Mozilla Patches Numerous Leaks In Firefox 41

Mozilla has released a new version of Firefox where 27 vulnerabilities patched. Through six vulnerabilities an attacker without much interaction from a user his or her system in the worst case can take over completely. This would require visiting a hacked or malicious Web site or see getting an infected ad suffice.

In Firefox 41 are further resolved numerous other bugs and added new features. One of the new additions to the browser is perfect forward secrecy for WebRTC. WebRTC is an open source project developed by Google which provides browsers with Real-Time Communications (RTC). To the communications from users secure for applications and applications that WebRTC now use perfect forward secrecy required.

PFS at each session to generate a separate key and removed after the end of the session or sending a message. In the case attackers the encryption key compromise, they do not yet have access to the previously stored messages (sessions) of users, as these are generated using a separate derived key. WebRTC, according to critics, a privacy risk because the information users can leak. Updating to Firefox 41 via the automatic update feature of the browser, Mozilla.org.

Firefox and Chrome Can Leak IP VPN Users

Firefox and Google Chrome have implemented a technology allowing the IP address of VPN users can be traced. Before Daniel Roesler warns on GitHub . The problem is caused by WebRTC , an open source project developed by Google that provides browsers Real-Time Communications (RTC).

Both Firefox and Chrome have implemented whereby the WebRTC technology called " STUN requests "can send to STUN servers. Through these requests, the local and public IP addresses of the user can be captured via JavaScript. This is especially a problem for VPN users, who often use VPNs to protect their identity. Roesler made ​​this demonstration to capture the IP addresses. Readers Reddit give different solutions to the problem, such as disabling WebRTC in Firefox and Chrome.

In Firefox, this can by in the address bar " about: config "to enter and then put" media.peerconnection.enabled "to" false ".Google Chrome users can do this in the address bar " chrome: // flags / "to enter and then" Disable WebRTC device enumeration "to turn. Other solutions have JavaScript disabled, using Firefox NoScript or Chrome extension WebRTC Block. Additionally, VPN users get TorGuard advised to set the VPN tunnel directly to their router.