Mozillla flaws put personal data at risk

Details of the nine vulnerabilities were published on Mozilla's security Web site over the weekend.

Ian Latter, senior security consultant at Internet security specialist Pure Hacking, said most of the vulnerabilities stem from the way Mozilla applications handle Javascript.

"There are some permission issues related to running javascript at an escalated privilege level. They remove some of the security measures used to keep javascript sandboxed and allow it to potentially do malicious things to your computer," said Latter.

According to Latter, a potential security issue is that malicious scripts could gain access to random pieces of memory.

"This random memory may or may not contain pieces of information about where you have been browsing. The worst case scenario is that it could contain some personal or login information," said Latter.

According to the French Security Incident Response Team (FrSIRT), attackers can potentially run malicious code on a users' system because of a flaw in the Mozilla browser's pop-up blocker.

The FrSIRT advisory said: "When a popup is blocked the user is given the ability to open that one popup… If the popup URL were javascript: selecting ‘Show javascript:...' from the infobar or popup blocking status bar icon menus would run the javascript with elevated privileges, which could be used to install malicious software".

Another of the Firefox flaws can be exploited when a user visits a Web page that requires a plug-in that has not already been installed. The FrSIRT advisory claims that if the browser's Plugin Finder Service is used to automatically find an appropriate plugin, the ‘manual install' function can be used to "launch arbitrary code capable of stealing local data or installing malicious code".

All versions of Mozilla Suite prior to version 1.7.7 and Firefox versions 1.0.3 and earlier are vulnerable.

Pure Hacking's Latter advises users to either disable Javascript or download a patched version from Mozilla's Web site.

Munir Kotadia of ZDNet Australia reported from Sydney.