Researcher reports first Firefox 3.0 bug

Researcher sells critical vulnerability in browser to TippingPoint's bug bounty program

Only hours after Mozilla launched the final of Firefox 3.0, a researcher sold a critical vulnerability in the browser to TippingPoint's bug bounty program, the security company acknowledged Wedesday.

The bug has been reported to Mozilla, TippingPoint announced in a post to a company blog. "While Mozilla is working on a fix, we won't be divulging anything else until a patch is available," said TippingPoint, citing policy. "Once the issue is patched, we'll be publishing an advisory."

The Austin, Tex.-based security vendor operates the Zero Day Initiative (ZDI), one of two prominent vulnerability purchasing programs, and regularly buys bugs from independent researchers, then reports the flaws to the appropriate vendor. It's perhaps best known for sponsoring an annual hacking contest, in which researchers try to break into stock Windows, Mac OS X or Linux laptops, at the annual CanSecWest security conference.

TippingPoint released little information about the Firefox bug other than to confirm that it affects the new Firefox 3.0 as well as older 2.0 versions. TippingPoint classified the vulnerability as "critical" and said it could be used to execute remote code. There is one caveat, however, said TippingPoint. "Not unlike most browser-based vulnerabilities that we see these days, user interaction is required, such as clicking on a link in e-mail or visiting a malicious Web page."

The company didn't hint whether the vulnerability was present in all editions of Firefox 3.0, or was specific to one operating system. However, it hinted that a patch might come quickly. "Working with Mozilla on past security issues, we've found them to have a good track record and expect a reasonable turnaround on this issue as well," said TippingPoint.

Mozilla regularly touts its patch speed when it defends its security record. Last January, for instance, Window Snyder, the open-source vendor's chief security executive, rebutted a news report that claimed Firefox was less secure than Microsoft's Internet Explorer by noting that Mozilla patches faster than Microsoft. "At Mozilla we work as hard as we can to ship fixes as soon as possible to minimize the exposure to our users," she said then in a post to the company's security blog.

Mozilla was not available late Wednesday for comment or to answer questions.

Firefox 3.0, released Tuesday, was downloaded more than 8.3 million times in its first 24 hours of availability.

(Read Firefox 3.0 review here).

Join the Good Gear Guide newsletter!

Error: Please check your email address.
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?