Flaw found in Firefox

From Cnet News

A flaw has been discovered in the popular open-source browser Firefox that could expose sensitive information stored in memory, Secunia has warned.

Firefox versions 1.0.1 and 1.0.2 contain the vulnerability, the security information company said in an advisory on Monday. The flaw stems from an error in the JavaScript engine that can expose arbitrary amounts of heap memory after the end of a JavaScript string. As a result, an exploit may disclose sensitive information in the memory, Secunia said.

"Unlike other browser flaws, this one is not subject to phishing or access to the system. But it can expose sensitive information from other Web sites you visited and the information you entered there," said Thomas Kristensen, Secunia chief technology officer.

While the flaw is only rated as "moderately critical" by Secunia, the rapid adoption of the open-source browser means that many users may be at risk. Prior to the release of version 1.0, downloads of earlier versions of the browser had reached 8 million within the first 18 months.

The Mozilla Foundation, which makes the Firefox browser, is working on a patch, and no cases have been reported, a representative for the group said.

Secunia has developed a test that allows people to see whether their system is affected by the vulnerability.

Test (http://dw.com.com/redir?destUrl=http%3A%2F%2Fsecunia.com%2Fmozilla_p roducts_arbitrary_memory_exposure_test%2F&siteId=3&oId=2100-1029-5655861&ontId=1009&lop=nl.ex)

Oooh, I'm glad I saw this. Someone was just telling me how great Firefox is and I almost downloaded it and switched over.

SG...

I still recommend downloading and switching to Firefox. Firefox is infinately more secure than Internet Explorer. It's also more robust with a plethora of extensions to block ads from the source..add a dictionary at your finger tips, The BugMeNot extension...which lets you get into free sites that require registration...

Trust me...Firefox is better than IE and I try to switch everyone possible over. By using Firefox, I have not had one bit of spyware since I switched over from IE.

~Dan

I should check it out, then.

My new computer came with the McAfee Security Center installed and it seems to do a good job keeping my computer free of bad stuff.

I use IE exclusively right now. Do you think that stuff still gets through with McAfee operating?

I don't necessarily trust McAfee...have read about people using it in the past and they've had spyware and virii get through onto thier system...

McAfree and Symantec (Norton) use to be the big boys on the block. They still are, in a sense. But, there are many alternatives out there that work just as good and work better.

But with McAfee and your system, I would still venture to guess that some stuff is getting through. And since alot of stuff is aimed at Internet Explorer exclusively, all the more reason to switch.

~Dan

Thanks, Dan!