'Highly Critical' Flaw in Firefox 2.0

[Hairbautt]

http://img.photobucket.com/albums/v383/Hairbautt/News%20Images/Firefox.jpgA new security flaw, rated as "highly critical", has been discovered in Firefox 2.0+ by the security firm, Secunia.

The security hole involves a 'special' Uniform Resource Identifier (http://en.wikipedia.org/wiki/Uniform_Resource_Identifier) (URI) handler where, according to Secunia, "Firefox registers the "firefoxurl://" URI handler and allows invoking Firefox with arbitrary command line arguments."

Thor Larholm (http://www.webservicessummit.com/TLarholm.htm)--a computer security expert and a Senior Security Researcher for PivX Solutions, LLC--originally thought Internet Explorer was the culprit, but according to Secunia, "a malicious site visited in Internet Explorer could pass parameters using that URI handler that would be run automatically in Firefox, without any sort of validation."

They recommend that you do not visit any untrusted sites until the problem is resolved.

:source: Source: BetaNews (http://www.betanews.com/article/Highly_Critical_Flaw_in_Firefox_20/1184081542)
:view: Related: Neowin.Net (http://www.neowin.net/index.php?act=view&id=41410)

July 17, 2007
:view: Neowin.Net: Cross-browser Firefox/IE flaw worsens (http://www.neowin.net/index.php?act=view&id=41491)

[4play]

click me (http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html) bottom of the page is the test for this vuln click it then tick the box marked remember what i do etc.... and then press cancel. should now be safe.

[Demigod]

I'm tired of people thinking that if they browse with Firefox, they are automatically invincible to all the viruses and worms that crawl the internet.

Statistically speaking, Opera is the best choice (in terms of speed and security) for Windows-users.

Look here:

http://mywebpages.comcast.net/SupportCD/FirefoxMyths.html

[Hairbautt]

I think Safari claims to be the fastest...and "the world's best browser."

http://www.apple.com/downloads/ (Check right side)

[4play]

yep safari must be the most secure since the first day the windows version is released and flaws were found and 4 of the 6 current flaws (http://secunia.com/product/5289/?task=statistics) are unpatched

opera has a decent enough track record but if you really want security go with lynx (http://lynx.browser.org/) there has only ever been 2 exploits found and they have both been patched. (http://secunia.com/product/5883/?task=statistics)

edit: this story gets better turns out the exploit is also internet explorer related. internet explorer does not perform validation on the input before being passed along to firefox. firefox on its own will throw up warning if you click a nasty link.

[myminpins]

I love my Opera... don't really know why ANYONE uses IE any more... lol

Excellent read!!!!!:)

[lynx]

The reasons why fewer security holes have been found in Opera, Safari and Lynx (copyright theft?) is because there aren't as many people looking. It doesn't mean that the holes aren't there. The same argument used to be trotted about Firefox.

The link is still caught in an IE tab within Firefox (but beware, even if you select cancel, IE still launches the app :O).

In reality, this only a security hole if you have Firefox installed but continue to use IE. Why anyone would want to do that is beyond me.

[Cheese]

In reality, this only a security hole if you have Firefox installed but continue to use IE. Why anyone would want to do that is beyond me.

Sadly I have to at work as one website I have to use in my job does not work on Firefox (it barely works in IE).

[ulun64]

I think Safari claims to be the fastest...and "the world's best browser."

http://www.apple.com/downloads/ (Check right side)

Safari is the best browser in MacOSX but not in windows. It's system hogger in windows.



The reasons why fewer security holes have been found in Opera, Safari and Lynx (copyright theft?) is because there aren't as many people looking. It doesn't mean that the holes aren't there. The same argument used to be trotted about Firefox.

The link is still caught in an IE tab within Firefox (but beware, even if you select cancel, IE still launches the app :O).

In reality, this only a security hole if you have Firefox installed but continue to use IE. Why anyone would want to do that is beyond me.

Opera also have security holes but Opera fixed 100% of all it's security bug problem. Making it's the most secure browsers in Windows atm.

http://operawatch.com/news/2007/01/what-percentage-of-known-security-bugs-in-browsers-are-actually-fixed.html

I'm using Opera most of time. Sometime I used IE cos certain website don't like Opera. I used Firefox before but it's too slow so I abandon it.

[lynx]

Opera also have security holes but Opera fixed 100% of all it's security bug problem. Making it's the most secure browsers in Windows atm.No, you still haven't got it.

Just because there are few people looking for security holes does not mean they don't exist. All the creators of browsers fix the security holes when they are found (eventually), that doesn't make any particular browser more secure than any other.

On the downside, if there are few people looking for security holes then any security holes that exist are more likely to go undiscovered. That makes such browsers potentially the least secure.

I'm not saying that Opera is any better or worse than other browsers, merely pointing out that your assumption does not have a valid basis.