Firefox v.6.0.1 was offered to release channel users on August 30th, 2011.
What’s New in Firefox 6 [3]
The latest version of Firefox has the following changes:
* Revoked the root certificate for DigiNotar due to fraudulent SSL certificate issuance (see bug 682927 and the security advisory)
Fixed in Firefox 6 [4]
MFSA 2011-34 Protection against fraudulent DigiNotar certificates
Vulnerability ratings: 1 High
Affects: Windows, OSX, Linux, Android …
Evaluation: Upgrade, but be aware of impacts;
One possibility is to remove the DigiNotar CA from the list of trusted CAs. The problem with this approach is that now legitimate certificates, signed by DigiNotar, will no longer validate. The last thing you want to do IMHO is to get users accustomed to bypassing these warnings. I am not sure how popular DigiNotar is, so maybe it is an option in this case.
Certificate revocation lists are supposed to solve this problem. But they are not always reliable. However, for high profile breaches like this one, expect a browser patch that adds the certificate to a blacklist. Apply the patch as it becomes available. — SANS [5]
[1] Firefox Updated: Firefox 6.0.1 (2011-Aug-30) [Mozilla]
[2] Firefox features [Mozilla]
[3] Mozilla Firefox 6.0.01 Release Notes (2011-Aug-30) [Mozilla]
[4] Security Advisories for Firefox [Mozilla]
[5] DigiNotar SSL Breach (2011-Aug-30) [SANS]
0 Responses to “Firefox v.6.0.1”