser provider Mozilla has released Firefox 3.6.2, which is meant to fix a bug that could potentially crash your browser. The bug was discovered by Evgeny Legerov, who said it affected Firefox browsers running on Windows XP and Vista.
IE8 can't stop Microsoft's declining market share
IE8 can't stop Microsoft's declining market shareIE's share falls to new low; Firefox, Chrome and Opera post solid gains
It takes courage to admit your product is insecure
kudos to mozzila's chief security officer, window snyder (yes, that's his real name), who
Latest Safari release could be “easy pickings”
the winner of the 2008 pwn2own hacking contest has his sights set on apple inc.’s newest launched safari 4 beta. security researcher charlie miller, who took home $10,000 for hacki
blog comments powered by Disqus