Mozilla fixes Firefox holes, curtails clickjacking

From CNET News.com: Mozilla released two new versions of its browser on Tuesday, Firefox 3.6.9 and Firefox 3.5.12, to close 10 critical security vulnerabilities in each and to help Web site operators block a risk called clickjacking.

Critical vulnerabilities can let a remote attacker run arbitrary code on a computer, and with the browser becoming both more important and more powerful, browser makers must constantly watch for new attack possibilities.

Firefox 3.6 also gets a new general approach to cut down browsing risks: support for what's called the X-Frame-Options HTTP response header. Web site developers can use this technology to block browsers from showing their Web sites inside a frame--essentially a smaller window within the browser window. Putting a legitimate site inside a frame on a malicious site is one approach for attacks called clickjacking, in which the malicious site can capture keystrokes such as usernames and passwords.

For the new versions of Firefox 3.5 and 3.6, nine of the ten critical vulnerabilities are the same, but one problem on 3.5 is minor on 3.6, and one 3.6 problem didn't affect 3.5. In addition, several non-critical security vulnerabilities were patched. Full details are available on the security pages for 3.6.9 and 3.5.12.

Mozilla also is racing to complete this year. It released a fifth Firefox 4 beta on Tuesday, adding support for some hardware acceleration on Windows, among other features.

View: Article @ Source Site