The open-source project released Firefox 1.0.1 to fix a vulnerability in the Internationalized Domain Names (IDN), a standard for handling special character sets in domain names that could let an attacker spoof Web sites on non-Microsoft browsers. The standard allows companies to register domain names that appear to be the same in different languages.
That encoding scheme could enable an attacker to create a fake Web site for a phishing scam. A spoofed link would seem to be a legitimate URL in the address bar of affected browsers. But instead of taking the victim to the trusted site, the link would lead to a phony Web site with a domain rendered as the same address under the IDN process.
The updated browser will display the IDN Punycode in the address bar, preventing URL spoofing. Punycode is the encoding of Unicode strings into the limited character set supported by the Domain Name System and IDN.
"Regular security updates are essential for maintaining a safe browsing experience for our users," Chris Hofmann, director of engineering for the Mozilla Foundation, said in a statement.
Phishing attacks, which try to fool consumers into handing over sensitive information by creating legitimate-looking Web sites and e-mail messages, have become a central security concern recently. While vulnerabilities in Microsoft's Internet Explorer have been the focus of much of the concern, other browsers also have had their fair share of flaws.
The update is available for Windows, Mac OS X and Linux at Mozilla.org.
Firefox recently surpassed 25 million downloads, achieving that mark in 100 days. Mozilla, which released the free 1.0 program in November, says an average of 250,000 people download Firefox every day and more than half a million Web sites feature Firefox promotions.
Mozilla, an open-source software foundation formed by Netscape, was spun off from Time Warner in 2003.
Talkback
Why is this line about a flaw in Firefox still being peddled? The flaw was never in FF because the browser was only following the specification which you'd know if you RTFM'd. As it happens, the flaw was actually in the specification to begin with, and therefore all modern browsers fell for. IE doesn't because it's so far behind. Do your journos actually understand the difference here, or do they just regurgiate any old garbage they're fed.
Actually this is neither a flaw in Firefox nor a flaw in the specification but a flaw with the registrars. They're the ones who should be denying Joe BlackHat down the street domain names like www.páypal.com