File Deletion Flaw In Firefox Fixed

[ManagerJosh]

The Mozilla Foundation's Firefox stand-alone browser, which has been riding a wave of defectors from the security-plagued Internet Explorer, has a bug of its own, the open-source group recently announced.



Firefox suffers from a vulnerability that could allow hackers to delete all the files in the Download directory, which by default in Windows is set to the Desktop. To exploit the flaw, the attacker would have to entice a user to download a file from a Web site.

Users can avoid the issue by canceling unexpected file save prompts as well as any from an untrusted site, said the foundation. Users should also right-click download links, then use the "Save link as" selection in the pop-up menu.

http://www.internetweek.com/breaking...cleID=49400533

[Floris]

Thanks for the update, I will soon get the nightly build and update once more.

[Marco]

Users can avoid the issue by canceling unexpected file save prompts as well as any from an untrusted site, said the foundation.

Well, duh... anyone who doesn't already do that is an idiot.

[Scott MacVicar]

you can do an update.

Tools -> Options -> Advanced -> Software Update -> Check Now

its set to do it every few days automatically but your best to do it now.

[TheMusicMan]

Hmmmm Scott... I have Firefox 0.9.1 and tried to do what you said to download the latest version, but it said no updates available... ??

Do I have a problem?

[Wayne Luke]

You would have to download the full package. 0.9.1 is already obsolete so they most likely will not release an update for it.

[TheMusicMan]

hmm... I thought I had the full package...?

[Dean C]

What I love is that I got this 2 days ago in an auto-update. Thank god firefox implemented this feature. It also shows a little icon just below the minimize button too when updates are available

[Zachery]

Amazing how windows does this too.

[Wayne Luke]

hmm... I thought I had the full package...?

0.9.3 and 1.0PR have been released since you downloaded your version. Auto Updates didn't really work well until 1.0PR though.

[cirisme]

Hmmmm Scott... I have Firefox 0.9.1 and tried to do what you said to download the latest version, but it said no updates available... ??

Do I have a problem?

Yes, download PR1.0(as much as I hate it). The auto-update didn't work in previous versions.

[Mark.B]

What I love is that I got this 2 days ago in an auto-update. Thank god firefox implemented this feature. It also shows a little icon just below the minimize button too when updated are available

Yes, by the time I learned of this security issue the other day, Firefox had already got me to install the update.

It's too clever by half!

[CeleronXT]

Hmmmm Scott... I have Firefox 0.9.1 and tried to do what you said to download the latest version, but it said no updates available... ??

Do I have a problem?

You would have to download the full package. 0.9.1 is already obsolete so they most likely will not release an update for it.

It's really because the autoupdate got a complete overhaul and even, I believe, changed the very method used, between 0.9 and 0.10.