Language Selection

English French German Italian Portuguese Spanish

Spoofing flaw resurfaces in Mozilla browsers

Filed under
Security

A 7-year-old flaw that could let an attacker place malicious content on trusted Web sites has resurfaced in the most recent Firefox browser, Secunia has warned.

The flaw, which also affects some other Mozilla Foundation programs, lies in the way the software handles frames, which are a way of showing Web content in separate parts of the browser window. The applications don't check whether the frames displayed in a single window all originate from the same Web site, Secunia said in an advisory on Monday. Firefox 1.x, Mozilla 1.7.x and Camino 0.x versions are vulnerable to the flaw, the security monitoring company said.

As a result, an attacker could insert content into a frame on a trusted Web site, Secunia said. Account holders who believe they are interacting with a frame belonging to an online bank could be tricked into giving up personal information or downloading malicious code, for example. Secunia rated the issue "moderately critical."

The same "frame injection" vulnerability in Mozilla's browsers was detailed by Secunia in July of last year. At the time, it did not affect the most recent versions of the applications.

For a spoofing attempt to work, a surfer would need to have both the attacker's Web site and a trusted Web site open in different windows. A click on a link on the malicious site would then display the attacker's content in a frame on the trusted Web site, Secunia said. The company advised people not to visit trusted and untrusted Web sites at the same time.

The Mozilla Foundation is investigating the Secunia report, a representative for the organization said.

The vulnerability has not been exploited, a moderator of a support forum on the Mozilla Web site wrote Monday, in response to the Secunia alert.

For protection, the moderator advises people to close all other windows and tabs before accessing a Web site such as a bank or online store that requires them to type in personal data.

With its initial release last fall, Firefox has demonstrated that the mature Web browser market dominated by Microsoft's Internet Explorer can be shaken up. IE has begun to see its market share dip slightly--a first in a number of years.

Source.

Secunia Advisory.

More in Tux Machines

Events: Video Conferences, Code.gov, and LibreOffice

  • How to video conference without people hating you
    What about an integrated headset and microphone? This totally depends on the type. I tend to prefer the full sound of a real microphone but the boom mics on some of these headsets are quite good. If you have awesome heaphones already you can add a modmic to turn them into headsets. I find that even the most budget dedicated headsets sound better than earbud microphones.
  • Learn about the open source efforts of Code.gov at this event
    The U.S. government has a department looking to spread open source projects, and members will be in Baltimore this week. Code.gov is looking to promote reuse of open source code within the government to cut down on duplicating development work, and spread use of the code throughout the country. On April 26 event at Spark Baltimore, team members from Code.gov, the U.S. Department of Transportation and the Presidential Innovation Fellowship are among those invited to be at a meetup to share more. Held from 12-3 p.m., the event will feature talks from the invited guests about what they’re working on and Federal Source Code Policy, as well as how it can apply locally, said organizing team member Melanie Shimano.
  • LibreOffice Conference 2018 Takes Place in Tirana, Albania, for LibreOffice 6.1
    While working on the next major LibreOffice release, The Document Foundation is also prepping for this year's LibreOffice Conference, which will take place this fall in Albania. The LibreOffice Conference is the perfect opportunity for new and existing LibreOffice developers, users, supporters, and translators, as well as members of the Open Source community to meet up, share their knowledge, and plan the new features of the next major LibreOffice release, in this case LibreOffice 6.1, due in mid August 2018. A call for papers was announced over the weekend as The Document Foundation wants you to submit proposals for topics and tracks, along with a short description of yourself for the upcoming LibreOffice Conference 2018 event, which should be filed no later than June 30, 2018. More details can be found here.
  • LibreOffice Conference Call for Paper
    The Document Foundation invites all members and contributors to submit talks, lectures and workshops for this year’s conference in Tirana (Albania). The event is scheduled for late September, from Wednesday 26 to Friday 28. Whether you are a seasoned presenter or have never spoken in public before, if you have something interesting to share about LibreOffice or the Document Liberation Project, we want to hear from you!

GitLab Web IDE

  • GitLab Web IDE Goes GA and Open-Source in GitLab 10.7
    GitLab Web IDE, aimed to simplify the workflow of accepting merge requests, is generally available in GitLab 10.7, along with other features aimed to improve C++ and Go code security and improve Kubernets integration. The GitLab Web IDE was initially released as a beta in GitLab 10.4 Ultimate with the goal of streamlining the workflow to contribute small fixes and to resolve merge requests without requiring the developer to stash their changes and switch to a new branch locally, then back. This could be of particular interest to developers who have a significant number of PRs to review, as well as to developers starting their journey with Git.
  • GitLab open sources its Web IDE
    GitLab has announced its Web IDE is now generally available and open sourced as part of the GitLab 10.7 release. The Web IDE was first introduced in GitLab Ultimate 10.4. It is designed to enable developers to change multiple files, preview Markdown, review changes and commit directly within a browser. “At GitLab, we want everyone to be able to contribute, whether you are working on your first commit and getting familiar with git, or an experienced developer reviewing a stack of changes. Setting up a local development environment, or needing to stash changes and switch branches locally, can add friction to the development process,” Joshua Lambert, senior product manager of monitoring and distribution at GitLab, wrote in a post.

Record Terminal Activity For Ubuntu 16.04 LTS Server

At times system administrators and developers need to use many, complex and lengthy commands in order to perform a critical task. Most of the users will copy those commands and output generated by those respective commands in a text file for review or future reference. Of course, “history” feature of the shell will help you in getting the list of commands used in the past but it won’t help in getting the output generated for those commands. Read
more

Linux Kernel Maintainer Statistics

As part of preparing my last two talks at LCA on the kernel community, “Burning Down the Castle” and “Maintainers Don’t Scale”, I have looked into how the Kernel’s maintainer structure can be measured. One very interesting approach is looking at the pull request flows, for example done in the LWN article “How 4.4’s patches got to the mainline”. Note that in the linux kernel process, pull requests are only used to submit development from entire subsystems, not individual contributions. What I’m trying to work out here isn’t so much the overall patch flow, but focusing on how maintainers work, and how that’s different in different subsystems. Read more