Become a fan of Slashdot on Facebook

 


Forgot your password?
Close
typodupeerror
×
Mozilla The Internet Security Software IT

Firefox Updated to 1.0.4 454

Posted by Zonk from the patching-the-fox-hole dept.
Exstatica writes "Firefox has been updated to 1.0.4 and they have fixed a few critical security holes, all javascript vulnerabilities. The Mozilla Foundation announced these vulnerabilities May 7th. 'There are currently no known active exploits of these vulnerabilities although a proof of concept has been reported." You don't have to upgrade, but it's recommended.'" We've reported on these vulnerabilities previously.
This discussion has been archived. No new comments can be posted.

Firefox Updated to 1.0.4 More

Firefox Updated to 1.0.4

Comments Filter:

  • Update process... (Score:5, Interesting)

    by sznupi ( 719324 ) on Thursday May 12, 2005 @08:56AM (#12508169) Homepage
    yes, I know the arguments behind it...but it would be relly nice if update didn't involve simply downloading installer (on mine 128kbps it's so so...and on slower?)

  • Quick and serious on security (Score:5, Interesting)

    by xiando ( 770382 ) on Thursday May 12, 2005 @08:56AM (#12508170) Homepage Journal
    These issues were announced on Monday, and now a security release is available. This shows how professional the Mozilla Foundation has become and how serious they take security issues. Good work! Security problems will inevitably appear from time to time in all kinds of software, how these issues are handled is to me just as important as the software itself. Good job!

    • Re:Quick and serious on security (Score:5, Insightful)

      by portwojc ( 201398 ) on Thursday May 12, 2005 @09:00AM (#12508206) Homepage
      Yes excellent work.

      Hopefully the mainstream news sources I saw will report this just as they reported the problem. I'm not holding my breath though.

    • Re:Quick and serious on security (Score:2, Insightful)

      by MoogMan ( 442253 ) on Thursday May 12, 2005 @09:13AM (#12508305)
      But, on the flip side, it does show a lack of a security auditing process. This will be needed inevitably...

    • Yes, but ... (Score:5, Insightful)

      by thinkfat ( 789883 ) on Thursday May 12, 2005 @09:26AM (#12508395)
      ... as soon as the first proof of concept evolves into a worm, they will experience what it means to be deployed on millions of internet-connected pc's of clueless users.

      Rule #1: doesn't matter how fast you output a security update, if it's not being installed.

      Unfortunately it's not enough for an update to _exist_.

      • Re:Yes, but ... (Score:5, Insightful)

        by jbarr ( 2233 ) on Thursday May 12, 2005 @10:04AM (#12508714) Homepage
        And therin lies the double-edged sword. Just about everyone on /. complains about Microsoft's auto-update feature saying that it's intrusive, and they don't want some company to have control of what is installed on their PC's. Yet, in order to ensure security, an auto-update feature really becomes necessary. Of course, Microsoft and the Mozilla Foundation as companies are viewed with very different levels of "trusts." Unfortunatly, not everyone will be satisfied.

        Personally, instead of displaying the tiny unobtrusive update indicator as it currently does, I would love see Firefox do something like change the window color to red and display a system message dialog stating the problem with a link to the update. Maybe a good compromise?

        • Re:Yes, but ... (Score:3, Insightful)

          by Ogive17 ( 691899 ) on Thursday May 12, 2005 @11:52AM (#12509749)
          I downloaded firefox as soon as it was "officially" released.

          Now I consider my knowledge of computers and software as advanced, but I'm definately not an expert. I found the interface to be less friendly than IE and trying to change options was a chore. Also, until 3 days ago, I didn't know how to automatically update Firefox until I saw someone mention clicking the red arrow on the top right portion of the window. Now, I had gone to mozilla.org and downloaded the latest versions on my own, but this was a hassle. And if "I" didn't know about the auto-update, my grandmother, parents, sister, brother, and a few friends I've turned to Firefox are not going to know either.

          Sometimes reading through /. posts, I am reminded of bleeding heart liberals or bible thumping conservatives with how people treat OSS to M$. People are annoyingly blinded by their dis-like for the other side that they cannot see the whole picture. Sure Firefox is great, but it's not perfect and IE still has some advantages.

      • Re:Yes, but ... (Score:3, Interesting)

        by tyler_larson ( 558763 ) on Thursday May 12, 2005 @10:32AM (#12508961) Homepage
        ... as soon as the first proof of concept evolves into a worm...

        Point taken, but let's bear in mind that this POC can't evolve into a worm. It can't even evolve into an exploit now that the only site on the default whitelist no longer exists.

        That's why they didn't put out a stop-gap fix release at the beginning of the week--the threat had passed completely.

        Firefox developers got lucky this time--they could remove the threat with a simple server-side modification. With most vulnerabilities of this severity, that's not an option.

      • Re:Yes, but ... (Score:3)

        by Curtman ( 556920 ) on Thursday May 12, 2005 @10:33AM (#12508970)
        Unfortunately it's not enough for an update to _exist_.

        True. But it's also not enough for a bug to exist either. It has to be _exploitable_.

  • Already upgraded (Score:5, Interesting)

    by Walkiry ( 698192 ) on Thursday May 12, 2005 @08:57AM (#12508177) Homepage
    Posting from 1.0.4 right now. Funny thing, after I upgraded and restarted the browser, I still had the "updates available" little red arrow on the top right corner of the browser. After checking for upgrades (and finding none), it's disappeared. Bug? Leftover registry entry or config file from 1.0.3?

  • Dude at work (Score:5, Funny)

    by PlancksCnst ( 877593 ) on Thursday May 12, 2005 @08:57AM (#12508185) Homepage
    This guy at work noticed I was using firefox (he's an IE user), and said, slyly, "You know, there's a couple of really bad security holes." Good think FF fixes their holes faster than MS.

  • Vulnerabilities everywhere. (Score:4, Funny)

    by CABAN ( 818466 ) <<adelleda> <at> <gmail.com>> on Thursday May 12, 2005 @08:57AM (#12508186)
    Next time I try to help a friend out I'm not suggesting firefox. I'm suggesting Netscape! Wwwait.

  • hmmm... (Score:3, Informative)

    by prophetmike ( 789248 ) on Thursday May 12, 2005 @08:59AM (#12508194) Homepage
    Firefox 1.0.4 was posted sometime between 11 and 11:30PM last night EST. I got it about 11:40 :D (Yes, geek alert) That aside, with all of these newfound vulnerabilities popping up so often, could Firefox become (later down the line) the new Internet Explorer? May seem highly unlikely now.. but as the New York Lottery says... "Hey, you never know."

    • Re:hmmm... (Score:3, Insightful)

      by CaymanIslandCarpedie ( 868408 ) on Thursday May 12, 2005 @10:28AM (#12508927) Journal
      No. The real issue with IE wasn't the security that were found (this will ALWAYS be the case with ANY software), it was thier lax attitude about fixing the issues.

      FireFox right out of the box proved to be a pretty solid browser (they had the chance to learn lessons from those browsers that came before). And when an issue does come up the take it seriously and try to fix it promptly.

      I'd not only argue FireFox will never be IE (of a year or two ago), but I'd also bet IE (of today) will never be IE (of a year or two ago). XP SP2 had a lot of fixes and MS$ has been much more both pro-active and reactive about security (thanks to the kick in the pants from FireFox).

      Please put down your torches and pitch-forks ;-) I'm not saying IE is as good as FF, just saying MS$ has responded to the challenge and are doing better so I don't think any browser will be as lax as MS$ has been in the past.

      That is however one of the issues with MS$. They have soooo much going on, there are times when a product (IE) will be such a low priority these things can happen. Over the last few years MS$ has been working on high-priority tasks like (new VS.NET, new SQL Server, XP SP2, and Longhorn) just to name a few. With those big core company projects happening, IE kind of fell through the cracks since they felt un-touchable in the browser market. Luckily, FireFox came around and woke them up. If you use IE or not, for the good of everyone it is good to see they have woken up a bit and lets hope it never happens again!

  • Mozilla Suite updated as well (Score:5, Informative)

    by iamjoltman ( 883526 ) on Thursday May 12, 2005 @08:59AM (#12508196)
    It should be noted that the Mozilla Suite has also relased an update, 1.7.8.

  • Wheres my arrow? (Score:2)

    by kevin_conaway ( 585204 ) on Thursday May 12, 2005 @08:59AM (#12508201) Homepage
    I don't have an upgrade arrow yet :P

    • Re:Wheres my arrow? (Score:3, Informative)

      by michrech ( 468134 ) on Thursday May 12, 2005 @09:09AM (#12508268)
      I don't know this as fact, but I think it is all in what time your browser checks for updates. I can't tell for sure, but I think it is set to do a random check (mayhapps it even checks every so many days and yours is still not showing an update as others are because you installed so many days after they did)...

      I dunno..

      ---
      telnet://sinep.gotdns.com [gotdns.com] -- Telegard BBS -- Enjoy!

  • Mirrors (Score:5, Informative)

    by bunburyist ( 664958 ) on Thursday May 12, 2005 @09:01AM (#12508213)
    Mozilla.org will probably get hammered!! Here's a google cache of the Firefox Mirror List [64.233.183.104]

    And while you're at it don't forget those extensions:

    FoxyTunes: http:www.iosart.com/foxytunes/firefox/ [iosart.com]

    AdBlock: http://adblock.mozdev.org/ [mozdev.org]

    Or you can just go get more at: update.mozilla.org [slashdot.org]

    Happy Browsing!

  • Locales (Score:2, Informative)

    by bjprice ( 863197 ) on Thursday May 12, 2005 @09:05AM (#12508244) Homepage Journal

    Unfortunately there's no British English version of 1.0.4 yet.

    It'll appear in the list of locales here [149.174.36.116] when it's ready, but it looks like we limeys are stuck with 1.0.3 (or speaking American English) until then.

  • Impressive (Score:5, Interesting)

    by PenguinBoyDave ( 806137 ) <david@dav[ ]eyer.org ['idm' in gap]> on Thursday May 12, 2005 @09:05AM (#12508245)
    While I don't care for the update process, I am exceedingly impressed that Mozilla makes fixes so quickly, and doesn't try to hide them (like another browser company has done in the past). Professionalism...very nice to see this from Mozilla. Kudos!

  • exe crashes explorer when viewed accross SMB share (Score:2, Interesting)

    by Anonymous Coward on Thursday May 12, 2005 @09:05AM (#12508246)
    I copy the exe installer into a folder on a windows share, explorer crashes when I access the folder from certain clients. Same happened with 1.0.2 but not with 1.0.3

    I wildly guess it's a race condition or something arising from reading the embedded icon resourse as that doesn't show? No I don't really have a clue what causes it.

    All machines are fully patched W2K, thank buddha for memory sticks!

  • c'mon! Let's break some FF extensions! (Score:3, Interesting)

    by denis-The-menace ( 471988 ) on Thursday May 12, 2005 @09:07AM (#12508254)
    Why can't we have extensions that don't die just because they changed the release number?

    Extension authors can't keep up.
    Mozilla Update is slow to update itself.
    and Users like me are left looking to google for help.
    Silly me thought Mozilla Update there to centralized things.

  • Language Not Available!! (Score:2, Funny)

    by HomeworkJunkie ( 877015 ) on Thursday May 12, 2005 @09:08AM (#12508266)
    Damn. Can't upgrade to 1.0.4 since the English (British) version is not available yet :( Can't be installing the American version ;)

  • Good, but I wish there was remote updating (Score:5, Interesting)

    by Anonymous Coward on Thursday May 12, 2005 @09:11AM (#12508292)
    As a system admin for our company, every new Firefox release means that I will have to go around to 150 workstations and manually reinstall the browser again to keep it up to date. I wish there was some sort of way to remotely update the browser on all machines or a way to patch vulnerabilities without a full reinstall.

  • Middle click new tab on Mac (Score:3, Interesting)

    by Feng ( 63571 ) on Thursday May 12, 2005 @09:13AM (#12508307)
    Does middle clicking on a link open a new tab for OS X yet? The last I heard you had to patch FF to enable this feature. Middle clicking works fine on Safari, it's one feature I really miss when using FF on OS X.

  • Amazingly fast response (Score:5, Interesting)

    by jbarr ( 2233 ) on Thursday May 12, 2005 @09:16AM (#12508324) Homepage
    My wife pointed out an article on Google News (that I had already seen earlier) showing that Firefox had some security vulnerabilities. She winced because I had just converter her to Firefox. I told her not to worry. I said, "Mark my words, there will be a security fix within a week." Well, today the fix was released and she was impressed. Not only has the Firefox development team improved the product, but they have made my wife happy! Life is good!

  • Will someone please... (Score:2)

    by Viceice ( 462967 ) on Thursday May 12, 2005 @09:19AM (#12508341)
    Will some one please post a .torrent? Highly apreciated thanks.

    • Re:Will someone please... (Score:2, Insightful)

      by Baramin ( 847271 ) on Thursday May 12, 2005 @09:28AM (#12508406) Homepage Journal
      You're obviousile eager to update your firefox rapidly, I suppose because of the security fixes of that new version.

      But you're willing to download it from any source as you're requesting a torrent, which can contain a "modified" version ?

      I fail to see the logic... I'd advise you to wait till you can download it from the main mirrors.

  • 'all javascript vulnerabilities'? (Score:3, Insightful)

    by DaHat ( 247651 ) on Thursday May 12, 2005 @09:20AM (#12508344)
    That sounds awful ominous and near impossible... perhaps instead the line should be 'all known javascript vulnerabilities'?

  • Bleeding edge (Score:5, Informative)

    by imipak ( 254310 ) on Thursday May 12, 2005 @09:22AM (#12508360) Journal
    Although I've been an enthusiastic mozilla/firefox user & supporter since the late 90s (yes I was browsing with a 'naked' gecko control, HA! :P) I was surprised to find I'd lost track of development to the extent that I didn't realise the trunk builds have a much more up-to-date gecko engine. The gecko in the 1.0.x series (inc. 1.0.4) are a year old! Those users who prefer livin' on the edge might prefer to get a faster, smaller, much less memory-leaky build from: ftp://ftp.mozilla.org/pub/mozilla.org/firefox/nigh tly/latest-trunk/ [mozilla.org]
    • For Mac users the Nightly builds also sorts a few problems .
      The browser is much smother , the middle mouse buttons works for things like auto scroll , open in a new tab and close tabs.
      Also the menu interface has been redone and is far more hetrogeneous to the os X enviroment.
      I tried out 1.0.4 and the mac problems above seemed not to be fixed so the nightly builds do provide a far more comfertable browsing experiance on os X

  • In related news... (Score:5, Funny)

    by amichalo ( 132545 ) on Thursday May 12, 2005 @09:25AM (#12508379)
    ...FireFox downloads double to 100 Million [spreadfirefox.com]!

  • Firefox speed..... (Score:3, Interesting)

    by SammysIsland ( 705274 ) on Thursday May 12, 2005 @09:36AM (#12508454)
    Back in the day when I first downloaded FireFox, one of my favorite parts of using it was how fast it would load up the first window when opened. It was almost instantaneous.

    The more I use it, the longer this actions takes. It doesn't matter if I clear cache and cookies, un-install plugins, or just plain uninstall and reinstall the browser.

    Is it simply the newer versions that cause it to load so slowly? My roommate has the same problem. Is anyone else experiencing this and is there an answer?

    Responses greatly appreciated. Thanks.

  • news? (Score:5, Insightful)

    by Errtu76 ( 776778 ) on Thursday May 12, 2005 @09:59AM (#12508675) Journal
    Disclaimer: I like firefox. I use firefox.

    Why is this news? Does this mean that every time firefox decides to update, it should be front page news? Can't you (slashdot) create a seperate field where the latest versions of popular products are announced? Like:

    product | version | last update
    firefox | 1.0.4 | today

    • Re:news? (Score:4, Insightful)

      by globalar ( 669767 ) on Thursday May 12, 2005 @12:02PM (#12509845) Homepage
      Most of the time, Firefox updates are not very important. However, the exploits which 1.04 fix were highly publicized.

      I saw many IT magazines, mostly targeted at management, with significant space (even a few covers) devoted to the exploit. It is an example of the Firefox (and Mozilla) team's committment that a patch came out so quickly. This is very important, as it shows open source products can compete in the very tough browser market.

      The progress of Firefox is now being watched by many - opponents and supporters alike. Firfox is under the spotlight and responding the serious issues - especially security, which has plagued IE - is crucial for the browser's future success. This is more about PR and brand recognition than security.

  • Doing the .exe shuffle (Score:4, Informative)

    by carambola5 ( 456983 ) on Thursday May 12, 2005 @11:19AM (#12509437) Homepage
    I can't run the executable "firefox.exe" at work because it "has been disabled by the administrator." Solution? Rename to firefox2.exe.

    The only pain comes when firefox is updated... it leaves the firefox2.exe executable from the previous installation, and adds the new firefox.exe to the install folder. It then becomes a dumb little task to update all the icons and shortcuts scattered about my system.

    Wish there was some way to specify, during install, the resulting executable name. Of course, I have to be one of the maybe twenty people in the world who needs this, so maybe it's not worth the miniscule bloat.

  • Meanwhile Microsoft's Patch Yesterday (Score:3, Informative)

    by Master of Transhuman ( 597628 ) on Thursday May 12, 2005 @11:25AM (#12509504) Homepage

    leaves several vulnerabilities at LEAST as serious as the Firefox ones open UNTIL NEXT MONTH!

    Who said something about "time to patch" favoring MS?

    Firefox: vulnerabilities announced Monday.
    Patched by Thursday morning.

    Microsoft: vulnerabilities announced months ago.
    Patched - "Next month - maybe".

  • It should be noted that 1.0.4 also features a JS bugfix which hastes said JS execution by around 20%.

    May sound like it suck... if you don't know that the whole XUL thing (basically everything in firefox but the Gecko engine itself: interface, extensions, userscripts, ...) is pure Javascript.

  • Mozilla. k Thanks (Score:3)

    by baadger ( 764884 ) on Thursday May 12, 2005 @01:17PM (#12510733)
    If Slashdot wasn't so eager to sniff Firefox's hind leg this post would, and should, have mentioned Mozilla 1.7.8 as being released too.

Slashdot Top Deals

The best way to accelerate a Macintoy is at 9.8 meters per second per second.

Close