0

I have access (and the general public) to a computer lab with many workstations. Each workstation is identical in terms of software, hardware and the version of firefox.

The version that is installed is 21.0, and the latest (as of this writing) is 33.3. After noticing the version I do not use Firefox on these computers, instead using TeamViewer to connect to my computer and use the browser there.

Does it matter that much if an outdated version of firefox is being used? I'm concerned because I would imagine that many security fixes would be in place since then.

RoraΖ
  • 12,317
  • 4
  • 51
  • 83
alexyorke
  • 105
  • 6

1 Answers1

1

It does matter that much via the amount of vulnerabilities and exploits available that affect that particular version. For example, that version had 8 vulnerabilities, 3 of which were critical. From the current release, to that version, there were 53 CRITICAL vulnerabilities discovered. Developers won't go back and say: "Well the exploit on version 28 didn't affect version 23," - it will never be known unless you're a researcher, and your disclosure states something like: "Affects ALL versions prior too..."

So unless you're willing analyze all bugs for all versions prior to current, there is a strong possibility that newer bugs, can affect older versions. Bottom line, you're allowing N amount of critical vulnerabilities in your experience. A workaround would be to use the portable edition of Firefox if you don't have installation permissions.

munkeyoto
  • 8,682
  • 16
  • 31
  • Do I have a responsibility to report that Firefox is outdated and contains security flaws? – alexyorke Nov 20 '14 at 15:18
  • 1
    Responsibility? Perhaps not a legal or regulatory one, but the IT staff might appreciate either the head's up or appreciate that someone is concerned. – schroeder Nov 20 '14 at 15:22
  • The responsibility is on the department, in which they should have some form of change management, and patch management procedures to addressed that. It would be nice that you did bring it up, but in strong environments, they'd likely know they're outdated. – munkeyoto Nov 20 '14 at 15:37
  • I should probably give another place a heads up for using Windows XP and Firefox 15 – alexyorke Nov 21 '14 at 20:27