reader comments 17
Share this story
Developers with both Mozilla and Tor have published browser updates that patche a critical Firefox vulnerability being actively exploited to deanonymize people using the privacy service.

“The security flaw responsible for this urgent release is already actively exploited on Windows systems,” a Tor official wrote in an advisory published Wednesday afternoon. “Even though there is currently, to the best of our knowledge, no similar exploit for OS X or Linux users available, the underlying bug affects those platforms as well.

Thus we strongly recommend that all users apply the update to their Tor Browser immediately.”
The Tor browser is based on the open source Firefox browser developed by the Mozilla Foundation. Mozilla officials on Tuesday released version 50.0.2 for the mainstream users of Firefox.

According to the release notes, it includes a fix for the vulnerability, which is rated as critical.
“A use-after-free vulnerability in SVG Animation has been discovered,” the release notes state. “An exploit built on this vulnerability has been discovered in the wild targeting Firefox and Tor Browser users on Windows.”
The notes didn’t provide additional details, except to say that the vulnerability is indexed as CVE-2016-9079.

A separate Mozilla security advisory shows that it also affects Mozilla’s Thunderbird e-mail application, as well as the Firefox Extended Support release version used by the Tor browser. Mozilla representatives didn’t respond to e-mails seeking comment for this post.
Attack code exploiting the vulnerability first circulated Tuesday on a Tor discussion list and was quickly confirmed as a zero-day, the term given to vulnerabilities that are actively exploited in the wild before the developer has a patch in place.

The malicious payload delivered by the code-execution exploit is almost identical to one the FBI used in 2013 to identify people who were trading child pornography on a Tor-anonymized website.

Because the initial post to the Tor group included the complete source code, the highly reliable exploit is now in the hands of potentially millions of people, although they would have to make minor changes to make use of it.
Besides an update for Firefox, Wednesday’s Tor release also includes an update to NoScript, a Firefox extension that ships with the Tor browser. NoScript allows users to select the sites that can and cannot execute JavaScript in the browser.

For privacy and usability reasons, the Tor browser has traditionally installed NoScript in a way that allowed all sites to run JavaScript in the browser.
It’s not clear what effect the new NoScript update has on that policy.
Firefox and Tor users should install the fixes at once. People using both Tor and mainstream versions of Firefox are believed to be protected from the attack by setting the Firefox security slider to “High,” although the setting will prevent many sites from working as expected.

For much more about this attack see Ars’s previous coverage Firefox 0-day in the wild is being used to attack Tor users.
Post updated in the third, fourth, and fifth paragraphs to add details about a just-released patch for the mainstream version of Firefox.

Leave a Reply