Mozilla fixes Firefox 16 web browser flaw with update

Mozilla has updated its Firefox browser to fix a flaw that could have allowed sites to find out which other web pages its users had visited.

The security vulnerability was introduced in the 16th edition of its software, temporarily causing Mozilla to replace it with an older version.

The flawed version of the software was only online for a day.

Firefox had a 20% share of the global desktop browser market in September, according to a study by Netmarketshare.

That places it second only to Microsoft's Internet Explorer.

"We were quick to recognise the security vulnerability of Firefox 16 and took immediate action to temporarily remove the update from the current installer page," a spokesman from Mozilla told the BBC.

"As a precaution we asked Firefox users to revert back to using Firefox 15.0.1 whilst we worked to fix the problem. Firefox 16 was released with updates completely 'throttled', which meant that users were not automatically updated.

"We take security issues extremely seriously and were able to address the problem with Firefox quickly with limited impact to our users."

Browser bugs

Tal Be'ery, a web researcher at Imperva, explained how the error could have been exploited.

"Firefox is basically leaking a URL's [web address] data across domains by not restricting [programming language] Javascript's location method," he said.

He added that a proof-of-concept exploit had already been created to show how this might be used by hackers to obtain a user's Twitter ID.

It is not unusual for flaws to be discovered in web browsers.

Last month Microsoft was spurred to action by news that a previously unknown security hole in older versions of Internet Explorer was being used to download malware to PCs. The Poison Ivy Trojan allowed hackers to take control of infected computers.

Google recently awarded a teenage researcher $60,000 (£37,400) after he revealed a flaw in Chrome that could be used by a hacker to take control of a victim's system.

The search giant has since issued a fix, but said it would not publish details of how the exploit worked until Apple issued a fix to Safari, which is also vulnerable.

Quick fix

Graham Cluely, senior technology consultant at security software firm Sophos, said Mozilla's flaw could have proved serious had it not been spotted so quickly.

Source: bbc.co.uk

Read More

Mozilla previews 'Metro'-ized Firefox for Windows 8

But it won't ship until months after Windows 8 debuts

Mozilla last week released the first public preview of a Firefox browser that runs in Windows 8's touch-first "Modern" or "Metro" user interface (UI).

he Firefox app for Modern -- the UI dubbed "Metro" until Microsoft ditched the term over trademark issues -- will be partnered with the traditional desktop browser in a package that may appear in early January 2013 as Firefox 18.

Asa Dotzler, product manager for Firefox, announced the preview last Thursday in a short post to a Mozilla blog.

"Over the coming weeks and months, we'll be adding more features, tightening up Windows integration, improving performance and responsiveness, and finishing up all the necessary work to deliver a first-class Firefox experience for Windows 8," Dotzler wrote.

Users running Windows 8 RTM (release to manufacturing), the final code Microsoft started distributing in mid-August, can download and install a Modern-ized Firefox from Mozilla's "Nightly" channel, a rough-edged, in-development build that precedes the better-known Aurora, Beta and Final stages for each edition.

As Dotzler acknowledged, Firefox for Modern harbors bugs and omits features that should appear in the final.

Computerworld, in fact, was unable to run the Firefox app in the Modern UI on a 32-bit version of Windows 8 RTM. The touch-sensitive browser, however, did launch and work properly in Windows 8 64-bit.

Mozilla engineers are investigating the issue.

Brian Bondy, a Firefox platform engineer who has been working on the Modern version for Windows 8 for most of the year, was more specific than Dotzler in describing what is in the preview, and to a lesser extent, what will be in the future.

Last spring, Mozilla committed to creating a browser for Windows 8's new UI, the first of Microsoft's rivals to do so; Google followed suit a month later.

Browsers are a special case for Windows 8. After a several-month delay last year, Microsoft allowed hybrid desktop-Modern browsers.

Modern-style enabled browsers can run outside the normal security sandbox required for all other apps, and have access to most Windows APIs (application programming interface) on the classic desktop side, as well as the new WinRT API, the backbone of the Modern side of Windows 8 application development.

The category also gets an important pass from Microsoft: A Modern-enabled desktop browser circumvents the Windows Store -- the Microsoft-curated distribution channel -- and when installed on the Windows 8 classic desktop, simultaneously installs the Modern version.

The biggest caveat for a Windows 8 hybrid browser is that only the default browser -- which is set by the user -- can run in the Modern UI. During setup Windows 8 assigns Internet Explorer 10 (IE10) as the default browser.

Source: computerworld.com

Read More