[ insider_reports_insider ]
Security Problems Found With Firefox Extensions
Doug Caverly
Staff Writer
2009-11-20
 Insider Reports RSS Feed
Firefox users should take a moment to reevaluate which of the extensions they use they can do without. Security consultants have determined that some extensions represent security risks insofar as their vulnerabilities can put entire systems in jeopardy.
 | | Security Problems Found With Firefox Extensions |  |
According to a Help Net Security article, Roberto Suggi Liverani and Nick Freeman, who work for Security-Assessment.com, noted at a recent conference that "Mozilla doesn't have a security model for extensions and Firefox fully trusts the code of the extensions."
Furthermore, "There are no security boundaries between extensions and, to make things even worse, an extension can silently modify another extension."
So Firefox users probably shouldn't go around trying interesting-sounding extensions willy-nilly. They may also want to take special care to avoid InfoRSS 1.1.4.2, Sage 1.4.3, and Yoono 6.1.1 (along with all previous versions of each extension), since those were singled out by researchers for being vulnerable.
On the bright side, it looks like Mozilla's aware of problems like this, since Firefox 3.6 is supposed to introduce a lockdown feature for add-ons. And since extensions' vulnerabilities shouldn't give hackers access to lots of people, perhaps they'll be left alone until some permanent fixes are in place.
About the Author:
Doug is a staff writer for SecurityProNews, InternetFinancialNews, SearchNewz, and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|
iEntry 10th Anniversary
RSS
Archive
