The United States Cybersecurity and Infrastructure Agency (CISA), part of the Department of Homeland Security, this week urged customers who are using the Firefox browser to upgrade to version 72.0.1, as there is a major vulnerability in older versions of the Firefox browser.
Mozilla has warned Firefox users to update their browser to the latest version after security researchers found a vulnerability that hackers were actively exploiting in “targeted attacks” against users.
But Qihoo did not say precisely how the bug was exploited, who the attackers were, or who was targeted.
Browser vulnerabilities are a hot commodity in security circles as they can be used to infect vulnerable computers — often silently and without the user noticing — and be used to deliver malware or ransomware. Browsers are also a target for nation states and governments and their use of surveillance tools, known as network investigative techniques — or NITs. These vulnerability-exploiting tools have been used by federal agents to spy on and catch criminals. But these tools have drawn ire from the security community because the feds’ failure to disclose the bugs to the software makers could result in bad actors exploiting the same vulnerabilities for malicious purposes.
Mozilla issued the security advisory for Firefox 72, which had only been out for two days before the vulnerability was found.
Homeland Security’s cyber advisory unit, the Cybersecurity and Infrastructure Security Agency, also issued a security warning, advising users to update to Firefox 72.0.1, which fixes the vulnerability. Little information was given about the bug, only that it could be used to “take control of an affected system.”
Firefox users can update their browser from the settings.
Mozilla released Firefox 72.0.1 on Wednesday to address a security issue that allows malicious entities to run unauthorized code on a target computer through a webpage, letting them take control of an affected system. From Mozilla:
Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion. We are aware of targeted attacks in the wild abusing this flaw.
As the above quote states, there are known targeted attacks exploiting this flaw, which means it’s important for all Firefox users to upgrade, including enterprise users.
The vulnerability was first discovered by Chinese company Qihoo 360 two days after the release of Firefox 72, but there is no word on how long the bug has been exploited nor who used the vulnerability or who might have been targeted. This is the third zero-day vulnerability that Mozilla has addressed within the last year, with the company patching two other major vulnerabilities in June 2019.