|
3.0.10出来还没多久，3.0.11又冒头了。这次又是好几个安全漏洞被发现，其中最搞笑的是这一个： http://www.mozilla.org/security/announce/2009/mfsa2009-27.html Microsoft security researchers Shuo Chen, Ziqing Mao, Yi-Min Wang, and Ming Zhang reported that when a CONNECT request is sent to a proxy server and a non-200 response is returned, then the body of the response is incorrectly rendered within the context of the request Host: header. An active network attacker could use this vulnerability to intercept a CONNECT request and reply with a non-200 response containing malicious code which would be executed within the context of the victim's requested SSL-protected domain. Since this attack requires the victim to have a proxy configured, the severity of this issue was determined to be high. 几个微软研究院的中国人发现了这个漏洞，基本上来说，Firefox完全打破了SSL的安全性，只要你用proxy，hacker就有可能不知不觉地把你的session给hack掉，比如说你本来是去网上银行的，hacker如果在互联网上探测到了你对proxy发出的连接请求，可以截获这个请求然后发给你一些恶意代码，Firefox这时就会欣然执行之，连phishing都不用，真他妈的方便到家了 |
