Mozilla Firefox 3.0 Vulnerability

[Daniel ~]

Written by Daniel
Friday, 20 June 2008

Mozilla Firefox 3.0 Vulnerability
By Zero Day Initiative
Wed 18 Jun 2008 14:58pm
DVLabs

A number of people who monitor our Zero Day Initiative's Upcoming Advisories page noticed yesterday that we reported a vulnerability to Mozilla (ZDI-CAN-349).

[Frontpage...]

[cloasters]

There's no perfect software. I hope the fix for this is available soon.

[MUff1N]

OK, so "What" is it and how do you avoid it?
Would help if they said what it was...
This is like saying my car is broken...
So with that said he's the info that's needed to avoid a problem before this is patched...

What we can confirm is that about five hours after the official release of Firefox 3.0 on June 17th, our Zero Day Initiative program received a critical vulnerability affecting Firefox 3.0 as well as prior versions of Firefox 2.0.x. We verified the vulnerability in our lab, acquired it from the researcher, then promptly reported the vulnerability to the Mozilla security team shortly after. Successful exploitation of the vulnerability could allow an attacker to execute arbitrary code. Not unlike most browser based vulnerabilities that we see these days, user interaction is required such as clicking on a link in email or visiting a malicious web page.

While Mozilla is working on a fix, we wont be divulging anything else until a patch is available, adhering to our vulnerability disclosure policy. Once the issue is patched, we'll be publishing an advisory here. Working with Mozilla on past security issues, we've found them to have a good track record and expect a reasonable turnaround on this issue as well.