Only hours after Mozilla launched the final of Firefox 3.0, a researcher sold a critical vulnerability in the browser to TippingPoint’s bug bounty program, the security company acknowledged Wednesday.
However, on Thursday, Mozilla downplayed the threat, telling users that the risk is “minimal.”
“There is no public exploit, the details are private, and so the risk to users is minimal,” Window Snyder, Mozilla’s chief security officer, said in an entry to a company blog.
The bug has been reported to Mozilla, TippingPoint announced in a post to a company blog. “While Mozilla is working on a fix, we won’t be divulging anything else until a patch is available,” said TippingPoint, citing policy. “Once the issue is patched, we’ll be publishing an advisory.”
The Austin, Tex.-based security vendor operates the Zero Day Initiative (ZDI), one of two prominent vulnerability purchasing programs, and regularly buys bugs from independent researchers, then reports the flaws to the appropriate vendor. It’s perhaps best known for sponsoring an annual hacking contest, in which researchers try to break into stock Windows, Mac OS X or Linux laptops, at the annual CanSecWest security conference.
As per its policy, TippingPoint said it would not release details of the bug until Mozilla has crafted a patch. Wednesday, however, it did note that the vulnerability would let hackers execute remote code—making the bug a critical flaw—and that it would require some action by the potential victim, such as clicking on a link in an e-mail message or visiting a malicious or compromised site.
Thursday, Terri Forslof, TippingPoint’s manager of security response, expanded somewhat on the vulnerability’s range. “It’s not operating system specific,” she said. “It’s browser specific, only on Firefox, but on Windows, Mac and Linux.”
Snyder confirmed that Mozilla had received word from TippingPoint—Forslof said she had e-mailed Snyder directly with a heads-up—and that her team was looking into the problem. “To protect our users, the details of the issue will remain closed until a patch is made available,” she said.
Wednesday, TippingPoint sounded confident that Mozilla would quickly fix the flaw. “Working with Mozilla on past security issues, we’ve found them to have a good track record and expect a reasonable turnaround on this issue as well,” TippingPoint noted in a its blog posting.
Mozilla regularly touts its patch speed when it defends its security record. Last January, for instance, Window Snyder, the open-source vendor’s chief security executive, rebutted a news report that claimed Firefox was less secure than Microsoft’s Internet Explorer by noting that Mozilla patches faster than Microsoft. “At Mozilla we work as hard as we can to ship fixes as soon as possible to minimize the exposure to our users,” she said then in a post to the company’s security blog.
Although Mozilla provided no additional information nor did it offer recommendations for users, TippingPoint’s Forslof was willing to do so. “This is in the same line as lots of other browser vulnerabilities,” she said, “so the advice is in the same line, too. Don’t click on links in e-mail, make sure the operating system is up-to-date, and don’t visit unsafe sites.”
Forslof added that the researcher, who has chosen to remain anonymous, is someone TippingPoint has worked with before. “He’s a regular contributor to our program,” she said.
She wouldn’t disclose more than that, but did say it wasn’t unusual for researchers to suddenly reveal a vulnerability that they’d discovered some time before. “I can think of several examples,” Forslof said. “It’s highly likely that he [found the bug] in their last version [of Firefox], and was just waiting for them to release 3.0 to see if they’d fixed it there.”
According to both TippingPoint and Mozilla, the vulnerability is in the older Firefox 2.0 series as well as the brand-new Firefox 3.0, which launched Tuesday. The browser was downloaded more than 8.3 million in its first 24 hours of availability.
Updated at 1:50 p.m. PT to include comments from Mozilla and Tipping Point.
This story, "Researcher reports first Firefox 3.0 bug" was originally published by Computerworld.