Printable View
Just thought I would drop you guys a heads up. Apearantly your keystrokes can be seen with a simple exploit in FireFox. Here is a site that has a test so you can go there and see your own keystokes being exploited. I went there and it works, my keystrokes that I used previously were revealed. Passwords are not secure in Firefox until they patch this.
Secunity Link With Test For FireFox!!
Still waiting for Mozilla to come up with a patch... :(
Firefox 1.0.3 final will be out as soon as testing is completed. See:
http://www.mozillazine.org/talkback.html?article=6348
Fifth Set of Mozilla Firefox 1.0.3 Release Candidates
Quote:
As many people have asked, we would like to inform readers that the JavaScript engine memory heap disclosure bug will be fixed in Firefox 1.0.3. There will also be a Mozilla 1.7.7 update and possibly a Camino 0.8.4 release to fix this vulnerability in other Mozilla products.
mine showed all x's
frebo. What browser did you use? I tried my Firefox and I could see some text and other codes.
maxthon browser
Ok, thanks. This is a worrisome problem for people using FireFox. Today when I checked my banking site I switched to IE. Didn't want to take a chance with FF. As Firefox becomes more popular we are going to see the malware writing scumbags trying to take advantage of any flaw they can find. This could be a major problem for the Mozilla foundation. They can't turn out the patches as fast as Microsoft.
Opera is all clear :). Ran FF and each time you click the link some more info is shown. Looks like FF is on the shelf for a while for me.
jmtjet why dont you give maxthon a try it is almost like ie without the problems
Frebo, yes I have it installed, but thought it be as vulnerable as IE since it's built on the IE engine so I haven't used it much. I'm using Opera right now. What's your experience with Maxthon. Any problems or security concerns?
Should we avoid using Firefox for banking etc.. until this is fixed?
I would say yes.
Thanks Crunchie, I'll revert to IE for the timebeing then.
Just turn off Javascript support until the patch is released.
Click Tools > Options > Web Features and remove the check mark in Enable Javascript.
The "patch" is actually a new Firefox browser release. Testing isn't completed yet but, if anyone is interested, download links to the Firefox 1.0.3 candidate builds and more information can be found on Mozilla staff member Asa Dotzler's weblog:
http://weblogs.mozillazine.org/asa/
Update for FF is now available. http://mozilla.org/products/firefox
just installed Firefox 1.0.3 and ran the test. Nothing but xxxxxxxxxxxxxxxxxx.
Oh, it's out now (v.1.0.3) - just click on your "Tools/Options/Advanced/Software Update/Check now" stuff and get it. Pete
Installed version 1.03, all seems to be okay, but when I try the test at:
http://secunia.com/mozilla_products_...exposure_test/
nothing happens, I get no response at all. Why is this? :confused:
poppy
Poppy - Did you turn off Javascript support in FF? I got all "XXXX"'s here. Pete
Hey Pete....
with Javascript support off or on, I still get 'no-response' at all when I click the link for the test from secunia???.......maybe I'll re-install and see if that makes a diff....btw...can I just re-install over the present installation?
poppy
I re-installed....and still no response from the test link....whether Java and Java Script are enabled or disabled....makes no difference......so far all else in 1.03 works okay.....
EDIT:.....checked the MozzilaZine forums and there are a ton of posts (7+pages) on 1.03 glitches.....so I consider myself lucky with only one glitch :rolleyes:
poppy
Yippeee. Got the update and all is well again. Thank you Mozilla. :)
Depending on which PC I've tested, the Javascript memory exploit test shows as either blank or X's. FWIW, I really don't care which I get as long as the exploit no longer get through... :)
Also, I have relying on the FF zipped versions for almost a year. But 1.02 and 1.03 are only installer based. So, reluctantly, I've made the switch. So far, no issues there (thank goodness!)