San Francisco (CA) – Mozilla has confirmed that it is “working on a fix” for a recently discovered JavaScript vulnerability.
“A bug discovered last week in Firefox 3.5’s Just-in-time (JIT) JavaScript compiler was disclosed publicly yesterday,” the company explained in a statement. “It is a critical vulnerability that can be used to execute malicious code. The vulnerability can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code.”
According to Mozilla, the vulnerability can be mitigated by running FF in safe mode or disabling the JIT in the JavaScript engine. To do so:
1. Enter about:config in the browser’s location bar.2. Type jit in the Filter box at the top of the config editor.3. Double-click the line containing javascript.options.jit.content setting the value to false.
However, Mozilla warned that disabling JIT would result in decreased JavaScript performance and recommended restoring the original settings after completing installation of the expected patch.
JIT settings can be restored by following these steps:
1. Enter about:config in the browser’s location bar.
2. Type jit in the Filter box at the top of the config editor.
3. Double-click the line containing javascript.options.jit.content setting the value to true.
It should be noted that the critical JavaScript vulnerability was also confirmed by US-CERT.
“US-CERT is aware of reports of a vulnerability affecting Mozilla Firefox 3.5,” stated the computer emergency readiness team. “This vulnerability is due to an error in the way JavaScript code is processed. Exploitation of this vulnerability may allow an attacker to execute arbitrary code. Additionally, exploit code is publicly available for this vulnerability.”
