Risk

10/11/2012
11:06 AM
50%
50%

Mozilla Suspends Firefox 16 Downloads: Serious Bug

Mozilla warns that Firefox 16 contains significant vulnerability, plans to offer patched version for download as soon as possible.

Just one day after releasing Firefox 16, Mozilla Wednesday suspended downloads of the new software after it discovered a security vulnerability in the browser.

In a security warning, Firefox director of security assurance Michael Coates, said that "the vulnerability could allow a malicious site to potentially determine which websites users have visited and have access to the URL or URL parameters." But he said that Mozilla had seen no evidence that the bug was being exploited by in-the-wild attacks.

Even so, "Firefox 16 has been temporarily removed from the current installer page and users will automatically be upgraded to the new version as soon as it becomes available," said Coates. Furthermore, he noted that "as a precaution, users can downgrade to version 15.0.1," though he said that any current version 16 installations would be automatically updated after the patch gets issued.

Mozilla plans to issue a patched version of Firefox 16 Thursday.

[ Security threats are growing. Read Web API Allows Phishing Attack. ]

In the interim, however, is downgrading to Firefox 15.1 wise? According to vulnerability information provider Secunia, Firefox 15.x contains numerous "highly critical" vulnerabilities that could allow an attacker to remotely bypass the browser's security controls, execute a cross-site scripting attack, spoof websites, crash the browser, or access a user's system. All told, it said there are 23 issues, which remain--as yet--unpatched in version 15, though Mozilla reported fixing 14 known vulnerabilities in version 16.

According to market watcher Net Applications, as of September 2012, Firefox controlled 20% of the desktop browser market, putting it behind Internet Explorer (54%), but ahead of other rivals, including Chrome (19%), Safari (5%), and Opera (2%).

In other security-related browser news, the Electronic Frontier Foundation (EFF) Monday, together with the Tor Project, announced the release of HTTPS Everywhere version 3.

The privacy tool, which is a browser add-on, forces an encrypted HTTPS connection on any website that offers users a choice between HTTP and HTTPS. "Many sites on the Web offer some limited support for encryption over HTTPS, but make it difficult to use," according to the HTTPS Everywhere download page. "For instance, they may default to unencrypted HTTP, or fill encrypted pages with links that go back to the unencrypted site. The HTTPS Everywhere extension fixes these problems by using a clever technology to rewrite requests to these sites to HTTPS."

Despite the branding, however, the tool won't work everywhere, although it does now work with 1,500 sites--or about twice as many as with the previous version--and gets used by about 2.5 million people. "Our current estimate is that HTTPS Everywhere 3 should encrypt at least a hundred billion page views in the next year, and trillions of individual HTTP requests," said EFF technology projects director Peter Eckersley in a blog post.

So far, stable versions of HTTPS Everywhere have only been available for Firefox. But the EFF and Tor, together with a group of volunteers, are developing a version for Chrome and Chromium, though it's not yet ready for public release.

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Verdumont Monte
50%
50%
Verdumont Monte,
User Rank: Apprentice
10/11/2012 | 8:28:51 PM
re: Mozilla Suspends Firefox 16 Downloads: Serious Bug
This bug has been fixed already. Please post an update to the article..
Mathew
50%
50%
Mathew,
User Rank: Apprentice
10/12/2012 | 10:28:29 AM
re: Mozilla Suspends Firefox 16 Downloads: Serious Bug
UPDATE
Mozilla pushed an update for Firefox (16.0.1) at 3pm ET Thursday. This Mozilla security bulletin has more details.
Printers: The Weak Link in Enterprise Security
Kelly Sheridan, Associate Editor, Dark Reading,  10/16/2017
20 Questions to Ask Yourself before Giving a Security Conference Talk
Joshua Goldfarb, Co-founder & Chief Product Officer, IDDRA,  10/16/2017
Why Security Leaders Can't Afford to Be Just 'Left-Brained'
Bill Bradley, SVP, Cyber Engineering and Technical Services, CenturyLink,  10/17/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.