Tales from the Techside

Update for Firefox address security issues and memory leaks

Firefox 1.5.0.1 has been officially released, if you are currently using Firefox then you have two choices on how you update.

1. Wait for it to happen Firefox has begun notifying users through automatic updates
2. Click Help > Check for Updates

Several security issues are addressed and users are highly recommended to get the updates as soon as possible. Keep in mind though if you have any extensions the upgrade might cause them not to work and therefor you should evaluate your needs prior to upgrade. If however these extensions are not absolutely critical I highly recommend you update now. If your reading this blog and are using Internet Explorer and want to give Firefox a try click this link:

http://www.getfirefox.com

I prefer the Firefox browser both from a security standpoint and usability one but understand it is not for everyone so I won't rail on you that you should change.

Google Safe Browsing Extension for Firefox

Google has released a browser extension for Firefox to help combat phishing, using sophisticated algorithms in addition to accessing an extensive database of malicious site this tool will automatically alert users if they stumble onto a possibly malicious website attempting to gather personal information. This extension is free and in my testing very easy to use, being that it is from Google I can safely assume it will be well maintained. Bottom line if your using Firefox I would suggest you give it a try.

Link: Google Safe Browsing for Firefox.

New Exploit Effects Older Version of Mozilla Firefox

Firefox users who are using version 1.0.4 and earlier of Firefox need to upgrade as soon as possible. This past week an exploit that allows malicious users to sieze control of the older versions of Mozilla Firefox was discovered.

This flaw is similiar to the recently announced IE exploit that allowed a malicious website to install and run malicious scripts with the users consent. While this is to the best of my knowledge the first such exploit to be discovered and widely published for Firefox I am sure it will not be the last.

Users who remain up to date through vigilant patching will continue to remain secure while Users who don't are only as secure as Firefox is obscure. As Firefox becomes more widely used expect more exploits to be discovered. Therefore as users it becomes our responsibility to make sure our software is up to date. So if you are running Firefox take a moment and make sure you are using at least version 1.0.5 or greater and if you aren't go to the Mozilla website and update your browser.

To check if your version of Firefox Needs to be Updated:

1. From the Tools menu, select Options….

2. Click the Advanced icon on the left side of the Options dialog

3. Scroll down to the Software Update section

4. Click on the Check Now button to manually check for updates

Link: http://www.mozilla.org/security/announce/mfsa2005-50.html

Long titles cause Firefox to slow

Firefox has a documented issue with web pages with an super long title of approximately 2.5 million characters or greater to cause Firefox to slowdown dramatically on startup. A few people have speculated that this is the first documented case of a Denial of Service exploit for Firefox http://news.zdnet.co.uk/internet/security/0,39020375,39241033,00.htm, http://news.com.com/Unpatched+Firefox+1.5+exploit+made+public/2100-1002_3-5987401.html.

While it does cause Firefox to slow down this does not adversely effect Firefox in any other way. If your browser is effected by this issue then simply follow the instructions below to fix it.

Deleting the item from history

1. Open History from the Go menu

2. Select the item with the long title

3. Press the delete button

Clearing all history data

• In Firefox 1.5
  1. Select "Clear Private Data" from the Tools menu

  2. Check the "Browsing History" box and press the "Clear Private Data Now" button

• In Firefox 1.0 (also works in 1.5)
  1. Select "Options" from the "Tools" menu

  2. On the "Privacy" tab select "History"

  3. Press the Clear button in the History section

Click the following link to read the Mozilla Foundation's response to this issue.

Link: Long-title temporary startup unresponsiveness.