Firefox Bugged Again
Spanish Security firm Secunia, has found a seven year old flaw - 'frame injection' vulnerability, in Mozilla's Firefox browser which allows attackers to place malicious content on trusted websites.
The warning reveals a flaw in the way the browser handles frames. The application does not verify if a page, displayed in different frames on a particular website originates from the same site. This flaw could be used by a hacker to insert malicious content in one of the frames of a trusted website.
The security company pointed out that Firefox 1.x, Mozilla 1.7.x and Camino 0.x versions of the application were vulnerable to the flaw and has rated it as 'moderately critical'.
According to a posting by a 'user support moderator' on the Mozilla's online forum, a user viewing a trusted site on one window and has open on another window a malicious website that attacks this vulnerability, can enable the attacker to steal his/her information.
To ensure protection, the moderator advices users to close all windows or tabs before accessing sites where the user might need to enter a secure password, bank or credit card details, or any other sensitive data.
The warning reveals a flaw in the way the browser handles frames. The application does not verify if a page, displayed in different frames on a particular website originates from the same site. This flaw could be used by a hacker to insert malicious content in one of the frames of a trusted website.
The security company pointed out that Firefox 1.x, Mozilla 1.7.x and Camino 0.x versions of the application were vulnerable to the flaw and has rated it as 'moderately critical'.
According to a posting by a 'user support moderator' on the Mozilla's online forum, a user viewing a trusted site on one window and has open on another window a malicious website that attacks this vulnerability, can enable the attacker to steal his/her information.
To ensure protection, the moderator advices users to close all windows or tabs before accessing sites where the user might need to enter a secure password, bank or credit card details, or any other sensitive data.
Comments