Zero-Day Firefox Vulnerability Exploited to Distribute Trojan

[malexous]

Security researchers from Norman have come accross a drive-by download attack exploiting an unpatched Firefox vulnerability in order to infect users with a new trojan.
...

Zero-Day Firefox Vulnerability Exploited to Distribute Trojan - Softpedia

 

[Corrine]

Also of interest is Graham Cluley's blog, recommending NoScript:

Mozilla says it is working on a fix, but in the meantime Firefox users might be wise to turn JavaScript off and use the popular NoScript addon.

NoScript is a great idea - I'd never use Firefox without it, and neither should you.

Firefox hit by critical zero-day vulnerability

 

[Fayla]

No script is great

I run my Firefox on a standard user with UAC visualization and DEP enabled on it, along with no script, adblock etc etc.

Also of interest is Graham Cluley's blog, recommending NoScript:

Mozilla says it is working on a fix, but in the meantime Firefox users might be wise to turn JavaScript off and use the popular NoScript addon.

NoScript is a great idea - I'd never use Firefox without it, and neither should you.

Firefox hit by critical zero-day vulnerability

Thanks for the info OP

 

[malexous]

Firefox 3.6.12 Fixes Critical Security Vulnerability

Now that was fast. The Firefox developers have updated the web browser only a day after the discovery of a 0-day vulnerability on the Nobel Prize website targeting Firefox 3.6 Windows installations. The critical vulnerability affected all Firefox 3.6 and 3.5 releases, and allowed the attacker to compromise a system without user interaction or warning messages.

The new versions of the browser are currently distributed to the release servers. It usually takes a couple of hours before the releases are pushed to the users who will receive an update notification once the new version becomes officially available.
...

 

[EchoX860]

So as long as I didn't go to that site I'm fine?

 

[dobhar]

Cheers for this info...

 

[CarlTR6]

Security researchers from Norman have come accross a drive-by download attack exploiting an unpatched Firefox vulnerability in order to infect users with a new trojan.
...

Zero-Day Firefox Vulnerability Exploited to Distribute Trojan - Softpedia

Good information and this is a good thread. Thanks.

 

[Corrine]

So as long as I didn't go to that site I'm fine?

It was believed that other sites could also be compromised. However, since the update has been released by Mozilla, if it hasn't been offered, click Help > Check for Updates NOW. If you don't have NoScript installed, I advise considering it. NoScript - JavaScript/Java/Flash blocker for a safer Firefox experience! - what is it? - InformAction

 

[SledgeDG]

Just got the update request to 3.6.12 some 20 mins ago...used chrome in the meantime

With NoScript...the only thing that really bothered me, was that with every of the frequent updates, I was redirected to their page and that kept messing with my tabs.

Solution: in the URL bar enter about:config
search for a key named noscript.firstRunRedirection (if it's not there, create it)
and set it to false



-DG

 

[Phone Man]

It seams it also affects Thunderbird. MFSA 2010-73: Heap buffer overflow mixing document.write and DOM insertion Jim

 

[EchoX860]

So I should download this addon? My addons usually involve:

Chromifox Theme Extreme
Adblock Plus
Echofon
GameFox
Linkification
Download Statusbar
Foxytunes

 

[SledgeDG]

I run NoScript ever since I discovered it and haven't regret it one single bit.
Of course occasionally I coma across a webpage that relies heavily on Javascript . In that case you can right-click the "S" icon in the bottom bar and allow JS for certain pages either permanent or on a session base.
It's a nice addition and even stops some ads, Adblock Plus can't/doesn't.

-DG

 

[CarlTR6]

I run NoScript ever since I discovered it and haven't regret it one single bit.
Of course occasionally I coma across a webpage that relies heavily on Javascript . In that case you can right-click the "S" icon in the bottom bar and allow JS for certain pages either permanent or on a session base.
It's a nice addition and even stops some ads, Adblock Plus can't/doesn't.

-DG

Ditto and I agree. NoScript is one of the reasons I stick with Firefox. I updated my FF this morning.