reader comments

Is Urgent Firefox Patch Legit
Urgent Firefox Patches Download
How To Remove Urgent Firefox Patch Virus

These “Urgent Firefox Update” removal instructions work for Firefox as well as every version of Windows. “Urgent Firefox Update” is a scam that a lot of our readers have been complaining about.

Most of the time you will be offered to download some kind of free software that will be able to fix the problem. It’s not that hard to tell that there is no problem in a first place and the program will try to lure your money one way or another.
Aug 07, 2015 Mozilla released Firefox 39.0.3 on Thursday to patch a pretty serious security flaw.

with 26 posters participating, including story author

Developers with both Mozilla and Tor have published browser updates that patch a critical Firefox vulnerability being actively exploited to deanonymize people using the privacy service.

'The security flaw responsible for this urgent release is already actively exploited on Windows systems,' a Tor official wrote in an advisory published Wednesday afternoon. 'Even though there is currently, to the best of our knowledge, no similar exploit for OS X or Linux users available, the underlying bug affects those platforms as well. Thus we strongly recommend that all users apply the update to their Tor Browser immediately.'

The Tor browser is based on the open-source Firefox browser developed by the Mozilla Foundation. Shortly after this post went live, Mozilla security official Daniel Veditz published a blog post that said the vulnerability has also been fixed in a just-released version of Firefox for mainstream users. On early Wednesday, Veditz said, his team received a copy of the attack code that exploited a previously unknown vulnerability in Firefox.

Is Urgent Firefox Patch Legit

The attack executed code when targets loaded malicious JavaScript and code based on scalable animation vector graphics. The exploit used the capability to send the target's IP and MAC address to an attacker-controlled server. The code in general resembles the types of so-called network investigative techniques used by law-enforcement agencies, and specifically one that the FBI used in 2013 to identify Tor-protected users who were trading child pornography.

A 'threat to the broader Web'

'This similarity has led to speculation that this exploit was created by FBI or another law enforcement agency,' Veditz wrote. 'As of now, we do not know whether this is the case. If this exploit was in fact developed and deployed by a government agency, the fact that it has been published and can now be used by anyone to attack Firefox users is a clear demonstration of how supposedly limited government hacking can become a threat to the broader Web.'

According to the release notes for version 50.0.2 released in the past few hours, the underlying vulnerability is indexed as CVE-2016-9079 and is rated as critical. A separate Mozilla security advisory shows that it also affects Mozilla's Thunderbird e-mail application, as well as the Firefox Extended Support release version used by the Tor browser. A thread on an online forum for discussing Firefox bugs indicated the critical flaw has existed in the browser code base for five years.

Attack code exploiting the vulnerability first circulated Tuesday on a Tor discussion list and was quickly confirmed as a zero-day, the term given to vulnerabilities that are actively exploited in the wild before the developer has a patch in place. The malicious payload delivered by the code-execution exploit is almost identical to one the FBI used in 2013 to identify people who were trading child pornography on a Tor-anonymized website. Because the initial post to the Tor group included the complete source code, the highly reliable exploit quickly became available to millions of people, although they would have to make minor changes to make use of it.

Besides an update for Firefox, Wednesday's Tor release also includes an update to NoScript, a Firefox extension that ships with the Tor browser. NoScript allows users to select the sites that can and cannot execute JavaScript in the browser. For privacy and usability reasons, the Tor browser has traditionally installed NoScript in a way that allowed all sites to run JavaScript in the browser. It's not clear what effect the new NoScript update has on that policy.

Urgent Firefox Patches Download

Firefox and Tor users should install the fixes at once. People using both Tor and mainstream versions of Firefox are believed to be protected from the attack by setting the Firefox security slider to 'High,' although the setting will prevent many sites from working as expected. For much more about this attack see Ars's previous coverage Firefox 0-day in the wild is being used to attack Tor users.

How To Remove Urgent Firefox Patch Virus

Post extensively updated throughout to add details about a just-released patch for the mainstream version of Firefox and Mozilla comments about the exploit.

Urgent Firefox Patch Download