FireFox Loses its Sheen
By Robert Lemos, SecurityFocus
Published Friday 13th May 2005 10:37 GMT
The Mozilla Foundation's Firefox web browser has made security a major part of its marketing, but a spate of vulnerabilities found over the last nine months had sullied that message.
In the latest incident, a 16-year-old security researcher - who asked only to be identified by his first name, Paul - found three vulnerabilities in the Firefox browser that together could be exploited to run arbitrary code. The incident is the latest black eye for the open-source software project's security image. While vulnerability researchers frequently flogged Microsoft for the number of security holes found in its Internet Explorer browser, now flaw finders are pinpointing more security holes in Firefox and, in many cases, using the same techniques.
"Much of what we learned security-wise from Internet Explorer is being applied to Firefox to find vulnerabilities," said Paul in an email interview. For example, Internet Explorer had its own Javascript flaw that allowed one page to execute scripts by navigating to another page that had higher privileges, he said. "That is one of the vulnerabilities used in this exploit."
The Mozilla Foundation changed its update server last week to prevent the exploit from working in the browser's default configuration, and on Thursday, the project released version 1.0.4 - a more permanent fix for the hole, said Chris Hofmann, director of engineering for the Mozilla Foundation.
"That was the main reason for this update," he said. "Though, as far as we know, this has not been actively exploited on the Web."
The security issues come as Firefox has rewritten the Cinderella story for the browser market by succeeding in gaining market share against the juggernaut of Microsoft's Internet Explorer.
Last month, the Firefox campaign announced that more than 50 million people had downloaded the browser. Almost seven per cent of visitors to major websites use the Firefox browser, an increase of more than a percentage point over two months, analysis firm WebSideStory announced on Tuesday.
However, the open-source software browser's security story has had to deal with some hiccups.
For the last six months of 2004, researchers found more vulnerabilities in Mozilla's Firefox than Microsoft's Internet Explorer, according to Symantec's bi-annual Internet Security Threat Report. The report tallied 21 vulnerabilities for Mozilla Firefox versus 13 for Internet Explorer. However, a smaller percentage of the vulnerabilities found in Firefox were considered a severe security threat, said Symantec's Oliver Friedrichs, senior manager with the company's security response team.
"Severe vulnerabilities in general allow for drive-by installs," he said. "So just by visiting a website, you could have [anything from] spyware to malware to Trojan horses installed on your system."
Friedrichs stressed that the number of vulnerabilities found by researchers is not necessarily a good indication of product security. He pointed to the Mozilla Firefox's relatively young age, the browser's increasing popularity, and commercial software vendors tendency to silently fix vulnerabilities as factors that could affect the vulnerability count.
Microsoft, for example, changed more than 50 features of Internet Explorer in its major security update, known as Service Pack 2, which the company released last August. In total, the software giant changed more than 428 features in Windows XP, including eliminating two classes of vulnerabilities on which the company has yet to provide details.
Those changes have made Internet Explorer a tougher target for vulnerability researchers, said one flaw finder.
"The assumption that Internet Explorer is easier to exploit is a common misconception," Paul said. "Internet Explorer has become quite tough, and it is very difficult to find vulnerabilities in it."
Microsoft did not immediately comment for this article, but tackled the issue on the company's Internet Explorer developer's blog.
"Security is an industry-wide problem," wrote one Microsoft developer. "It's not limited or unique to operating systems or applications, or client or server software. It's not limited or unique to commercial software or open source."
Whether the Mozilla Foundation will find that its original development focus on security will mean fewer security updates remains to be seen. However, their is no question that the project has its work cut out for it, said Mozilla's Hoffman.
"There is definitely engineering work to do," he said. "We work towards integrating security -- that's a critical part of our mission and what we want to accomplish with the browser and engage people that can help us secure the application and help us build a better browser."
Copyright © 2004,*www.theregister.co.uk/media/1051.gif
