Firefox fix due next week after attack is published

Bug affects Firefox on all operating systems and could be used to install unauthorized software on a victim's system

Online attack code has been released targeting a critical, unpatched flaw in the Firefox browser.

The attack code, written by security researcher Guido Landi was published on several security sites Wednesday, sending Firefox developers scrambling to patch the issue. Until the flaw is patched, this code could be modified by attackers and used to sneak unauthorized software onto a Firefox user's machine.

[ How safe is your browser? Find out in InfoWorld Test Center's guide to browser security | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]

Mozilla developers have already worked out a fix for the vulnerability. It's slated to ship in the upcoming 3.0.8 release of the browser, which developers are now characterizing as a "high-priority firedrill security update," thanks to the attack code. That update is expected sometime early next week.

"We... consider this a critical issue," said Mozilla Director of Security Engineering Lucas Adamski in an email.

The bug affects Firefox on all operating systems, including Mac OS and Linux, according to Mozilla developer notes on the issue.

By tricking a victim into viewing a maliciously coded XML file, an attacker could use this bug to install unauthorized software on a victim's system. This kind of Web-based malware, called a drive-by download, has become increasingly popular in recent years.

While the public release of browser attack code doesn't happen all that often, security researchers don't seem to have much trouble finding bugs in browser software. Last week, two hackers at the CanSecWest security conference dug up four separate bugs in the Firefox, IE, and Safari browsers.

Recommended
Join the discussion
Be the first to comment on this article. Our Commenting Policies