Security Vulnerability in Firefox 16

Fred wrote on October 11, 2012 at 2:44 am:

I was automatically upgraded to version 16 without knowing it! This behaviour is totally crap! Normally I wait a few days to update manually to a new version because of these errors which are always contained in new versions.

Put back the power of update in the hands of the users! I consider switching to Opera, which respects the user rights.

Glenn wrote on October 11, 2012 at 3:29 am:

Maybe I’m reading it wrong… but how is this a “security” issue as opposed to a privacy issue? (or did you leave something out of the description–intentionally or otherwise)

Thanks.

1. Danny Moules wrote on October 11, 2012 at 4:02 am:

   Security is being used as a tool to protect your privacy. If your privacy is being jeopardised by a security vulnerability, then it’s a security problem.

   It’s like saying because business data is being stolen it’s a business issue, not a security issue 🙂

   1. Glenn wrote on October 13, 2012 at 9:33 am:

      Circular logic is seldom as convincing as one expects it to be.

2. Granjow wrote on October 11, 2012 at 4:50 am:

   What if a URL contains a password, e.g. ftp://myuser:secretpass@myserver.foo?

   1. j-boo wrote on October 11, 2012 at 7:50 pm:

      pants-pooping time? 😉

Martin wrote on October 11, 2012 at 5:13 am:

Once this is fixed (hopefully soon!), I would really appreciate some more details as the description of the security flaw is indeed quite vague.

What exactly could have happened in the worst-case scenario?

Scouter Scot wrote on October 11, 2012 at 5:39 am:

This is a shame. Not the security violation, but rather Mozilla’s brand of notification. How many millions of users are moms, kids, or NFPs that don’t know or care to know this site or those like it exist? Who notifies them, Mozilla? If a Google+ user hadn’t mentioned it in passing, I never would have known.

1. Chris wrote on October 11, 2012 at 6:08 am:

   If you heard through Google+, then pretty much nobody else will ever hear about it 😉

   1. Ben wrote on October 11, 2012 at 10:48 pm:

      What? Who updates their browser without taking at least a peek at what that update will do? This is the first issue marked as fixed on the info page which is linked to in the update dialog.

Vik wrote on October 11, 2012 at 11:01 am:

Firefox is still one of the most secure browsers out there. I look forward

Melvin Alvarez wrote on October 11, 2012 at 12:20 pm:

¿Complemento G Data CloudSecurity podría ser una solución para corregir esta vulnerabilidad?

Wolfgang D. wrote on October 11, 2012 at 1:58 pm:

Thank you for your lightfast fix. Just installed 16.0.1

StephanieX wrote on October 11, 2012 at 3:23 pm:

Stop complaining. Like business users, wait for a program to become stable before updating.

tlr wrote on October 11, 2012 at 7:08 pm:

captcha not working?

Daniel wrote on October 11, 2012 at 10:44 pm:

Trolling?

Really?

Trolls can fuck themselves. Honestly Mozilla knows their shit… Chrome never has the experience nor the cohesion nor Firefox has.

Firefox is by far the best and most solid web browser on Windows, it’s range on addons and design are far superior than Chrome. Already on 16.0.1

Andy Scott wrote on October 12, 2012 at 12:13 am:

I just checked ‘About Firefox’ to check I was on version 15. I was, but checking automatically triggered the install of 16. No way to stop it. Like j-boo, I’m never using automatic updates again.

Hans wrote on October 12, 2012 at 4:30 am:

Just installed it on Ubuntu 11.04. I noticed that the information from the tag of the first website you load will stay visible during the whole session. It doesn’t update when you surf elsewhere.

tony wrote on October 12, 2012 at 5:54 am:

Will the user agent string for 16.0.1 be fixed soon? Was never updated in the patch and still reads 16.0. Thanks!

1. jh wrote on October 12, 2012 at 7:24 am:

   The UA string was modified in firefox 16 and going forward to remove the patch level of the browser.

   This was done to reduce fingerprinting (how easily a site can uniquely identify a user) and for protection. Non patched browsers dont look different the patched browsers.

   For more information the bug is: https://bugzilla.mozilla.org/show_bug.cgi?id=572659

   1. tony wrote on October 12, 2012 at 8:24 am:

      thanks for the reply, and that’s fine, i wasn’t referring to the Gecko patch level, but shouldn’t the user agent be:

      Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0.1

      Not:
      Mozilla/5.0 (Windows NT 6.1; WOW64; rv:16.0) Gecko/20100101 Firefox/16.0

      That’s how it’s always been up until now. Without the .1 at the end there is no way to distinguish between a vulnerable 16.0 and a patched 16.0.1. How can network admins secure their networks against a vulnerable browser and force people to update to 16.0.1 without also blocking 16.0.1?

      Maybe I’m missing something.

   2. tony wrote on October 12, 2012 at 8:30 am:

      I guess I may have misread your comment at first, it sounds like your are saying this has been done on purpose to avoid a site targeting certain browsers. I find this to be an interesting decision, and one that could hurt in the long run. Interested in seeing this pan out. I’m unfamiliar with how fast Firefox automatically patches, so hopefully these browsers stay updated.

      1. Eurythrace wrote on October 13, 2012 at 4:31 am:

         I find the dropping of the minor version numbers in the UA to be of great relief. As pointed out in jh’s original response, it made fingerprinting website visitors much easier. Your decision to check for this info on your website is exactly WHY it was dropped. It was putting too much user info in the hands of “strangers”. It is up to the individual user to protect themselves, thank you very much. Caveat emptor.

         1. tony wrote on October 15, 2012 at 8:12 am:

            Oh I understand, and I see why this is important from a home user perspective. I don’t own a website, but user agents are used to secure corporate networks by blocking vulnerable browsers. There is now no way to block users from using a vulnerable 16.0 without also blocking 16.0.1. I can see how majority of users are just home users and would benefit from this decision, but there are some downsides as well that affect people.

         2. tony wrote on October 15, 2012 at 8:27 am:

            While I understand why this is true for the average user, this is not why I was concerned. I don’t have a website or wish to track this information. I am just point out that while this is good for the average home user, it is not good for corporate networks that wish to protect themselves against vulnerable browsers. A large network can’t block vulnerable browsers without also so blocking the patched ones. Knowing what version browser people are using can help alert people to patch and update their machines. Even Mozilla’s own website will have trouble knowing whether users are using the most up to date version of their product. There are both upsides and downsides to this decision.

            1. Eurythrace wrote on October 15, 2012 at 11:58 am:

               Tony,

               Yes, a corporate INTRAnet is a totally different environment. If u really want to track potential browser vulnerabilities by version number, perhaps u can make a corporate agreement with Mozilla to retrieve the same info they must be sending when FF checks for updates. Perhaps a small special add-in/extension on the client side would suffice to inform your servers and alleviate your concerns.

               Cheers.

Shailesh wrote on October 12, 2012 at 6:21 am:

Rapid Release gets new features into the hands of end-users faster, and is a necessity to compete with Google. We don’t want to go back to the old days of waiting 6-12 months for a new release, where lots of new features that were ready sooner would have to wait months for the release to see the light of day. Yes, occasionally, some nasty bugs will make it into the release, but that doesn’t seem to be much different from the way it was before. Mozilla needs to think about re-architecting the process security of Firefox the way Google Chrome has done, and then paying bounties for bugs, otherwise, Chrome is just going to pull away over time.

1. The oldie wrote on October 14, 2012 at 10:25 am:

   But they should perhaps be better tested. This release 16 and 16.0.1 has flickering menues running under Wn7 64 bit. I went back to 15… which is ok in this respect, but forgot to turn off auto updates…
   I have seen that this has been a problem for others also in eralier releases.

msth67 wrote on October 12, 2012 at 12:17 pm:

Such information should be publicized more rapidly and more evidently by Mozilla,I too would say than learning it from other web sources and than having to dig around for further enlightenment doesn’t look too good:what about also using Mozillazine to notify such unforeseen issues,and furthermore why not publicize the link to the bug,since at this point probably the folks who shouldn’t know in fact know already?

1. pieroxy wrote on October 15, 2012 at 4:37 am:

   Well, maybe it is just not a big deal since there is no exploit. One can think that an exploit is highly unlikely on a browser released 3 hours ago. And a patch that quickly makes it much more unlikely that an exploit will ever see the light of day.

A pissed off user. wrote on October 12, 2012 at 2:55 pm:

This release of information was handled very poorly.

Next time something like this happens, you should post something on your main page indicating the problems. Be upfront. Do not hide it! That is how you lose TRUST!

I updated to 16.0 when it was released. Went to do a few more machines the next morning and the update was gone, but I could find NO explanation why. Unacceptable.

Should the type of handling in this situation present itself again, FF will be removed from all of my personal machines as well as from our Corporate network and I would be forced to recommend anyone I know that uses the internet, against using this product.

1. Dave wrote on October 12, 2012 at 9:27 pm:

   you should also demand your a refund

   1. John Meloche wrote on October 14, 2012 at 11:38 am:

      lol @ Dave. I agree! The fact he posted “pissed off customer” lol… customers pay money. I say, enjoy the fact you get such an incredible software free. Everyone faces problems. The fact that communication could be improved for the next time something happens doesn’t warrant being jerk in forum.

2. Slightly Sarcastic wrote on October 13, 2012 at 9:20 am:

   Pull your head out and take a deep breath of fresh air.
   Mozilla does not need to explain why they pulled the update, just be glad they did.
   You don’t want to post something like that on your “Front Page” because then you get people working hard to exploit it. That whole “TRUST” thing? Yea, Mozilla pulled the updates, worked on a patch, released a patch a day later. TRUST that they are indeed working hard to keep your browsing sessions as safe as they can.

   Threatening to “pull Mozilla from your personal and corporate machines” is about as whiny as you can get. You want Mozilla to pay you, too ? Put your money on a silver platter and butler it to your front door. ” Here you go sir, we are sorry for the screw up, won’t happen again.”
   Get real, bozo.

   The nerve of some people.

3. gs wrote on October 14, 2012 at 5:41 am:

   You get what you pay for.

   1. gharlane wrote on October 15, 2012 at 11:10 pm:

      atm I’m hard pressed to come up with the name of a browser you do have to pay for….. so your comment and attitude fall a bit flat.

4. ffuser wrote on October 15, 2012 at 8:20 am:

   @A pissed off user:
   When it comes to a mission critical or corporate networked computers:
   1. Never setup auto-update for any application or download / install updates
   2. Never install a newly released application or update the same day unless you are aware of the bug-fix etc. and have a good backup for a quick roll-back.
   3. Read release notes, new features, known issues etc. before applying the update
   4. Download the update and install it form a local source so all your versions are consistent and you have a backup copy of the update

   “Should the type of handling in this situation present itself again, FF will be removed from all of my personal machines as well as from our Corporate network ” – This happens with other applications as well… whats your solution? remove them and switch to another app?

Scott wrote on October 12, 2012 at 10:32 pm:

“As a precaution, users can downgrade to version 15.0.1 by following these instructions [http://www.mozilla.org/firefox/new/]. ”

Of course, when you go to that link, there are no instructions, but rather a link download the faulty 16.0.1. Smooth move.

Another Pissed Off User wrote on October 13, 2012 at 3:37 am:

Who is that firefox mastermind chief programmer?
Hand out Email Adress and Telefone Number!

john o neill wrote on October 13, 2012 at 8:54 am:

hi,
when i right click on a webpage to send a link it is no letting me do this any suggestions or comments please?

1. Jesse Ruderman wrote on October 13, 2012 at 9:40 am:

   You can send a link to the page from the File menu (or Firefox menu on Windows). See https://bugzilla.mozilla.org/show_bug.cgi?id=786185 and https://bugzilla.mozilla.org/show_bug.cgi?id=239307

Mase wrote on October 14, 2012 at 9:45 pm:

I was unlucky enough to have downloaded the update while making an online purchase. Now I am certain my CC has been compromised. Have been tracking certain items on my wish list suddenly they were available for unbelievable prices. It was only AFTER “purchasing” these items that I realized that the browser may have been compromised. So now I am with Aron, I have permanently turned off auto updates and I may never use FF the same way again. Will still use it to browse, but never for anything serious. Thought this kind of thing only was supposed to happen to IE users.

1. Daniel Veditz wrote on October 14, 2012 at 10:01 pm:

   Mase: any troubles you’re having are nothing to do with the security flaw described here.

   1. while you can download updates while browsing, you have to restart Firefox to apply the update. There’s no way anything could change in the middle of a purchase.
   2. the flaw described in this article only leaked the address (http://etc) of the page you were visiting. Your CC number is never in the URL, you enter it into a form and post back to the server.

   Were you “tracking” the items using a wish-list feature of the on-line store? The store obviously knows that information and may be trying to entice you. Were you “tracking” them by repeatedly visiting them on a store site? The store knows that, too (unless you use private browsing and don’t log into your store account), and could be trying to entice you. Nothing to do with this flaw.

   Do you visit http://www.mozilla.org/plugincheck regularly to make sure your 3rd party plugins are up to date? If not, and especially if you have Java installed, then you may well be compromised — but not through Firefox itself. See the next article in this blog, “Click-to-Play Plugins, Blocklist-Style”, for our plans for dealing with that issue.

   1. Mase wrote on October 14, 2012 at 11:22 pm:

      Impact:
      The vulnerability could allow a malicious site to potentially determine which websites users have visited and have access to the URL or URL parameters.

      This is exactly what happened to me. I’ve made dozens of purchases from this very reputable site for years with absolutely zero problems. Then on 10/12, a few items suddenly dropped in price. Not once, not twice but on at least a DOZEN different unrelated items. All from the exact same seller whom I had never previously heard of in my 7-10 years of making purchases. At the time, I could not believe that all these items had suddenly become available and VERY affordable. It seemed almost too good to be true. Thinking it was safe to try I purchased one of the items. Afterward, I noticed my FF browser was acting a little wonky. I logged out of the site and closed the browser like I always do. Still feeling a little suspicious, I ran all my protection software (anti-virus, spyware, anti-trojan, rootkit, etc all in safe mode then again in regular mode). Everything ran with zero detections so I relaxed a bit. It was only after trying to open FF later that I got alerts from my firewall that FIREFOX browser was trying to access something in connection with explorer.exe. Now I am pretty certain after reading the IMPACT provided here that the sites URL may have been accessed since I visit the site and search for items almost every day (but don’t log on). It has all the feelings of a phishing site. But I am no expert. I only know it’s not feeling right. So after running all that software again (for safe keeping), I decided to go back to a previous date before the update. Which brings me to this page. End of story.

      1. Daniel Veditz wrote on October 15, 2012 at 12:56 pm:

         “Now I am pretty certain after reading the IMPACT provided here that the sites URL may have been accessed”

         That’s not how this flaw works. A malicious site can only read the URL you browse in a frame inside that site (which could visually be the whole tab, but the URL at the top would remain the attacking domain) or if the malicious site opens a new window or tab and you then browse in that. It cannot read arbitrary URLs out of your history or from windows unrelated to the malicious site.

         “I got alerts from my firewall that FIREFOX browser was trying to access something in connection with explorer.exe”

         This flaw most definitely can’t do THAT.

         You may have ad-ware installed that’s either too new to be detected or skirts the legitimacy line enough (“informed consent” in the form of a buried opt-out checkbox in an install) that they’re afraid to call it malware because they could get sued.

   2. Mase wrote on October 14, 2012 at 11:27 pm:

      btw, you certainly can update the browser in the middle of a purchase. All you have to do is HELP tab and select ABOUT FIREFOX in the drop down menu. Once you do this FF will search for, download and then INSTALL the update all without closing the window. Then you will have to restart FF for the update to take place.

      1. hillbilleter wrote on October 15, 2012 at 11:05 am:

         Mase, what you have done is NOT to update in the middle of a purchase, by your own description. Your own statement, “Then you will have to restart FF for the update to take place” proves that all you have done is a simple download, not an installation. And the website that is worrying you may have improved its cookie placement procedures and put cookies in your browser to follow your habits. That’s what they do. Amazon comes to mind. After that, when you browse anywhere that allows those cookies to “talk” with a site that allows ads, the ads are trying to sell you things you’ve shown an interest in before. If you want to get ride of your cookies to test it, that may set your mind at ease.

Aunty wrote on October 20, 2012 at 1:24 am:

I’m working on a second hand laptop and I’m not sure how much clear memory it has so I don’t want a stream of updates to clog it up. When I was offered the original version I read the small print and they made it clear it had little bugs so I opted not to update. The old one that everyone went back to was still working fine. If you do take the offer to be the first to try something you have to be prepared to encounter little glitches. You can report these bugs but you can’t really complain – especially if it’s free.

Don wrote on October 20, 2012 at 11:47 am:

I keep getting asked to upgrade immediately. I usually do, but for some reason, this time, read these comments first. Glad I did.

You said “Alternatively, users can wait until our patches are issued and automatically applied to address the vulnerability.”

I’m waiting…

I’m on 15.0.1 and have not updated. Things appear to work fine. Reading the comments, 16.0.1 sounds faulty. When you have these new “patches” ready, can you clearly say that they fix whatever problems are in 16.0.1 and are ok to allow an update on 15.0.1?

I’m not a tech guy, just a user that wants to continue with FireFox.

Dave Steckel wrote on October 21, 2012 at 8:54 pm:

16.01 Thunderbird doesn’t auto remove junk. When you try to check move junk mail to folder, the ok doesn’t work. So you have to manually recheck each junk mail and click not junk then click junk to get rid of it. And 16.01 doesn’t put the junk in the junk folder. If it isn’t fixed soon, do we have to reinstall the last working 15.? load?