Firefox open to exploit code attacks

Two vulnerabilities in the popular Firefox browser have been rated "extremely critical" because exploit code is now available to take advantage of them.

The cross-site scripting and remote system access flaws were discovered in Firefox version 1.0.3, but other versions may also be affected, said security company Secunia, which issued the ratings at the weekend.

The two vulnerabilities, when combined, can be exploited, but no known cases have yet emerged where an attacker took advantage of the public exploit code.

One flaw involves "IFRAME" JavaScript URLs, which are not properly protected from being executed in the context of another URL in the history list.

Thomas Kristensen, Secunia's chief technology officer, said: "If you visit a malicious website, it can steal cookie information from other websites you have previously visited." The attacker could then use that information to engage in identity theft or gain access to other password-protected sites that the victim visited.

A second vulnerability exists in the IconURL parameter in InstallTrigger.install(). Information passed to this parameter is not properly verified before it's used, allowing an attacker to gain user privileges. This flaw could allow an attacker to gain and escalate user privileges on a system.

People who want new extensions or themes need to go to the Mozilla update service. These extensions and themes will need to be manually installed.

Since the vulnerabilities were discovered, the Mozilla Foundation, which owns Firefox, has taken preventive measures.

Mozilla has changed its update web service and advises people to temporarily disable JavaScript.

However, people who download and install the Mozilla software from third-party sites are still at risk, Kristensen said.

"The threat still exists but is less critical now," he noted. "People can go to third-party sites to install the software, but it's not going to happen on as wide a scale as it had with the Mozilla sites."

Dawn Kawamoto writes for CNET News.com