also @ TechSpot: iOS 5.1.1 untethered jailbreak tool released, supports 4S, iPad 3

Critical Firefox 3.5 bug discovered

By

On July 15, 2009, 9:27 AM EST

US-CERT posted a warning yesterday, of a critical vulnerability affecting the recently launched Firefox 3.5. The bug is due to an error in the way JavaScript code is processed. By exploiting this anomaly, an attacker may be able to execute arbitrary code. Furthermore, exploit code is publicly available for this vulnerability.

Mozilla is aware of and has publicly acknowledged the issue on their blog. They say that the bug can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code. Mozilla is working to fix the issue and a security update will be sent out when it’s ready.

For the time being, to mitigate the bug simply disable the Just-in-time (JIT) JavaScript engine. To accomplish this: Enter “about:config” in the address bar, type “jit” in the filter bar up top, and double-click the line containing “javascript.options.jit.content”, which should then have a value of “false”.

If that sounds a bit too troublesome, you can simply run Firefox in Safe Mode or even install an add-on like NoScript. Naturally, as soon as the fix is released, you can reverse any remedy.

Related Stories

No tags on this story

User Comments (27)

Post a comment
captaincranky
on July 26, 2009
11:51 PM

I'm not exactly certain of the absolute difference in specific function between No Script and the Windows hosts file. I'm also not sure of the difference between the function of "Combo Fix" and the Hosts file either. Just thought I'd throw that in there. SpyBot SD16 also places a massive amount of entries into the hosts file. I may be showing my ignorance here, but I thought the hosts file was to prevent hostile redirects.

No Script stops pretty much ALL cross site scripting. I don't know if you use this extension but, if you don't, why not install it for a bit of a trial. It creates a button to approve or deny, all scripts running on a page. If you have trouble a a specific site you can approve all scripts on a page. I still turn then on one at a time until I get all of what I want, and none of what I don't.

Why not give it a shot, if you don't already use it? A picture is worth a thousand words, at least so they say. If you don't like it, take it back out! It won't do any damage, and it's easy to get rid of.

If the extension only got rid of those stinking Vibrance roll-overs that turn a page into a veritable mine field, wouldn't that be enough?

Reply

strategic
on July 27, 2009
5:54 AM

No Script stops pretty much ALL cross site scripting. I don't know if you use this extension but, if you don't, why not install it for a bit of a trial.

Actually, since you were the one to recommend it, I already have instaled it on my desktop PC lastnight, and have now just installed it on my notebook.

So far, I like it, it may have slowed it down a bit,

but it's much nicer surfing now. Thanks!

I haven't played with it yet,I'm in the learning stage, but the HOSTS file can be manipulated to block malicious sites or ad servers. You list the name of the Web site you want to block. With it is listed the IP number 127.0.0.1. That is the number of your computer. Doing this has the effect of short-circuiting the request. The request just dies.

Reply

Browse more commented news

Post a new comment

Guest user

To post as an anonymous
user click here
.

Members

If you are a TechSpot member,
please login first.


By signing up you gain complete access to the TechSpot community. Join thousands of computer and technology enthusiasts that contribute and share knowledge in our forum. Post messages, get a private inbox, upload your own photo gallery and more.

Subscribe to TechSpot

Get free exclusive content, learn about new features and tech breaking news.