Firefox - Critical Security Vulnerabilities

wolfman

http://www.pcpro.co.uk/news/72452/firefox-clipped-with-critical-vulnerabilities.html

Just so you're aware. Expect an update in the coming weeks.

Relic_2

thanks for this, will be looking out for it

shrek101

I read yesterday that many people that prefered Firefox are going off it, due to all the fixes of late. With the impending IE and as we now have a better version of Opera, Firefox may well have some competition.

I prefer firefox with all the addons, but for some reason it does seem to take on my system at least 40mb of ram when running.

Relic_2

yeah, lately there are more and more holes being discovered in firefox. but i still prefer it, the fact it has tabbed browsing saves me on so much memory anyway, not to mention the fact its faster etc.

But as usual microsoft are going to incorporate all of these features and more in there new IE. so when they get back on top we will see whos best, although out of spite i hope i'd still go for firefox.
we'll i know there are many arguements about this so i wont go on.

wolfman

Firefox is great, but with popularity will come security flaws. One of the main reasons IE is known to be insecure is because it's such a big target (has a large user base). I'm sure there are more security flaws in Firefox, they just haven't been found yet. The great thing with open source though, is that the fixes occur very quickly. The only downside is that anyone can see the code, and hence the weaknesses.

Reading up on IE 7 it does sound very good. It should be fully standard compliant, a lot more secure, redefine tabbed browsing (? dunno how), and be modular... well from what I've read so far.

andy88_2

wolfman wrote:

I'm sure there are more security flaws in Firefox, they just haven't been found yet.

Errrr, apologies but

Between July 1 and Dec. 31, 2004, Symantec documented 13 vulnerabilities affecting Microsoft Internet Explorer. This is notably lower than the 21 vulnerabilities affecting each of the Mozilla browsers that were documented during the same period. Six vulnerabilities were reported in Opera and none in Safari.

which follows this

US-CERT (United States Computer Emergency Readiness Team), a partnership between the Department of Homeland Security and the public and private sectors, impartially tracks all manner of security issues in operating systems and major applications, such as browsers. US-CERT issues a bulletin every week, outlining the current crop of problem areas. You can access all past and current bulletins here; I urge you to take a moment, click on over to their site, open several bulletins at random, and scroll down the page. In most cases in the more recent issues, you'll see the list of IE's vulnerabilities is shorter than those for Firefox, Mozilla, and the other alternate browsers. Likewise, with the more recent bulletins, you'll also see the list of Windows' vulnerabilities is actually much shorter than that for the other operating systems, even though Windows is far more widely installed

http://www.informationweek.com/story/showArticle.jhtml?articleID=160900911&pgno=3

wolfman

andy88, those results are a little dated. In fact most were taken before Firefox v1.0 was even released. And despite the number of flaws, you'll find the severity of the flaws are always much higher in IE. It is an interesting point to raise though as a lot of people seem to think Firefox is secure, or atleast not vulnerable.

Actually, when I said "more", I meant more, not compared with IE, but compared with the 2 flaws in Firefox outlined in the original post, as in more to come. Bad grammar on my behalf.

jam

IMO as others have mentioned the important thing is "critical" flaws, allowing say priv escalation or remote exploits.

andy88_2

Yeah, wolfman, I didn't follow all the links myself yet. Certainly the last year stuff would be Mozilla or FF1.0PR, which I had off a mag disc without realising what PR meant (come to think of it, it was called Firebird for a while earlier; a nicer name cf 'Phoenix from the flames'). I assumed that the CERT stuff would be more up to date, and better understood by you guys, so I didn't look yet - apologies if it isn't quite what you hope.

I'm assuming that the main reason people recommend Firefox over IE is to do with handling DirectX exploits - would that be reasonably accurate?

edit - sorry, I think I meant ActiveX - must have been half asleep

wolfman

Yeah, it's not an integral part of the operating system, nor does it use ActiveX, both of which IE suffers from.

There are also useability aspects, such as tabbed browsing, small to download, it's fully standard compliant etc... why people often prefer it to IE.

I'm waiting for IE 7. Prior to Firefox, Microsoft cut down (moved around) a lot of the browser team, but since have apparently pulled back some of the best coders to work on IE 7. From the rumours and specs I've read it does sound very impressive.

avi_3

hi - How about avant browser? I think it is extremely good. But i am naive about itssecurity flaws