# Two New Critical Flaws Found in Firefox



## 40sondacurb (Jan 14, 2005)

May 9, 2005 10:56AM 

"The Mozilla Foundation partially patched this issue on the server side by adding random letters and numbers to the install function, which will prevent this exploit from working," said FrSIRT, which posted the alert on Saturday. 

--------------------------------------------------------------------------------

Complimentary Whitepaper | Right-Channeling: Make Sure your Best Customers get your Best Service - By giving your most valuable customers superior service, you keep them happy—which in turn significantly increases retention and maximizes the value they generate. Learn the secrets to Right-Channeling - Download Today 
--------------------------------------------------------------------------------




A French security testing company has found two holes in the latest version of Firefox that it rates as "critical." 
The vulnerabilities could allow hackers to implant code in a Web page that would create a batch/exe file with a malicious payload such as a Trojan or key-logger on the PC of anyone viewing the site, warned testers at the French Security Incident Response Team (FrSIRT). 

"The Mozilla Foundation partially patched this issue on the server side by adding random letters and numbers to the install function, which will prevent this exploit from working," said FrSIRT, which posted the alert on Saturday. 

FrSIRT rates the flaws as critical and has posted proof-of-concept exploit code on its website. 

The Mozilla Foundation said in a statement: "Mozilla is aggressively working to provide a more comprehensive solution to these potential vulnerabilities and will provide that solution in a forthcoming security update. 

"Users can further protect themselves today by temporarily disabling JavaScript or disabling the 'Allow websites to install software' option in Tools > Options > Web Features." 







© 2005 VNU Business Online Limited (UK). 
© 2005 Top Tech News. 



Just letting every one who doesn't keep track of google news know what's going on with the FF security thing.


----------



## POADB (Jul 28, 2004)

I recieved an Update from FF the other day - perhaps the two are the same?? perhaps not..

Well as long as TSF doesn't run these expliots.. i should be ok :grin:


----------

