*Firefox and Tor to Patch Critical Zero-day Vulnerability

TechViews.org   …..

The critical Firefox vulnerability being actively exploited in the wild to unmask Tor users has been patched with the release of new browser updates. Both Mozilla and Tor Project has patched the vulnerability that allows attackers to remotely execute malicious code on Windows operating system via memory corruption vulnerability in Firefox web browser.

Tor Browser Bundle is a repackaged version of the open-source Mozilla Firefox browser that runs connections through the Tor anonymizing network configured to hide its user’s public IP address.

However, the exploit code released by an unnamed online user was currently being exploited against Tor Browser users to leak the potentially identifying information of Tor users. “The security flaw responsible for this urgent release is already actively exploited on Windows systems,” an official of the anonymity network wrote in an advisory published on Wednesday.

“Even though there is currently…no similar exploit for OS X or Linux users available, the underlying [Firefox] bug affects those platforms as well. Thus we strongly recommend that all users apply the update to their Tor Browser immediately.”

Soon after the Tor Project released the updated version of its browser, Mozilla also posted a blog post that said the company has also released an updated version of Firefox that patched the underlying vulnerability. The vulnerability, rated critical, also affects Mozilla’s Thunderbird e-mail application and the Firefox Extended Support Release (ESR) version used by the Tor Browser.

The attack code exploiting the underlying vulnerability initially circulated Tuesday on a Tor discussion list by an admin of the SIGAINT privacy-oriented public email service.

“The exploit took advantage of a bug in Firefox to allow the attacker to execute arbitrary code on the targeted system by having the victim load a web page containing malicious JavaScript and SVG code,” said Mozilla security official Daniel Veditz.

“It used this capability to collect the IP and MAC address of the targeted system and report them back to a central server. While the payload of the exploit would only work on Windows, the vulnerability exists on Mac OS and Linux as well.”

Firefox and Tor users are strongly recommended to update their web browsers to the latest Firefox version 50.0.2 and Tor Browser 6.0.7, respectively, as soon as possible. Meanwhile, people using both Tor and mainstream versions of Firefox can set the Firefox security slider to “High” in order to protect themselves from the attack.


Please Subscribe for free on the right panel to receive updates as soon as they are published.

And please comment below, or visit our “Comments and Discussion” page and tell us what you think.

Data Source: http://bit.ly/2gBrDPl


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s