Dropsafe

by Alec Muffett

Major vulnerability in FireFox on Windows (more?)

If you use Firefox, especially on windows, read this!

If you fail to take protective measures you could stumble across a webpage which toasts your system.

Geoff wrote me:

Not sure about Linux and OS X – assume the worst.

See http://www.kb.cert.org/vuls/id/783400

For now, consider using another browser. But if you have to use FireFox…

The CERT advisory suggests that you configure FireFox to generate a warning dialog whenever it encounters one of the URLs involved in the exploit.

To do this, start FireFox, enter the URL “about:config”, scroll down, and for each of the following entries make sure it is set to “true”.

If it isn’t, right-click the line and choose “Toggle”, which will set the value to “true”

network.protocol-handler.warn-external-default
network.protocol-handler.warn-external.mailto
network.protocol-handler.warn-external.news
network.protocol-handler.warn-external.nntp
network.protocol-handler.warn-external.snews

This will at least give you a warning that Firefox is being asked to do something suspicious; you will have to judge for yourself whether it is nasty.

⊞

Comments

5 responses to “Major vulnerability in FireFox on Windows (more?)”

  1. Samizdata.net

    Major vulnerability in FireFox on Windows…

    A public service warning! You surf the internet at random using FireFox (which generally you should), you may stumble across a website, which could infest your machine with a virus. But this is nothing new, I have heard about these evil websites full o…

    Reply
  2. Glenn

    source codebase looks like it’s fixed (patch). But not sure when a release will be out??

    Reply
  3. Brian Utterback

    The advisory explicitly states that only the Windows version is vulnerable. That having been said, I’m enabling the warnings anyway.

    Reply
  4. within the crainium

    Firefox vulnerabilitiy…

    If you’re a Firefox user, here’s something you might want to know about. Major vulnerability in FireFox on Windows (more?) If you use Firefox, especially on windows, read this! If you fail to take protective measures you could stumble across……

    Reply
  5. David Shaw

    IT’s fixed now, my version just updated itself with patch 2.0.0.6 which has the fix in it

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts