Language Selection

English French German Italian Portuguese Spanish

Spoofing flaw resurfaces in Mozilla browsers

Filed under
Security

A 7-year-old flaw that could let an attacker place malicious content on trusted Web sites has resurfaced in the most recent Firefox browser, Secunia has warned.

The flaw, which also affects some other Mozilla Foundation programs, lies in the way the software handles frames, which are a way of showing Web content in separate parts of the browser window. The applications don't check whether the frames displayed in a single window all originate from the same Web site, Secunia said in an advisory on Monday. Firefox 1.x, Mozilla 1.7.x and Camino 0.x versions are vulnerable to the flaw, the security monitoring company said.

As a result, an attacker could insert content into a frame on a trusted Web site, Secunia said. Account holders who believe they are interacting with a frame belonging to an online bank could be tricked into giving up personal information or downloading malicious code, for example. Secunia rated the issue "moderately critical."

The same "frame injection" vulnerability in Mozilla's browsers was detailed by Secunia in July of last year. At the time, it did not affect the most recent versions of the applications.

For a spoofing attempt to work, a surfer would need to have both the attacker's Web site and a trusted Web site open in different windows. A click on a link on the malicious site would then display the attacker's content in a frame on the trusted Web site, Secunia said. The company advised people not to visit trusted and untrusted Web sites at the same time.

The Mozilla Foundation is investigating the Secunia report, a representative for the organization said.

The vulnerability has not been exploited, a moderator of a support forum on the Mozilla Web site wrote Monday, in response to the Secunia alert.

For protection, the moderator advises people to close all other windows and tabs before accessing a Web site such as a bank or online store that requires them to type in personal data.

With its initial release last fall, Firefox has demonstrated that the mature Web browser market dominated by Microsoft's Internet Explorer can be shaken up. IE has begun to see its market share dip slightly--a first in a number of years.

Source.

Secunia Advisory.

More in Tux Machines

Raspbian PIXEL Fork Lets You Install and Run the Operating System on a PC or Mac

After announcing the availability of new builds of his AndEX Nougat 7.1.1 Android-x86 fork that lets users run Android 7.1.1 on their PCs, now Arne Exton released a custom build of Raspberry Pi Foundation's Raspbian PIXEL image. Read more

Ubuntu 17.10 Won't Ship with Upstart and CGManager as Unity 8 Is Being Dropped

Canonical's Dimitri John Ledkov informs the Ubuntu Linux and Ubuntu Touch communities that the upcoming Ubuntu 17.10 (Artful Aardvark) operating system will drop support for the Upstart init daemon and CGManager project. Read more

Benchmarking Various Linux Distributions With Amazon's EC2 Cloud In 2017

After carrying out the recent Amazon EC2 Cloud benchmarks vs. Intel/AMD CPUs I also decided to run some Linux distribution tests in the Elastic Compute Cloud with not having done any such comparisons in a long time. So for those wondering how different Linux distributions compare in Amazon's cloud, this article is for you. Read more

This Custom Android-x86 Build Puts Android 7.1.1 on Your PC, with Linux 4.11 RC7

GNU/Linux developer Arne Exton was happy to announce the release of a new build of his custom built Android-x86 project that lets uses runs the latest Android mobile operating system on their personal computers. Read more