UPDATE: Flaw detected in FireFox Browser!!

[Kiran.dks]

Phishers slip through Firefox security net
A flaw in Firefox could allow phishing sites to appear authentic to the user

*ivory.vnunet.com/images/firefox/firefox-logo/medium.jpg

Security researchers claim to have discovered a flaw in Firefox that could allow attackers to disable the browser's anti-phishing filter through a simple change in a site's URL syntax.

SecuriTeam, a security alert site maintained by Beyond Security, said that the trick could allow for pages already in the Firefox registry of known phishing sites to slip past the recognition software and appear authentic to the user.

SecuriTeam credited a report by an independent researcher using the name 'Kanedaaa'.

The researcher discovered that the phishing filter could be disabled when an extra 'forward slash' is entered after the domain suffix (e.g. www.vnunet.com//news).

Firefox normally responds to a known phishing page by alerting users and redirecting them to a search page.

Mozilla, which oversees development and distribution of the open source browser, did not immediately respond to a request for comment from vnunet.com.

News Courtesy: vnunet

 

[anandk]

make that two !
Two flaws found in Firefox

 

[Kiran.dks]

Yes anand! However the First flaw is said to appear in older versions of Firefox, prior to the current 2.0 release, but Beyond Security was unavailable for comment on the matter.

The first flaw lies in Firefox's pop-up blocker feature, according to a SecuriTeam statement on Monday. The browser typically does not allow Web sites to access files that are stored locally, according to the official report, but this URL permission check is superseded when a Firefox user has turned off pop-up windows manually. As a result, an attacker could use this flaw to steal locally stored files and personal information that might be stored in them.

A possible scenario for such an attack would involve the user clicking on a malicious link that would furtively plant a target file equipped with an exploit code on the computer's hard drive. Then it would display a prompt asking the user to allow a pop-up to appear in order to play a video file or download. The attacker-supplied file would then be loaded thanks to the browser flaw, which could give the attacker local file read privileges.

The second flaw is the one which I have posted above. It applies to the latest version too. So firefox users, atleast stay updated to version 2.0 to stay away from first flaw.

 

[Vishal Gupta]

I'm smelling ff 2.0.0.2

 

[nishant_nms]

I'm safe b'cause I am on Opera