Browser open to URL spoofing
vnunet.com, 07 Jan 2005
A security flaw in the increasingly popular Firefox browser is exposing millions of users to phishing scams, security experts have warned.
Jakob Balle, security specialist at Secunia Research, said that the vulnerability in Firefox and Mozilla allows malicious hackers to execute phishing scams by spoofing the source URL displayed in the browser's Download Dialog box.
"The problem is that long sub-domains and paths are not displayed correctly, which can be exploited to obfuscate what is being displayed in the source field of the Download Dialog box," he said.
A Secunia Research advisory stated that the "less critical" vulnerability has been confirmed in Mozilla 1.7.3 for Linux, Mozilla 1.7.5 for Windows, and Mozilla Firefox 1.0. It added that "other versions may also be affected".
"Currently, no solution is available. However, the vendor reports that this vulnerability will be fixed in upcoming versions of the affected products," Secunia stated.
Balle urged users not to follow download links from untrusted sources.
Security update fixes spoofing and arbitrary code execution, says Mozilla
Security firm warns of phishing risk with Firefox, Opera and others
Developer denies delay linked to move to Google
Have you got a burning desire to quiz experts from...
Figleaves founder argues platform-as-a-service vendor will emerge to shake up...
Do you agree?
Have your say on this article