Mozilla/Firefox Bug Allows Arbitrary Program Execution

treefort writes "An article at eWeek has the lowdown. The article also has a link to the bug report which addressed this issue some time ago. Still, I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites. Note that this only affects users of Mozilla and Firefox on Windows XP or Windows 2000." New releases are already available on mozilla.org that fix this. Update: 07/09 00:41 GMT by CN : I removed the bum link to Bugzilla, since I guess they don't like us. Also I discovered that OSDN's own NewsForge has more on the situation.

Comments

A clear advantage

[SIGALRM]

The Mozilla Foundation has confirmed the problem and issued a fix

This incident underscores why many use or have switched to Firefox: vulnerabilities discovered and promptly fixed. Not weeks and months from their publication--and not by another vendor--this exploit was addressed by those who have made available Mozilla's code for public scrutiny.

FYI, in case you didn't read the article, you can download the fix here.

Re:A clear advantage

[peripatetic_bum]

OK. This just rocked. I click on the link to fix the exploit and mozilla asks if it can update the file and Whammo. It's done.

Amazing what the mozilla group is doing.

G

Re:A clear advantage

[hackstraw]

Yeah, they "fixed" it timely. But WHY THE HELL IS THERE A shell: SCHEME IN THE BROWSER IN THE FIRST PLACE? I've never heard of it, never needed it, and obviously there are issues with it.

Come on we blast M$ for putting vbscripting and whatnot in IE, but this is just as dumb.

Re:A clear advantage

[Anonymous Coward]

This incident underscores why many use or have switched to Firefox: vulnerabilities discovered and promptly fixed. Not weeks and months from their publication

Yeah, it was years before it was addressed. If you read the Bugzilla report, it was first opened in 2002. This is not a good example of "open software fixes things faster".

Re:A clear advantage

[bwy]

Very true- no software ever written has been 100% bug free. Mac, Linux, Mozilla etc. simply aren't targets for obvious reasons that are frequently brought up here.

The difference in large part in my opinon boils down to:

#1 WHO finds the bug. Is it the developers and community that discovers it in good faith, or is it a hacker and the rest of us find out after a billion dollars has been lost worldwide to the latest worm, virus, etc.

#2 As you said, how quickly is the problem fixed. Certainly, private companies aren't necessarily horrible at doing this, to spite what people say. I work for a small software company and assure you that any security issues with our product would be corrected promptly. By the same token, some open source projects w/o a steady lead or direction could have exploits that go unfixed for some time.

However, based on my observations and considering those two points, I'd say I certainly feel better using Firefox than IE.

Re:A clear advantage

[lseltzer]

Not quite done yet. You have to restart your browser first.

Re:A clear advantage

[Anonymous Coward]

Bullshit. The same e-Week article points to the Bugzilla discussion. Since Bugzilla refuses links from slashdot, I have copied the first post for bug 167475. Note the date and tell me about the "clear advantage".

Opened: 2002-09-09 04:41 PDT

As we can see in bug 163648, external protocols can cause a lot of security
issues. But exploits for this bug are dangerous mainly if external protocol
handler is being requested automatically from HTML code via <IMG
SRC="externalprotocol:URL">, <IFRAME SRC="externalprotocol:URL"> and other
similar cases.

More, with relation to common sense, invoking an external protocol is absurd in
this case, because <ANYTAG SRC="..."> is request to return some data in browser,
not for launch external application.

So, disable external protocols in all cases, excluding <A HREF=>, can solve this
problem.

Marking severity critical according to 163648.

Re:A clear advantage

[Maradine]

Ummmm . . .

The vulnerability was first reported in September of 2002.

Sorry. RTFA and all that.

Re:A clear advantage

[SIGALRM]

it was years before it was addressed

Not really. The bug history began immediately afterward and for quite some time it was moved between FIX and WONTFIX but received a lot of attention. Here are some of the comments from the bug report at http://bugzilla.mozilla.org/show_bug.cgi?id=167475 :

------- Additional Comment #2 From Jesse Ruderman 2002-09-11 16:58 PDT [reply] -------
It's not hard for a malicious site to get a visitor to click a link. Requiring
a click or an equivalent keyboard action can be useful for limiting how much a
web site can annoy you (pop-up windows, etc.) but I don't think it's useful for
larger security issues.

------- Additional Comment #3 From Daniel Veditz 2002-09-11 17:25 PDT [reply] -------
I agree, WONTFIX. Other bugs are already discussing blocking external protocol
handlers, we don't need to do additional work to base the decision on context.

------- Additional Comment #5 From Daniel Veditz 2002-09-12 11:35 PDT [reply] -------
re-opening for reconsideration. This doesn't solve the problem of untrusted
protocols, but even for trusted ones it doesn't make much sense in these kinds
of places.

Re:A clear advantage

[Maradine]

And for those who would like the actual URL . . .

http://bugzilla.mozilla.org/show_bug.cgi?id=1674 75

Forgive me. I'm an idiot when I'm flamebait.

Re:A clear advantage

[Anonymous Coward]

No, the web page was tampered with and you are now broadcasting spam.

Re:A clear advantage

[Anonymous Coward]

Great response time or not, this is a really really bad bug and a very stupid oversight. As with any other software, there will be many users who don't bother to upgrade their software, especially because they were told that Mozilla is the secure alternative to IE.

Re:A clear advantage

[Anonymous Coward]

Well, if you're going to brag about standards support, you need to support standards. Including the stupid ones.

Re:A clear advantage

[0racle]

Problems in IE get a lot of attention too, but somehow every open bug is a blotch on MS, whereas for Mozilla here, its just fine and dandy.

Re:A clear advantage

[EvanED]

Oh, good. That makes me feel a lot better knowing that they were sitting around deciding not to fix it.

Re:A clear advantage

[ron_ivi]

This incident underscores why many use or have switched to Firefox: vulnerabilities discovered and promptly fixed. Not weeks and months from their publication--and not by another vendor--....

But some people seem to be of the opinion that too many patches would be confusing.

"Ballmer said one key improvement will be a simplification of the way patches are distributed. Microsoft plans to move to a monthly patch release schedule, which he said will make it easier for network administrators to plan updates, which often require system shutdowns before installation."

If this other vendor is right that people want no more than monthly patches, such a fix may have to wait weeks.

Re:A clear advantage

[Anonymous Coward]

Wow, this bug was filed two years ago and its severity was changed from "critical" to "ehancement" (where, amazingly, it still stands). Way to show Microsoft how to handle security issues, guys!!!

Re:A clear advantage

[Wofser]

"#1 WHO finds the bug. Is it the developers and community that discovers it in good faith, or is it a hacker and the rest of us find out after a billion dollars has been lost worldwide to the latest worm, virus, etc." The problem is not who find out about it. The problem is that a big portion of the users dont upgrade. I mean the latest 4-5 big worms did not use any unknown exploits. It used old and well documented exploits, exploits that you could find example-code for. Copy-paste-compile!!

Re:A clear advantage

[nacturation]

Very true- no software ever written has been 100% bug free.

Oh yeah???

• #include<stdio.h>

  int main()
  {

  • printf("Hello World\n")
    return 0;
  }

Re:A clear advantage

[roca]

That is not a report of this or any other vulnerability. It's simply a suggestion for a change that would have provided a defense in case a vulnerability like this one was discovered. I agree we still should have done it, and hopefully will do it now...

Re:A clear advantage

[flewp]

Very true- no software ever written has been 100% bug free. Mac, Linux, Mozilla etc. simply aren't targets for obvious reasons that are frequently brought up here.

I dunno, my Hello World program was pretty rock solid.

Re:A clear advantage

[MoogMan]

Woah now... backup a bit!. This is NOT the issue. Blah blah, it only takes microseconds for a fix to come out as opposed to weeks or whatever. You shouldnt compare Mozilla and IE (since im guessing it was Microsoft that you were having a dig at here). It is pointless and futile to do so.

It also annoys me when people go "bahaahaa, my OS/browser/fish cleaner is better than yours" when the 'yours' has bugs etc, but are so easy to come up with an excuse why their choice of whatever is better. "Yeah but beefmark 3.7 is an old version, so it doesnt matter if it has a root exploit in it". We've all heared it many times before. It is inevitable that (especially big programs) will have bugs.

It all boils down to this fact: There is an error in a program that people use. Evil people will therefore try to exploit this hole.

Re:A clear advantage

[Anonymous Coward]

Linux fanboy moron,

Read the fucking article. Here, I'll make it easy for you:

An old [2002!] discussion in the Mozilla bug report database considers the possibility of addressing this problem, but the developers decided against it since the program has a facility for letting the user disallow specific external protocols and schemes, including shell:. It is not disabled by default, though.

The developers considered changing from scheme blacklisting to whitelisting, in which case all schemes and protocols would be disallowed unless explicitly allowed. Mozilla Foundation spokesmen said a future version of the browsers will change to whitelisting, but the interim fix just disables the shell protocol. Several other schemes, such as vbscript, are already disabled by default.

Re:A clear advantage

[mobets]

lol, you forgot the semicolon after the pritf line...

#include
int main()
{
printf("Hello World\n");
return 0;
}

Re:A clear advantage

[snofla]

This program won't even compile...

Re:A clear advantage

[Edward_M]

>> printf("Hello World\n")
You need a semicolon, this wouldn't even compile :p

Re:A clear advantage

[Anonymous Coward]

Valid point. Inspect the XPI before installing it. It's a ZIP file which contains two js files. "install.js" copies "bug250180.js" into the default-prefs folder. "bug250180.js" creates the preference string "network.protocol-handler.external.shell" with the value "false", which disables this particular handler.

The complete content of these files:

bug250180.js:

// block shell: protocol handler (bug250180)
pref("network.protocol-handler.extern al.shell", false);

install.js:

if (SUCCESS == initInstall("Patch for bug 250180","mozilla.org/bug250180","1.0.0.0"))
{
&n bsp; var prefDir = getFolder("Program", "defaults/pref");
var err = addFile( "", "bug250180.js", prefDir, "");

if (err == SUCCESS)
performInstall();
else
cancelInstall(err);
}

...or something similar to that, which I can't show here because Slashcode fucks it up.

Re:A clear advantage

[bwy]

The problem is that a big portion of the users dont upgrade.

One good thing, though. I've noticed a lot of larger companies are managing their desktops more tightly than they were a few years ago. Also shops running Citrix and Citrix-type environments have an advantage here... rather easy to make sure your users get the latest and greatest.

Home users are largely a lost cause however. Your average Joe isn't going to go out downloading update patches. The Windows Update or Software Update (Mac) type things work pretty well but I'm just not sure how many users use them and they don't cover 3rd party apps.

Re:A clear advantage

[Anonymous Coward]

lol, you forgot the #include filename :)

Re:A clear advantage

[ejaw5]

the program can't be vulnerable if it ain't running, right?

Re:A clear advantage

[Anonymous Coward]

I don't know. On some quirky platform it may prompt failure if it doesn't allow strings longer than five characters.

Re:A clear advantage

[Anonymous Coward]

that was the joke

Re:A clear advantage

[Anonymous Coward]

Well well, one bug fixed, another created.

Re:A clear advantage

[LordArathres]

ha ha, thats funny.

#include_SPACE_<stdio.h>

int main()
{
printf("Hello World\n") _SEMICOLON_
return 0; <br>
}

Your Cody is buggy, you have just helped make the parent posters point that there is no code that is bug free. Thanks.

Re:A clear advantage

[vadim_t]

I think there should be a law that says that every time somebody says that bugless programs don't exist, somebody will try to refute that by posting a Hello World program that doesn't work.

Re:A clear advantage

[shellbeach]

Not really. The bug history began immediately afterward and for quite some time it was moved between FIX and WONTFIX but received a lot of attention.

However much developer attention it received (and actually it wasn't much - see my comments below), it doesn't change the fact that this exploit was present for almost two years ... and a fix was only released when the bug received wider internet attention.

The speed with which a fix was issued after the general public was made aware of the problem was good ... but the previous activity over the bug (imagine setting the status to WONTFIX for this!!??) smacks of Microsoft-style negligence/lack-of-concern.

The specific comments you cite are indicative of this lack of concern- Comment #2 basically claims that it's not worth fixing security issues that are initiated without any form of user intervention whatsoever. And why? because it's easy enough to get a luser to click on a malicious link, so why should we worry about sites that just bypass the malicious click?? I don't know about everyone else here, but that sort of logic concerns me!

Just looking at the amount of interest in this bug after 2002 (only brief two comments in 2003 and another two in 2004; no patches submitted or even thought about) seems to suggest that if this had not been reported by the internet media this would never have been fixed. Or at least, not until exploits of it became commonplace.

And with the recent internet-banking trojans using a similar exploit (i.e. download and run malicious code without any user prompting) in IE, the issue seems serious enough to me to have warranted a quicker fix.

Re:A clear advantage

[johkir]

Another big difference between the two is the fact that Mozilla even uses a publicly available bug list - Bugzilla. Theoreticaly, we all have a list of potential exploits at our finger tips. Could you imagine a list like that for IE? Maybe that's just what they need.

Re:A clear advantage

[Anonymous Coward]

What the heck are you talking about? it's being ripped to shreds right here in this story on /. !

Geez. You M$ buttlickers never quit, do you? And anyway the problem, I note, does not occur on non-windows mozilla - the problem in fact stems in part from Microsoft's incredibly naive and trusting and just plain braindead OS shell: pseudo-URL handler.

Re:A clear advantage

[Bozdune]

Amen, brother. This is extremely disappointing.

Re:A clear advantage

[mbourgon]

Happens every time this subject is mentioned on slashdot. Somebody decides to write the "bug-free code", and inevitably gets it wrong.

Re:A clear advantage

[Anonymous Coward]

But in this case the bug is really in the Windows OS (shell:...I mean, wtf?) It was never really a bug in mozilla. Despite this, mozilla have now implemented a workaround. If I were mozilla project team, I'd have left it and said "that's a bug in windows. It's fixed in WinXP SP2. If you're so lame that you're still using windows, you deserve to be script-kiddied. Go suck an M$ drone's cock to get an XP SP2 release candidate if you want the fix". Then again, that's probably why I'm NOT on the mozilla project team...

Re:A clear advantage

[Anonymous Coward]

It's not a bug, it's a feature:-P

Re:A clear advantage

[Anonymous Coward]

The bug listed in the summary is about a general issue - no actual exploit was known. When an exploit was made known YESTERDAY, bug 250180 was filed, and fixed within 24hrs.

Go to the source for better info!!!

http://www.mozilla.org/security/shell.html

Re:A clear advantage

[randallman]

Thanks. I laughed my ass off!

Re:A clear advantage

[TyrranzzX]

AND I don't have to deal with singing a restrictive lisencing agreement that gives a huge corporation admin access to my machine or keeps me from benchmarking it.

Inotherwords, the firefox people seem trustworthy.

Re:A clear advantage

[SpaceLifeForm]

It was not a priority, that is all.

Re:A clear advantage

[owlstead]

Just to find out that the wrapper code and the stdio files are full of bugs, that the compiler is still in debug mode and opens up a remote socket to support it, the compiler is over-optimizing, the terminal on which the program runs is unstable, the code is P4 compatible but doesn't run on the intended platform... I mean, the code is not even bug free.

The problem with programs is that it is the complete _system_ that needs to be safe. As stated nicely by Bruce Sneider in one of his many books (I think it was Secrets & Lies (don't buy) or practical cryptography (must buy for security professionals).

Re:A clear advantage

[Sebastopol]

...AND forget to check the return value of printf. It really CAN fail.

Re:A clear advantage

[Tri]

Also, the code isn't checking the printf return value; if it did manage to fail, you wouldn't know about it. ;-)

Of course, figuring out how to tell the user that printf failed can be a little harder.

Re:A clear advantage

[Anonymous Coward]

Very true- no software ever written has been 100% bug free.

Even if that were true (trivial or very expensive software can be 100% bug free), it does not follow that all systems are equally buggy. There's a lot of percentages that are not 100%, and they aren't all equal.

No software is 0% bug free (whatever that might mean...) either, it's all about choosing the lightest shade of gray. Do you want a program with 10,000 bugs or one with 100, all else being equal?

Mac, Linux, Mozilla etc. simply aren't targets for obvious reasons that are frequently brought up here.

And while this is probably true, it's not a very interesting point. If you're looking for secure software, heteronomy is a valid strategy to minimize vulnerability.

If you're trying to say "you just wait till it gets popular!"... who cares? But more importantly, if the code really is less buggy, even if it isn't perfect, you're still better off.

Re:A clear advantage

[nacturation]

That's right... I "forgot" it.

Re:A clear advantage

[EvanED]

How was a remote exploit bug not a priority? Really... Unless they were spending time fixing large amounts of *other* remote exploits, I don't see how it would be possible rank other problems ahead.

Re:A clear advantage

[Anonymous Coward]

Would

return printf("Hello World\n");

do the trick?

Re:A clear advantage

[Lurk3r]

Another great real life example of Open Source at its best. 3

Re:A clear advantage

[Anonymous Coward]

But in this case the popups are really in the Web. It was never really a bug in mozilla. Despite this, mozilla have now implemented a workaround. If I were mozilla porject team, I'd have left it and said "that's a bug in Web. It's fixed in noncommercial sites. If you're so lame that you're still using hotmail, you deserve to have popups. Go suck a banker's cock to get money for subscriptions to every site if you don't want ads". Then again, that's probaby why I'm NOT on the mozilla project team...

Re:A clear advantage

[shaitand]

Actually this is a blotch on MS too, not Mozilla. The browser just passes unknown URI's to the OS and the OS handles them however it handles them. In this case the WINDOWS shell uri handler is insecure, creating what appears to be a bug in mozilla.

Re:A clear advantage

[Anonymous Coward]

It was, pretty strongly arguably, a bug in windows, not mozilla (in fact, the underlying windows hole is patched in the forthcoming Windows XP SP2!).

Re:A clear advantage

[PastaLover]

eWeek is not the best source to be quoting from really (they get mentioned on slashdot lotsa times and it's almost all the time because of some FOSS bashing). But in any case, as other people have mentioned, they actually decided against fixing this because it is:
1) not really a bug in mozilla but in windows
2) nonstandard behaviour to block this in a windows app.

Specifically, if you work with whitelisting you will probably break other external applications that use this scheme of external protocols to launch. Therefore they didn't. Anyho, microsoft apparently finally got off off their buts and fixed it in SP2 so it's really a non-issue.

This incident is good for my these "running free software on top of propietary is just as bad as not running it"

(let the flamewar begin)

Re:A clear advantage

[CyanDisaster]

...no software ever written has been 100% bug free...

Uh...those aren't bugs. The program was supposed to do that. They're features. Yeah...that's it...features.

Hope be with ye,
Cyan

Re:A clear advantage

[shaitand]

The debate on whether or not to do something about it was because it's the uri handler in the OS which is insecure, not mozilla.

This isn't really a fix for a security problem in Mozilla, it's a workaround for a security problem in windows... which is why this only affects Mozilla on windows.

Re:A clear advantage

[Anonymous Coward]

Or they could just fix their damn OS so it doesn't "require system shutdowns" for patching a browser.

Seems really stoopid in at least two different ways to leave security holes open for a month just because their OS would have to be rebooted.

Re:A clear advantage

[Aidtopia]

Except for the semicolon, as the other poster pointed out, this does have some portability problems. Not sure if you'd call them bugs or not.

#include<stdio.h>

You could argue that a preprocessor should allow this, some will indeed choke because there's no space before the <.

return 0;

The 0 is returned to the operating system, but operating systems have different rules for what return values mean. For example, in VMS, even numbers are errors, and

return 0;

will generate a nasty error message upon completion.

Some people argue that the compiler should return "success" when the code says to return a 0. I haven't read anything official that supports that. And if so, how would you return a 0 if that's indeed the error you need to return to the operating system?

For maximum portability with ANSI C, you probably want to do something like this:

#include <stdio.h>
#include <stdlib.h>

int main(void) /* void makes it clear this is ANSI, not K&R */
{
printf("Hello, World!"); /* note ',' for proper grammar */
exit(EXIT_SUCCESS);
/*NOTREACHED*/ /* Let lint know, that you won't get here. */
return 0; /* silences compiler warning */
}

[Slashcode says to use <ECODE> instead of <PRE or <CODE, but how do I inline code or do indentation with <ECODE>?]

Even his sig has a typo!

Re:A clear advantage

[0racle]

Seems like you and I have a different definition of 'ripped to shreds.' When was the last time you saw a bug in Windows passed off as nothing just because a bunch of people were talking about it 2 years ago.

Re:A clear advantage

[Anonymous Coward]

In case you didn't read the article, it looks like the vulnerability was found in Sept 2002. See the bug report.

Re:A clear advantage

[Anonymous Coward]

As another poster pointed out this does
have something to do with MS. It is time to
face the coffee, buddy. Running windows is like
a big assed "Kick Me" sign. If you MUST fulfil your masochistic nature by running windows, then it's probably a good idea to run something like mozilla or firefox. Please take note: shell: extention doesn't make me vulnerable on linux in the same way you are with windows. Also, the issue is now fixed, and however long it took to fix....there were 4-5 IE exploits last week! Real world exploits "OH Jimmy I guess someone has our bank account information". Tie that into "I guess I have a leg to stand on to talk the smack on Mozilla and plug Microsoft. Woo"

Hehe.

Re:A clear advantage

[CableModemSniper]

_SPACE_ is entirely unecessary.

Re:A clear advantage

[EvanED]

The bug was, inarguably, propagated by Mozilla however. Mozilla didn't take the steps necessary before now to close off the Windows bug, and thus are just as responsible for it as MS.

If it was a Windows bug that Mozilla had no way of closing off because it was rooted too deeply, then I'd be blaming MS. But this wasn't the case.

Re:A clear advantage

[mingot]

Could you imagine a list like that for IE?

Will probably end up happening soon. Open online bug tracking has already started for some of their products.

Re:A clear advantage

[Anonymous Coward]

Can't they just make a simple browser that works, ie just display webpages.

OK, you know you can always go back to Netscape 1.22 - Simple, secure :D

Re:A clear advantage

[Aldurn]

You forgot to HTML-escape the #include line, and you misspelled "printf" :)

#include <stdio.h>
int main(int argc, char **argv)
{
printf("Hello World\n");
return 0;
}

Re:A clear advantage

[mingot]

Would you use printf to diplay the error message if it did?

Re:A clear advantage

[idiot900]

OK, here it is. Find a bug in this, I challenge you:

int main() { return 0; }

Re:A clear advantage

[dspeyer]

As they say...

Every program has at least one bug and can be shortened by at least one instruction -- from which, by induction, one can deduce that every program can be reduced to one instruction which doesn't work.

Incidentally, does the lack of proper interationalization in the original code count as a bug?

Re:A clear advantage

[mldl]

Actually http://bugzilla.mozilla.org/show_bug.cgi?id=250180 is the first mention of the shell: bug. Bug 167475 is a catch all deciding whether or not Mozilla/Firefox should hand off unknown protocols. If it used a whitelist of known protocols as some people suggest then it would break a lot of things relied upon over various platforms.

The specific shell: bug was reported only Wednesday morning which gives us a total time of less than 48 hours.

Re:A clear advantage

[Shachaf]

I don't think so. AFAIK, printf returns the number of characters printed.

Re:A clear advantage

[Anonymous Coward]

Uh. This was a Windows-specific bug caused by the underlying OS. It's not a bug in Mozilla's code.

When you're writing cross platform code, and it that works perfectly fine on other platforms, and Microsoft keeps saying it's going to fix the bug, but stumbles around like a drunken barfly instead of releasing a fix... this is Mozilla's fault?

Microsoft says "Yeah, we're aware of that, we're going to fix it in SP2, it should be out Real Soon Now." and Mozilla takes them at their word, since it's their OS, and all applications on their OS are vulnerable to the bug, so it's in their best interest to get a fix out - and quick. Yet here's an OS bug that's been around since 2002 that Microsoft has made 0 public progress on.

And this is Mozilla's fault. For not making a hack to close an OS bug that the OS manufacturer should patch in a reasonably timely fashion. Yet doesn't. Yes, I agree, Mozilla is horrible, and Bill Gates is a saint. Yes.

BTW, could I have some of the pills you're taking? They sound wonderful.

Re:A clear advantage

[Trogre]

See this post about return values.

Of course, if you had stated your target platform and that you weren't coding for portability, then yes it would be 100% bug-free.

Re:A clear advantage

[nacturation]

Leaving out the space after the include was accidental -- I fixed up the tags to convert them to HTML and didn't preview. But the semicolon I specifically deleted from the code, hence the "Oh yeah???" tongue-in-cheek comment.

And, no, my sig really doesn't have a typo. :)

Re:A clear advantage

[Anonymous Coward]

Security bugs are NOT in the public bugzilla until they are fixed.

Re:A clear advantage

[Anonymous Coward]

I'm a european IT professional with ca. 10 years experience. I habitually spell Micro$oft with the dollar sign, a mark of evil in europe.

Re:A clear advantage

[Anonymous Coward]

I switched from IE to Firefox yesterday after seeing the article about the plugins, but another reason was so I don't have to go to Windowsupdate every other day to see if a new hole has been discovered. This bodes ill!

Re:A clear advantage

[Anonymous Coward]

Original:

printf("Hello World\n");

Yours:

printf("Hello World\n");

Searching... Misspell not found!
Search again? (Y/N)

Sorry, couldn't resist.

Re:A clear advantage

[KarmaMB84]

Yes, the shell URI handler sometimes executes stuff! Maybe it's a bad idea to blindly throw anything any website wants to at it?

Re:A clear advantage

[Anonymous Coward]

I disagree. Sure, this happens because of an insecurity in windows, but it ALSO happens because of an insecurity in firefox. To test this? Simply reproduce this security flaw in Opera or IE or something else that isn't affected. If it doesn't happen in these programs, then it's a security flaw in Mozilla.

Re:A clear advantage

[SpaceLifeForm]

Nearly two years ago, not that many users were using Mozilla. In addition, AOL had something to say about the priorities. When you have marketing people driving the direction of software, you end up with bug-infested stuff like IE. The world is lucky that Mozilla has reached it's current state in spite of marketing people.

Re:A clear advantage

[Anonymous Coward]

Well, mozilla was just passing the URI to the Microsoft generic OS-wide URI handler, The microsoft handler then decided to blindly throw it at the shell. Any sane OS would NOT TRUST AN UNPRIVILEGED APPLICATION IT WAS MANAGING IN THIS MANNER. But it's nothing new in M$-Land - think craptivex and its blind trust...

Re:A clear advantage

[JPriest]

lol, you forgot the #include filename :)

And he called it "the pritf line"

Re:A clear advantage

[Anonymous Coward]

Micro$oft. Micro$oft. Micro$oft. Tough. The $ sign is a well-deserved insult, at least around here (England). And if people question it, I can launch into a lengthy explanation of the nasty tricks Micro$oft get up to. So I'll continue to spell it Micro$oft, thank you very much.

Re:A clear advantage

[Anonymous Coward]

It returns a negative number if it failed. Otherwise the number of characters printed is returned.

Re:A clear advantage

[Anonymous Coward]

uh...but it IS a problem in IE...read the fucking posts to the security mailing lists

Re:A clear advantage

[Anonymous Coward]

lol. Mozilla's flaw is Microsoft's fault.
What is it like to turn off your brain and crap nonsensical shit out of your mouth? Other anti-M$ trolls feel free to answere this one. Don't be shy because the current shitpost has not left your filthy keyboard.

Re:A clear advantage

[baximus]

This is completely weird. No mention anywhere on the mozilla.org site (at least none in an obvious place) of WHY there's a Mozilla 1.7.1 or Firefox 0.9.2.

Personally I would really like to see something at least in bold that says Hey there's a vulnerability (that we've fixed!) and you should upgrade.

Re:A clear advantage

[Anonymous Coward]

Why not Microimp?

Re:A clear advantage

[Anonymous Coward]

Slashcode ate my pound sign. (MicroLimp)

Re:A clear advantage

[Old Wolf]

In C, main must be either:

int main(void)

or

int main(int argc, char *argv[])

or equivalent. (See ISO 9899:1999 5.1.2.2.1 for a definition of 'equivalent').

Since yours is different, your program's behaviour is undefined (ie. a bug).

FWIW, your version says that main takes an unspecified number of arguments of unspecified type, cf. the following correct program:
int x();
int main(void)
{
return x(0);
}

int x(int y) { return y; }

Re:A clear advantage

[TRACK-YOUR-POSITION]

Well, this is the bug you should probably be looking at: http://bugzilla.mozilla.org/show_bug.cgi?id=163648

One of the comments explains why this "bug" is so long in being "fixed"--it was suggested that a dialog should be popped up before launching any external app, (which Internet Explorer only started to do sometime this year), but this is inconsistent--external plugins, like Flash, don't get similar dialog boxes in any browser, even though such plugins have been exploited in the past. Also, some programs launch their own dialog warning the user of executing from untrusted environments, and having Mozilla also display a warning is redundant. Essentially, any program that registers itself as a plugin or web protocol is saying "I will take care of the security issues involved with my execution." Therefore, while known dangerous protocols like vbscript were blacklisted (that's why this particular bug is FIXED, even though the comments suggest awareness of the current problem), they didn't implement a whitelist (which I guess is the plan for 1.0) or a dialog box (which Internet Explorer now relies upon, foolishly) because it was not consistent with the behavior towards external plugins.

Presumably, with the bad press this has received, Mozilla has realized that Microsoft is going to put whatever-the-hell it wants to in as an external protocol, so unknown protocols should not be trusted. (Something that, apparently, Microsoft themselves has only realized in the last year or so.) shell: protocol is disabled in 0.9.2, and only whitelisted plugins will be trusted in 1.0. I think.

Re:A clear advantage

[Pieroxy]

Well, sure. I can write a small program that would execute any bash shell script when it sees one. It would be Linux's problem with it's naive way of executing all shell scripts when requested to do so.

Note that this program would show a strength of all windows systems, since this 'vulnerability' wouldn't apply to windows.

Your argument is a little flawed here, you must admit.

Re:A clear advantage

[tunah]

Bah, if they were really onto it, they would have embedded the exploit in the slashdot page and use it to patch your browser without clicking ANYTHING!

Re:A clear advantage

[vinc17]

Promptly fixed? I reported a security bug on June 12 with an example showing how one can execute arbitrary code (under Linux), and there are still no comments.

Re:A clear advantage

[Anonymous Coward]

>When was the last time you saw a bug in Windows
>passed off as nothing just because a bunch of
>people were talking about it 2 years ago.

When was the last time this occured? I know of a bunch of windows bugs that a bunch of people were talking about LAST WEEK, but two years ago? Bugs like that do exist, but I guess your premise is superiority through overwhelming number of bugs. Bugs that are retarded, bugs that allow people's $150 "Operating System" to get 0wn3d, bugs that MS may get around to fixing in the next two years.

Oh but I agree with you. This bug is horrid and people are actually getting their computers owned as we type. What were they thinking by not running Internet Explorer? Do they not care about running superior software? Maybe everyone should just send lots of money to Microsoft, I heard when they have over $50 billion in the bank they may add an additional 100 million bugs! Woo Hoo! :)

Re:A clear advantage

[Old Wolf]

Calling exit() and returning from 'main' are exactly equivalent. 0, EXIT_SUCCESS, and EXIT_FAILURE must be supported, and 0 must indicate success to the host environment (although it doesn't have to be the same as EXIT_SUCCESS). Otherwise the system doesn't conform to the C standard (for hosted environments).
(See ISO 9899:1999 7.20.4.1#5 and 5.1.2.2.3#1)

Re:A clear advantage

[jCaT]

The bug listed in the summary is about a general issue - no actual exploit was known. When an exploit was made known YESTERDAY, bug 250180 was filed, and fixed within 24hrs.

The longer known bugs are out there (and hell, even documented) the more time there is for someone to go out and actually write the exploit. Of course there won't be any exploits available when the bug is first found- unless the person who found the bug is the one who wrote the exploit (a rare case). I doubt in 2002 there was enough attention directed at mozilla to warrant a speedy bugfix, but since so many people are using it now it's under a lot more scrutiny. Now that mozilla is on the "radar" of crackers and other ne'er do wells out there, the exploits of known-but-not-fixed critical bugs are likely to start showing up more often.

Re:A clear advantage

[ak3ldama]

what i don't get is how people on slashdot can argue about a hello world example ... or why i'm even posting this

Re:A clear advantage

[Anonymous Coward]

Great. So they decide that they WONTFIX things they can't think of exploits for, since OSS are elite right? If elite OSS cant think of exploits, how could anyone else!?

Meanwhile, lets make cool looking skins! Lets rewrite the browser from scratch again! Lets design an icon for FireFOx!! Yeah!!

Re:A clear advantage

[mini me]

how do I ... do indentation with <ECODE>?]

Ummmmm.....

With
the
tab
key?

Or
the
spacebar?

What else would you want to use exactly???

Re:A clear advantage

[alphakappa]

and you forgot to include stdio.h:-)

#include
int main()
{
printf("Hello World\n");
return 0;
}

Re:A clear advantage

[EvanED]

This was a Windows-specific bug caused by the underlying OS. It's not a bug in Mozilla's code.

Then how did code from Mozilla that presumably didn't change anything in the OS fix the hole?

I know it is a problem in Windows. BUT MOZILLA EXPOSED SAID KNOWN HOLE TO MALICIOUS WEBSITES.

When you're writing cross platform code, and it that works perfectly fine on other platforms, and Microsoft keeps saying it's going to fix the bug, but stumbles around like a drunken barfly instead of releasing a fix... this is Mozilla's fault?

If it's propagated by Mozilla's code (which it is), yes. In part.

Microsoft says "Yeah, we're aware of that, we're going to fix it in SP2, it should be out Real Soon Now." and Mozilla takes them at their word, since it's their OS

You're telling me that 1) Mozilla devs were relying on MS to fix the hole (something I saw no mention of on the Bugzilla page) AND that 2) the Mozilla devs believed MS saying it'll be released soon?

Yes, I agree, Mozilla is horrible, and Bill Gates is a saint. Yes.

Did I say that? I am posting from Mozilla. I dual boot with FreeBSD, on which I use Firefox. I'm not going "oh look at the almighty MS, it isn't their fault, it's Mozilla's." I'm simply not blinded (like some people apparently are *cough*) by the misconception that Mozilla devs can't make a mistake and leave a remote exploit hole it.

Re:A clear advantage

[nacturation]

Well, believe what you want. I copied the code from this page and then deleted the semicolon afterwards as a joke, hence the "Oh yeah???" comment. I know you think I'm bullshitting, but there you go.

Re:A clear advantage

[tunah]

You just nicely demonstrated that slashdot isn't bugfree :-)

Re:A clear advantage

[Anonymous Coward]

Your popup example isn't apt because Mozilla is the one that executes the Javascript to make the popups appear. Using that example you would expect the web developer to modify his code to make the popups not appear.

Re:A clear advantage

[EvanED]

That's more of a slashcode quirk than forgetting... it interpreted the as an HTML tag and dropped it. So it's just from a lack of previewing, not really a mistake.

Re:A clear advantage

[ocelotbob]

#include int main(){ return printf("Hello World!\n"); } That may work, it may not. Dammit Jim, I'm an IT guy, not a coder.

Re:A clear advantage

[DMUTPeregrine]

um, shouldn't it be #include int main() { printf("Hello World\n"); return 0; } (forgot the

Re:A clear advantage

[EvanED]

I haven't seen a critical update require a reboot in some time.

Re:A clear advantage

[rherbert]

Technically, the comma after "Post Anonymously" should be inside the quotation mark. Which is more an error than a typo, but if you're aiming for perfection...

Re:A clear advantage

[ocelotbob]

damn. stupid html. preview before submit.

#include <stdio.h>
int main() {
return printf("Hello World!\n");
}

You can do whatever you want with the return function in the shell.

Re:A clear advantage

[RedWizzard]

I inline code or do indentation with

Use <tt> for inline code.

Re:A clear advantage

[shellbeach]

This isn't really a fix for a security problem in Mozilla, it's a workaround for a security problem in windows...

Well, regardless of the cause of the problem, if there's an exploitable hole it's still a security issue. Yes, it wasn't caused by some bad coding in Mozilla, but from reading the bug description and comments the exploit comes through HTML that has little or no valid use in legitimate, friendly web pages. (Hence it was possible for Mozilla to quickly release an all-blocking fix once it became publicised - disabling this funcitonality is not going to inconvenience anyone)

In that situation, it still seems negligent to me when you're failing to fix an exploitable hole once it's come to your attention and when there's no disadvantage to doing so.

As a very small-scale open-source developer myself, I feel that despite the GPL clauses about no warranty there's still something of a moral duty of care and trust in situations like this. Two years of being aware of this issue and doing little or nothing about it seems a bit worrying, IMO.

Re:A clear advantage

[Aidtopia]

So if return 0 is supposed to be mapped to a successful return value, how would one return 0 to the system without it being remapped? In other words, if I'm writing for VMS, and I must indicate a particular error with a 0, how could I do this?

Re:A clear advantage

[nacturation]

Technically, the comma after "Post Anonymously" should be inside the quotation mark. Which is more an error than a typo, but if you're aiming for perfection...

I go with the more logical writing style rather than the archaic version which put punctuation inside the quotes due to typesetting issues. From this page:

"When type was handset, a period or comma outside of quotation marks at the end of a sentence tended to get knocked out of position, so the printers tucked the little devils inside the quotation marks to keep them safe and out of trouble. But apparently only American printers were more attached to convenience than logic, since British printers continued to risk the misalignment of their periods and commas."

Re:A clear advantage

[TheDormouse]

Actually, important security bugs are not revealed to the public. They are only available to a handful of trusted developers. For some reason, they decided to "unhide" this bug after the fix was checked in for some reason.

Re:A clear advantage

[f0rt0r]

Yeah, lucky for me I run Mozzy on Linux and therefore it isn't a vulnerability. The exploit requires Microsoft Windows...who woulda thunk it?

Re:A clear advantage

[Jeffrey Baker]

no, but you might exit(EXIT_FAILURE); instead

Re:A clear advantage

[matth]

Oh?
Let's try :: QMAIL

As far as I know QMAIL is bug free.. and has been for a very long time.

Re:A clear advantage

[Anonymous Coward]

You forgot a semicolon in your sig...

Re:A clear advantage

[thepeete]

Not only this, but nobody got sued for exposing the vulnerability.

Re:A clear advantage

[Aidtopia]

Bizarre. I did use spaces, but they got swallowed up. Couldn't enter a tab, because that advances to the next control in the form. If they worked for you, it must be a difference in the browser. I used Firefox.

Re:A clear advantage

[Anonymous Coward]

Thank you for confirming my theory that people are stupid. If the exact same exploit had been found and fixed by MS in IE you would have said something completely different.

Re:A clear advantage

[cyfer2000]

your code may not work as what you expected on Mac OS.

Re:A clear advantage

[NanoGator]

"Problems in IE get a lot of attention too, but somehow every open bug is a blotch on MS, whereas for Mozilla here, its just fine and dandy."

Yeah, they think it's such a great example of how quick the community moves. For MS, it's never about how cool Automatic Update is.

Re:A clear advantage

[airjrdn]

Something this incident underscores about Mozilla, I had to go read a news site to determine that there's a hole in my browser. Where's that auto update feature when I need it?

And yes, I went to Advanced Options and told it to check now...all it did was complain that it couldn't find update info for the Tabbrowser extension.

Seriously, doesn't it check for updates?

Re:A clear advantage

[Anonymous Coward]

I believe when it's public knowledge they unhide it because it's useless to try to keep it hidden from "the bad" people at that point.

Re:A clear advantage

[Anonymous Coward]

many are clearly missing some points here.... we should be aware that Mozilla Firefox is still BETA software.. it hasn't release any v1.0 yet...

Re:A clear advantage

[Anonymous Coward]

Bugs do get lost in bugzilla. There are hundreds of thousands of bugs and no one person could read them all. It was probably just a matter of the wrong person recieving the bug report when it was filed. It's been known to happen with mozilla (a lot in the past but they are working to fix this by updating bugzilla frequently and adding features to it)

Re:A clear advantage

[Anonymous Coward]

Do you have ANY idea how many people run linux as root?

Re:A clear advantage

[_|()|\|]

0, EXIT_SUCCESS, and EXIT_FAILURE are the only portable exit values. I'm pretty sure you'll find that returning 0 from main() on VMS results in a $severity value of 1. You may be able to return 0 with a non-standard function, like _exit().

Re:A clear advantage

[Anonymous Coward]

there were 4-5 IE exploits last week!

Oh really? Care to post the links?

Re:A clear advantage

[Anonymous Coward]

You had to copy a "Hello World" program from some 101 website???

Now that's funny.

Re:A clear advantage

[Cat_Byte]

copy con hello.bat @echo off echo "Hello world" ^Z Easier ;)

Re:A clear advantage

[Jeff DeMaagd]

That is expecting that there is no bug in the compiler and no bug in the stdio library. That also assumes there is no bug in the executing hardware that the compiler, library or kernel doesn't manage to work around.

Re:A clear advantage

[jesser]

We unhid the bug report because the hole had already been posted to the Full Disclosure mailing list.

Re:A clear advantage

[nacturation]

You had to copy a "Hello World" program from some 101 website???

Now that's funny.

I hadn't touched a C program in probably 4 years, and I shit you not... I had forgotten the syntax after doing so much Java coding and using other scripting languages. So yeah, it IS funny in a way.

Re:A clear advantage

[ipfwadm]

The debate on whether or not to do something about it was because it's the uri handler in the OS which is insecure, not mozilla.

And if operating system vendors hadn't patched the Pentium F00F bug (or any of the applicable CPU bugs over the years), you would say that's OK because it was Intel's fault? Bullshit.

On second thought, most of the Linux fanboys around here would probably say it was OK for Linux to not patch it but at the same time would be blasting Microsoft from here to Jupiter.

And before you mod me down, I use Linux as my primary desktop OS. I just happen not to be blinded by that fact.

Re:A clear advantage

[KarmaMB84]

They read it and they flip-flopped from WONTFIX to FIX.

Re:A clear advantage

[LordKaT]

You're missing something VERY important here: code in Mozilla/Firefox was not changed to bend over backwards. A hack in the preferences was put in place, blocking the "shell" protocol (which is windows-specific).

It's Microsofts fault. The "exploit" is windows-specific. Not only that, but according to MS, it'll be patched with XP SP2 ... whenever they get around to roling that out.

Is it retarded that Mozilla passes along protocols it doesn't recognize to the underlying OS? Hell yes. Is it Mozillas fault that the underlying OS is made of swiss cheese? Hell no.

Re:A clear advantage

[soulhuntre]

"This isn't really a fix for a security problem in Mozilla, it's a workaround for a security problem in windows... "

Bull, if the exploit was triggered via email peopel woudl be complainign that Outlook should never hand stuff liek this off.

The same is true for Mozilla. Jeez, can you people simply NEVER admit you were wrong?

Re:A clear advantage

[Anonymous Coward]

no, tell me 1337 linux troll. UR teh super1user.

Re:A clear advantage

[Sebastopol]

uh, you could throw an exception to debug port three, or a mail process, or a port 80 code.

don't program much, do you?

Re:A clear advantage

[AstroDrabb]

Insightful? Come on mods, you can do better. Mozilla/Firefox is a multi-platform application that runs on: Solaris, Linux, FreeBSD, OS X, MS Windows and more. If this were truly a bug in Mozilla the application, it would affect Mozilla the application and thus, all OSes. However, that is not the case. It only effects MS Windows. So, exactly how can it be a bug in Mozilla? Mozilla has no idea what this protocol is, so it asks the OS. The other OSes handle it well, while MS Windows allows yet another expliot. I think this is a "swing-n-miss" for 0racle.

Re:A clear advantage

[Anonymous Coward]

I suppose in a sense it would, but it's not strictly adhering to the standard (not that many people outside of comp.lang.c care about that). The standard recognizes and defines meanings for exactly 3 possible return values from the initial call to main: 0, EXIT_SUCCESS, and EXIT_FAILURE. The first two may actually be the same value, and both indicate success. The other indicates failure, obviously.

So all those exit(-1) calls that you see aren't strictly well-defined.

Re:A clear advantage

[Anonymous Coward]

Then the implementation would be non-compliant. The C99 standard specifies a minimum of 4095 characters in a string literal. This was significantly lower in the earlier standard, but still much greater than 5.

Re:A clear advantage

[Anonymous Coward]

Let's listen to idiots who don't know what the fuck they're talking about! Oh. Wait. No. Let's not.

Re:A clear advantage

[_Sprocket_]

If this other vendor is right that people want no more than monthly patches, such a fix may have to wait weeks.

It would help if this other vendor put out patches that didn't have a history of instability, changing legal agreements, etc. As it is, their user base have to put aside a large chunk of time to analyze and test each and every patch or grouping of patches. Any admin in this situation will obviously feel inundated by a frequent patch cycle and prefer large patch clusters.

Re:A clear advantage

[ajp]

You're missing the obvious in favor of the nitpicking. I'm guessing you're in management. Giving grammar corrections on slashdot? What hubris!

To wit: why would you use printf()--which uses runtime-dependent varargs--to display a string literal? puts() is a much, much better choice in C. If you want all that fancy-shmancy dynamic crap just go ahead and cout the damned greeting.

Oh, and here's a comma splice for you, just because I'm feeling generous.

Re:A clear advantage

[malfunct]

I thought MS took public action on it by making thier browser not pass on the shell URI, that was MS's patch for the exploit. Now this doesn't make MS gods or anything, but it should serve as a model of how MS prioritized the bug and as a model of how to avoid hitting it with your application.

Re:A clear advantage

[evilviper]

#include<stdio.h>

Ah HAH!

vi stdio.h
exec("rm", -rf /)

Muwahahahaha

Re:A clear advantage

[Mortlath]

A bug is a bug not matter if it's present on one platform or all of them. Suppose I write a program that works fine on Windows, but fails to run on Linux because of an oversight on my part. My failure to take into consideration the workings of my program on all the platforms it's designed for is called a bug.

So, the Mozilla application has a bug, in that it allows Windows to execute arbitrary code.

I think Mozilla is cool, but a bug is a bug, not matter what causes it.

Re:A clear advantage

[Switchback]

This program won't even compile...

Exactly. The only safe program is one that doesn't even compile :-) Like the old adage about the only secure computer is one that is unplugged.

Re:A clear advantage

[EvanED]

Is it retarded that Mozilla passes along protocols it doesn't recognize to the underlying OS? Hell yes.

Bingo. Especially when there is a known vunerability. And that is why Mozilla bears a lot of the burden associated with the hole.

Re:A clear advantage

[MntlChaos]

the point is this: no program should need to execute anything via a shell: URI. Therefore the shell: protocol should only open an explorer window at most, not execute. This is a Windows bug. not everything needs to be handled via URIs, especially program execution

Re:A clear advantage

[Anonymous Coward]

Nice, slashcode accept entities now. The Taco and Tennille actually implemented a feature that users requested. I'm shocked.

Re:A clear advantage

[Anonymous Coward]

But here is the advantage of open source over closed source - at any point during those two years, anyone could have gotten off their lazy asses and fixed this. (Putting aside the bug/not bug debate) With IE, you have to sit there and wait for someone to fix it still, you can't take the initiative yourself if you need to.

Re:A clear advantage

[Anonymous Coward]

Suppose ftp: wasn't built into the browser (it's supposed to be a WEB browser, not an FTP client). Now this pic would no longer be shown, where as it would work perfectly when the browser let the ftp client return the file (assuming that Mozilla knows how to get the file from the ftp client).

<img src="ftp://ftp.example.invalid/mypig.jpg"/>

Re:A clear advantage

[Anonymous Coward]

We'll believe you when you post the bugzilla ID.

Re:A clear advantage

[Anonymous Coward]

You forgot **env in your function header.

Re:A clear advantage

[Anonymous Coward]

nothing works as expected on a Mac

Re:A clear advantage

[johnw]

> The 0 is returned to the operating system,
> but operating systems have different rules
> for what return values mean. For example, in
> VMS, even numbers are errors, and
>
> return 0;
>
> will generate a nasty error message upon
> completion.

If it does then you would be justified in submitting a bug report to the maintainers of that implementation.

> Some people argue that the compiler should
> return "success" when the code says to return
> a 0.

These people include those who wrote the ISO definition of the C language.

> I haven't read anything official that
> supports that.

You haven't read the language specs then?

HTH
John

Re:A clear advantage

[NuShrike]

You know, the elephant in the room with all of this is Microsoft, and some others, CONTINUE TO SHIP application binaries with known exploits.

It's much like if Ford continued to sell Explorers with the tires that auto-shred, and ask you to drive the truck back to the dealship to get "patched" after you bought (installed) the truck when there's a well known recall on it.

I know it's corporate policy not to make new CDs of their shipping stuff, but maybe it's time they changed it. "Return your old OS install cds and we'll replace it with the fully patched version back to you, or download it from <here>. Be sure to keep your original product IDs."

"The CDs you get with your new computer or you buy from the store will always be the latest fully patched version, or you can download it from <here>."

Ya right...

Re:A clear advantage

[otisg]

I've had it with Firefox! I'm switching to IE 7!

Re:A clear advantage

[mobets]

yeah, so I cant spel or tipe verie wel...

If Firefox had a spell checker for textboxes, then it wouldn't have been a problem.

Re:A clear advantage

[zurab]

You can obviously write whatever "execute any bash shell script" program you please but that doesn't mean that any major Linux distros, or Apple, or Microsoft, or any other OS distributor should include your program with their software and configure it as a helper application in the OS by default. AFAIK, the flaw is in how the helper app processes the request passed by the browser; all Mozilla could do by this "fix" was to block the helper altogether. The "fix" was to disable the feature that was supported and advertized by the OS.

Note that MS attempted to fix the helper application in question with Windows XP SP1 but failed. Windows XP SP2 looks like it contains the fix to disable the helper app.

Re:A clear advantage

[orbitalia]

Good post, but oh dear you missed the "\n" on the end of the "Hello World!" string. on alot of implementations you won't even get the Hello World printed to stdout until another event occurs that forces a linefeed.

How many slashdot programmers does it take to write a noddy program :)

Re:A clear advantage

[FireFury03]

This incident underscores why many use or have switched to Firefox: vulnerabilities discovered and promptly fixed

Even better - vulnerabilities discovered in third party software are fixed:

"This isn't even a problem with Mozilla; it's a problem with Windows Explorer. Windows XP Service Pack 1 was supposed to have closed this hole, but apparently it is still functioning and leaving Windows systems open to remote attack. So the Mozilla team worked to patch a hole that had little to do with their project."

So basically the Mozilla team had to fix a problem, that MS already claimed to fix, in Windows Explorer because MS are too clueless to fix and test it themselves.

Re:A clear advantage

[Anonymous Coward]

It was a joke.

You don't get out much, do you?

Re:A clear advantage

[Anonymous Coward]

Mozilla (and Firefox, of course) handles ftp: via internal interface (Necko) even if system default handler is an another program. Bug 167475 is about external protocol handlers called from Mozilla.

Re:A clear advantage

[Saint Stephen]

What in god's name is a scheme like shell: doing in FireFox in the first place? For god's sake and for the last time, *I do not want my browser or email program to execute arbitrary code*.

Write that on the chalkboard 1,000 times.

Re:A clear advantage

[Anonymous Coward]

Yeah, yeah, and if Mozilla downloaded an executable and called execv on it that'd also be a Windows problem?

Mozilla made a system call that runs arbitrary programs. Bad.

Re:A clear advantage

[Anonymous Coward]

Absolutely right. Handing untrusted and unvalidated input off to the OS is just a glaringly stupid thing to do, and you'll find it on any top 10 list of stupid things not to do when writing internet software.

Also it's easy to see that this is a bug in BOTH Mozilla and Windows, since if you aren't using either of them then the issue doesn't arise.

Very worrying if this also appears in thunderbird too, as it seems likely to mean that this may be exploitable just by sending a user an email. Which actually would be a security hole right up there with the worst of Outlook holes.

It's also a concern that this went unfixed for years until an exploit was publicised. It should have been obvious that an exploit was a matter of time.

And even now the average user will have no clue that they need to download and install this patch.

I know that these are just "0.9" releases but getting security patches out automatically and the whole "we don't know of an exploit" attitude really needs to be addressed before 1.0.

Re:A clear advantage

[b06r011]

...vulnerabilities discovered and promptly fixed. Not weeks and months from their publication...

it's a good job i read slashdot and find out about these things. i don't check the mozilla page very often, and wouldn't have known about this problem except for slashdot.

me thinks telling users about availible critical updates automatically is not always a bad thing...

Re:A clear advantage

[aichpvee]

Yeah, why spell it M$ when micros~1 has so much more contextual relevance.

Re:A clear advantage

[aichpvee]

Yeah, you don't need Firefox. You're going to get rooted running windows anyway.

Re:A clear advantage

[Tarrio]

Using printf for this is inefficient. Use puts instead :-)

Re:A clear advantage

[aichpvee]

How many people have had their machines turned into spam zombies because of this exploit? I hardly think it can be put in the same sentence as an outlook exploit until that number is greater than 0.

Re:A clear advantage

[stor]

I don't think people will give a fuck what's right in theory when their machine is exploited over this.

Sorry, I love Moz but they just failed it.

Cheers
Stor

Re:A clear advantage

[Anonymous Coward]

<ecode>

No spaces before this nice line
One space before this great line
Two spaces before this exciting line
Three spaces before this happy line
Four spaces before this fun line
Five spaces before this neat line
Six spaces before this cool line
Seven spaces before this awesome line
Eight spaces before this great line
Seven spaces before this wonderful line
Six spaces before this magnificent line
Five spaces before this silly line
Four spaces before this bizarre line
Three spaces before this strange line
Two spaces before this unhappy line
One space before this wasteful line
No spaces before this boring line

Each line below has an additional space before it, starting with zero spaces:
A
A
A
A
A

Each line below has an additional space before it, starting with zero spaces:
.
.
.
.
.

Each line below has an additional space before it, starting with zero spaces:
/
/
/
/
/

</ecode>

So, it works now, sort of, but:

• You can only have an even number of spaces
  
• It will round UP from one space, but round DOWN for any other number of odd spaces
  
• You cannot indent lines that consist singularly of certain symbols (bad for pasting code).
  

Bizarre.

Re:A clear advantage

[matth]

Precicely how is this off topic when the thread was about no software ever being bug free?

Re:A clear advantage

[fodZ]

"How many people have had their machines turned into spam zombies because of this exploit?"

Wrong question.

How many thunderbird users COULD have their machines turned into zombies because of this kind of exploit?

Until THAT number is zero then saying "it hasn't happened yet" is like a 5 year old saying "but I didn't get run over" when told he shouldn't run across the road because he might get run over.

Re:A clear advantage

[fodZ]

I suspect there will be machines out there vulnerable to this for "weeks and months from their publication" anyway. That's because it's not really "fixed" until people apply the patch.

Unfortunately people don't tend to do that unless it's damn near automatic, or actually is automatic, and the word is not being put out very well either.

In my case, I just happened to stumble across the story on /. - even though I have one of my homepage tabs on mozilla/products/firefox, for exactly the reason that I wanted to hear about updates, security related or otherwise. So now I've updated one of my computers. Maybe I'll remember to do all of the others.

Basically for a lot of people out there this fix may as well not exist.

Re:A clear advantage

[bertas28]

There are some good reasons for this - but mostly I think it's crap.

The main reason as I see it is that Microsoft can make patches work together much more nicely; there's more time available assembling the patch set and hence less likelihood of patch A breaking patch B.

On the other hand, as you say, the wait time, which could really stuff things up if a worm came along.

And sure, it might make it easier for Joe Home User to only have one patch in the list instead of one for every bug, but this came be fixed in a much more logical fashion: simply hide the individual patches until you press one of those neat little drop down buttons to get more detail.

As such, I lean towards the individual patch method - anyway, how the heck does this make it easier for admins to plan updates? They could just do it once a month anyway - and if they're the neurotic type, they have the option of doing it more often.

Re:A clear advantage

[julesh]

In that situation, it still seems negligent to me when you're failing to fix an exploitable hole once it's come to your attention and when there's no disadvantage to doing so.

As far as I can see from a quick read of the referenced bug page, they didn't _know_ it was exploitable until the day before yesterday. Not fixing something that you don't know about doesn't seem negligent.

Re:A clear advantage

[julesh]

I don't believe it handles SFTP, though. I could write an SFTP handler DLL for Windows and register it, at which point would work.

Re:A clear advantage

[julesh]

The problem is, this bug didn't suggest a correct fix to the problem. Merely stopping them from being executed automatically doesn't actually solve it -- you would still be able to write a link that executed an arbitrary program, or anything like that. And that's nearly as big a problem!

Re:A clear advantage

[julesh]

If this other vendor is right that people want no more than monthly patches, such a fix may have to wait weeks.

When two independent security flaws in Mozilla are discovered within 3 weeks of each other, get back to me.

Re:A clear advantage

[Anonymous Coward]

Well, currently Microsoft Patch Day is the second Tuesday of each month, but they did an off-schedule release of the patch for the latest severe IE bug because it was being exploited. So they do break the schedule when needed.

Re:A clear advantage

[Anonymous Coward]

Bingo. Especially when there is a known vunerability. And that is why Mozilla bears a lot of the burden associated with the hole.

THERE WAS NOT A KNOWN VULNERABILITY.

It was suspected that in theory there hypothetically existed the potential for a vulnerability maybe to possibly appear at some unspecified time in the future. They considered this and decided that maybe their time would be better spent fixing the things people were whining about.

When finally someone worked out that there was in fact a vulnerability, they dropped everything and rushed out a fix within 48 hours.

And that is why Mozilla does not bear any burden associated with this hole.

Re:A clear advantage

[Anonymous Coward]

Also it's easy to see that this is a bug in BOTH Mozilla and Windows, since if you aren't using either of them then the issue doesn't arise.

In that case it's a bug in the x86 architecture, too, because the issue will never arise on SPARCs or PowerPCs. Let's blame Intel too!

Re:A clear advantage

[Anonymous Coward]

Problems in IE get a lot of attention too, but somehow every open bug is a blotch on MS, whereas for Mozilla here, its just fine and dandy.

Man, I can understand not reading the article - this is Slashdot after all - but have people stopped reading the discussions too? At least half the posts here are slamming Mozilla! How the fuck can you claim everyone's defending Mozilla when half the geeks on Slashdot are blaming them?!

Re:A clear advantage

[Anonymous Coward]

Yeah but with IE, I don't have to download a zip file and read some 'howto' to figure out how to patch it.

When will Firefox have an update feature? That's what us lazy (and the dumb, which I don't speak for) users want.

Re:A clear advantage

[Anonymous Coward]

This incident underscores why many use or have switched to Firefox: vulnerabilities discovered and promptly fixed. Not weeks and months from their publication--and not by another vendor--this exploit was addressed by those who have made available Mozilla's code for public scrutiny.

That's a really ignorant thing to say. Microsoft has had fixes out quickly as well. Some bugs are harder to fix than others. With IE, there is a lot more code to go through. Most of the MS bashing comes from armchair developers anyway.

Re:A clear advantage

[maximilln]

Two years of being aware of this issue and doing little or nothing about it seems a bit worrying, IMO

I'm sure MS is aware of this bug and they haven't even bothered to publicly acknowledge it.

Even taking a hard-nose stance Mozilla is the lesser of two evils.

Re:A clear advantage

[maximilln]

which Internet Explorer only started to do sometime this year

IE happily follows all of the links on this page quite happily without popping up any dialog boxes.

This is a fully patched up-to-date XP installation.

Re:A clear advantage

[Anonymous Coward]

External protocols _never_ return any data not only in Gecko but even in MSIE. To access SFTP data from Gecko, you should write not a standalone DLL but Necko extension - and then SFTP will be internal protocol.

Re:A clear advantage

[jrutley]

Funny, but it's not a bug.
It's an error.

There's a difference.

Re:A clear advantage

[Anonymous Coward]

I would have liked to see a patch or new version released that offered a proper fix, not something that cuts functionality in order to "fix" the problem. I assume the shell protocol has authorized uses, otherwise it would not have been designed. This kind of "fix" is what I expect from M$.

Re:A clear advantage

[Zaiff Urgulbunger]

Did their patch work though? I'm a little confused as to what is/is not affected by this but. This link:

shell:windows
From here: http://www.mccanless.us/mozilla/mozilla_bugs.htm

on my *fully patched* Win2K machine, IE6 does list the contents of the WINNT folder.

Aside from that, I personally am I little concerned that the Moz. devs were aware of a problem but simply disowned it. That doesn't seem very responsible. However, it is true that this is fundamentally a flaw in the OS. I don't see that a browser can be responsible for all protocols when it doesn't know what they're for. If it blocks protocols by default then that limits the functionality of the browser, surely?

Re:A clear advantage

[mwood]

One thing that bugs me about this particular problem is that the Mozilla folk spend so much time relentlessly creating "cross-platform" reimplementations of stuff that could safely and sanely be left to the platform (such as storing user preferences) and yet here, in a very security-sensitive place, they happily glommed onto a platform-specific thingy which turned out to have unintended consequences. I am negatively impressed.

Re:A clear advantage

[mwood]

I agree that the specific vulnerability was not known back then, but I disagree on the burden of blame nonetheless. If someone had pointed out to me that our project was currently handing untested web documents over to code not under our control which is ill-defined and could be extended without our knowledge, I would have considered it DROPEVERYTHING, not WONTFIX.

Re:A clear advantage

[mwood]

So? "The URI handler in MS Windows is insecure." "Uh-oh. Don't use it, then. Or find a way to only use it securely." Not, "not our problem, MS should fix it." Notice how quickly it became "our problem" when a more specific exploit was noted.

Re:A clear advantage

[Anonymous Coward]

xpis should be authenticated by mozilla.org prior to install. if not the user should have to go through hoops to install these

Re:A clear advantage

[Anonymous Coward]

Since Balmer's entire goal was a "schedule" "for network administrators to plan updates".

The just want it written into some Cerified Microsoft Technician that "On the 13th of each month apply patches to all your software".

Re:A clear advantage

[mwood]

Think of it this way.

The setuid bit is not inherently damaging. A program which copies stdin to stdout is not inherently damaging. 'chmod u+s /bin/cp' is, however, incredibly stupid.

In Mozilla's case, the problem was combining a facility for fetching untrused code off the Internet and a facility for interpreting arbitrary commands. ShellExecute() by itself is insufficient to yield a remote exploit; a web browser by itself is insufficient to yield a remote exploit; a web browser that hands things off to ShellExecute() uncritically *does* permit a remote exploit if ShellExecute() knows how to execute arbitrary commands (and, as it turns out, it does).

Re:A clear advantage

[Anonymous Coward]

You fail to understand.

This exploit did not exist 2 years ago.

The code was and is designed to hand off unhandled URIs to the OS URI handler. I don't know about the OS URI handler in detail, but my assumption is that it is some kind of blessed facility provided by the OS to applications. The question 2 years ago was how to mitigate problems from use of it. Something like "how should we protect Windows from itself?"

Do you know if Windows even implemented "shell:" at the time? Do you know when they did? That's when it was an exploitable underlying facility.

Imagine Windows had a filesystem vulnerability. You create a 42 byte file named "C:\moomoo" and the filesystem corrupts. Is Mozilla responsible if it allows you to save a file called moomoo? Do you call this a hole in Mozilla?

BTW the disadvantage of protecting Windows against itself is incompatibility and deviation from MS's prescription of behavior.

So don't be worried. You just misunderstand.

Re:A clear advantage

[mwood]

Carpenter: "Boss, did you notice that our standard house plans all specify doors with no locks? We've installed 234 front doors this year without locks."

Contractor: "WONTFIX. Let me know when there's a specific exploit."

Re:A clear advantage

[maximilln]

I would mod you as funny but I still think you're on the wrong side.

Mozilla developers (carpenters) have known about flaws in Windows security design (controlled by the boss) for many years. They are powerless to fix it. In order to make their browser competitive they _MUST_ have the hook to the OS handler or MS would spank them with featureware. Now you, the users (the homeowners) want to hold the developers (the carpenters) responsible for something that Microsoft (the boss) refuses to fix.

Re:A clear advantage

[Electrum]

Open online bug tracking has already started for some of their products.

Do you have a link to that?

Re:A clear advantage

[shaitand]

The problem with that theory is that there shouldn't be a shell uri handler in the first place. There shouldn't be ANY trusted URI handlers in the OS, there are other ways to handle that.

And this doesn't only affect mozilla with windows, it affects IE with windows as well.

Re:A clear advantage

[vinc17]

Bug 246524

Re:A clear advantage

[mwood]

You misunderstand. The Carpenter and the Contractor are both working for Mozilla.

Returning to the software realm, Mozilla does need to use ShellExecute() but they certainly do not need to blindly use it whenever a URI scheme is not recognized by their code. Instead it should be used only when the scheme *is* recognized and known not to be implemented by their code; otherwise punt the decision to the user with appropriate scary warnings. Let the user also decide whether to push the "add this scheme to the safe list" button if he dare.

It is wrong to cast this as an either/or, be secure or be usable matter. The browser's behavior can, and always could, be made much safer regardless of whether anything is ever done to ShellExecute().

Re:A clear advantage

[Eudial]

This was redundant in your code:

• printf (for unformatted text you should use puts).
• argc, argv (never used).
• the indentation. 2 spaces is enough.

This was deprecated:

• return 0, use EXIT_SUCCESS instead.
• The uppercase 'W' in "World".

You should also end your sentences with a dot.

#include <stdio.h>

int main(void)
{
puts("Hello world.");
return EXIT_SUCCESS;
}

Re:A clear advantage

[malfunct]

What are your security settings in IE. With default settings I am unable to get any of the links to work, clicking on them is fully ignored.

Re:A clear advantage

[malfunct]

Strike that, with custom settings (relaxed some restrictions for stuff I have to do at work) I still can't click through the links.

Re:A clear advantage

[Antaeus Feldspar]

That's because it was not a bug.

A bug would be if Mozilla was supposed to load web pages securely and instead of doing so, loaded them in an insecure fashion.

What Mozilla is doing in this case, or in any case, does without the patch, is to say "Yes, okay" when the user chooses an insecure action and says "there, do this for me."

What are you going to call a bug next? "Mozilla loads the goatse.cx page even though no one would ever really want to see that! Goatse.cx has been around at least since 2002, and yet Mozilla has failed to fix this bug that lets you go there!"

Re:A clear advantage

[shellbeach]

As far as I can see from a quick read of the referenced bug page, they didn't _know_ it was exploitable until the day before yesterday. Not fixing something that you don't know about doesn't seem negligent.

There's a couple of bug references to this, so I'll assume you were referring to the latest one that specifically refers to the shell: protocol. But I was looking at this bug which is a more general form of the same security hole. I'll quote from the bug description:


As we can see in bug 163648, external protocols can cause a lot of security
issues. But exploits for this bug are dangerous mainly if external protocol
handler is being requested automatically from HTML code via , and other
similar cases.

More, with relation to common sense, invoking an external protocol is absurd in
this case, because is request to return some data in browser,
not for launch external application.

So, disable external protocols in all cases, excluding , can solve this
problem.

Marking severity critical according to 163648.

That was filed on the 9th September 2002. It seems fairly clear to me that the whole point of this bug was that external protocol handlers are inherrently exploitable in win32.

Re:A clear advantage

[supersteve1440]

No you don't.

Re:A clear advantage

[shellbeach]

That's because it was not a bug ... What are you going to call a bug next? "Mozilla loads the goatse.cx page even though no one would ever really want to see that! Goatse.cx has been around at least since 2002, and yet Mozilla has failed to fix this bug that lets you go there!"

See my comments earlier in this thread. But since you want to argue for agument's sake, the obvious difference between blocking requests for goatse vs. allowing malicious code to be downloaded and executed without user prompting is that the former is a request and the latter requires no user initiation. That's the whole point. And just because this exploit comes about because of the stupid nature of a second-rate OS, that doesn't mean developers of mozilla should just ignore the existence of it when the fix is straigtforward and inconveniences noone.

btw - the exploit was filed as a bug once in 2002, and twice separately in 2004. Remember that a bug in bugzilla encompasses the whole gamut from coding errors to feature requests.

Re:A clear advantage

[jak163]

I think the other problem is that regardless of who is at fault, it's a public relations disaster for Mozilla at precisely the moment when it had an opportunity to score big-time over Microsoft in the court of public opinion. Mozilla is more secure than IE, and it had been watching and waiting for years for an opportunity to make this matter to the public.

Re:A clear advantage

[Anonymous Coward]

way to fucking go, wiseguy... ya don't get my joke cuz yer a fucking putz

Re:A clear advantage

[dutchgen1]

Boy, you are way off bat. Mozilla is an active, hands-on browser. Designed for you to get involved in how it functions. Not like IE, which you don't have to do anything for it to get screwed up. So the active install and restart is the best way to go. Mozilla is browsing as it should be, not a thing more than basics for main package, and then if you want more, you find/create the extras to add to it. IE just adds everything from the beginning, then you are constantly having to dig to turn it off.

Re:A clear advantage

[shellbeach]

Even taking a hard-nose stance Mozilla is the lesser of two evils.

Well of course it is - but that doesn't mean that mozilla.org should be proud of ignoring bugs like this one.

Re:A clear advantage

[Zaiff Urgulbunger]

My settings are:

ActiveX controls and plug-ins
Download signed ActiveX controls: Prompt
Download unsigned ActiveX controls: Disable
Initialize and script ActiveX controls not marked as safe: Disable
Run ActiveX controls and plug-ins: Enable
Script ActiveX controls marked safe for scripting: Enable

Scripting
Active scripting: Enable
Allow paste operations via script: Enable
Scripting of Java applets: Enable

Now I would've tightened this lot up a bit in light of recent events but I use FireFox as my web browser and only use IE for Windows Update. But if memory serves, this setup is *slightly* tighter than the default setup... but I could be wrong!

I just tried setting "Run ActiveX controls...", "Script ActiveX controls..." and "Active Scipting" to Prompt, but it didn't seem to make any difference; well not to the first test link anyway which lists all the files in my WINNT folder.
Strange stuff!!

Re:A clear advantage

[kaschei]

I did; at least, the links to the tips information were still active before I closed firefox down. Perhaps refreshing the page would have worked? Regardless, you should close all the active firefox windows just for thoroughness.

Re:A clear advantage

[Anonymous Coward]

Wow, you're still really embarrassed about that Firefox thing, huh?

This is a story about a shell vulnerability in a Microsoft product. Why would you have to bring up the unfortunate vulnerability in Firefox and Mozilla? I call troll!!

Re:A clear advantage

[Anonymous Coward]

You forgot to take the penis out of your mouth before speaking.

Re:A clear advantage

[sepluv]

>>But WHY THE HELL IS THERE A shell: SCHEME IN THE BROWSER IN THE FIRST PLACE?<<

There is not a shell: scheme in Mozilla. It is in MSW XP. The security flaw is a bug in MS's software, and actually nothing to do with Mozilla--they just thought they'd fix it. As you shouted, I will too. YOU CANNOT BLAME MOZILLA FOR NOT FIXING FLAWS IN THE FUCKED-UP OS THAT YOU CHOOSE TO USE as quickly as you would like (despite the fact they don't get paid, they did fix it quite quickly and the bg was not in their software). Maybe you should be complaining to MS to get their OS fixed or even better get a real free-software OS: GNU/Linux.

And now for some helpful links:

[strictnein]

And now for some helpful links:

Note: If you click on download links for firefox on the main page of mozilla.org, you get 0.9.2. The link on the firefox page @ http://www.mozilla.org/products/firefox/ still gets you 0.9.1. The link on the main page for the Linux version of Firefox still points to version 0.9.1. It seems that if you want 0.9.2 for Linux you'll have to compile it yourself.

0.8
0.9rc
0.9
0.9.1
0.9.2

And a direct link to the newest release for the really lazy:
Windows 0.9.2

The question is, what is the shellblock.xpi for?

Does Bugzilla know? Sorry, links to Bugzilla from Slashdot are disabled. Ook!

Re:And now for some helpful links:

[cdrudge]

Or get an optimized firefox build here in a day or two.

Re:And now for some helpful links:

[hallucination]

No need for a linux release..... Read the article:
Note that this only affects users of Mozilla and Firefox on Windows XP or Windows 2000

Re:And now for some helpful links:

[jesser]

shellblock.xpi fixes the hole in 0.9.1 so that 0.9.1 users don't have to download the whole browser again.

Re:And now for some helpful links:

[sgtsanity]

The shellblock.xpi works to patch the 0.9.1 release. The only difference between 0.9.2 and 0.9.1 is that one of the preferences is a different value by default. So, if you have 0.9.1 already, there is no need to download the 0.9.2 release. You can just patch it using the .xpi link on mozillazine.

Re:And now for some helpful links:

[Apathetic1]

Shellblock disables the shell: scheme that was the cause of the vulnerability. If I understand the issue right, opening a shell: URI would pass commands straight to the Windows XP shell. The problem is similar on Windows 2000 but the article doesn't go into detail other than noting that it doesn't use the shell: scheme.

Re:And now for some helpful links:

[afidel]

Well, here is the plugin that blocks the shell: scheme for all Mozilla based browsers (1.1+ I think). I'm running 1.8beta2 and I couldn't find any info on whether it was affected but I found the above plugin so I'm not worried.

Re:And now for some helpful links:

[Anonymous Coward]

it's ok, linux users like to compile stuff just for fun.

Re:And now for some helpful links:

[Anonymous Coward]

Sorry, links to Bugzilla from snigger.microsoft.com are disabled. Double-Ook!

Re:And now for some helpful links:

[deadhead4321]

I just installed FireFox 9.1 yesterday and so yes there are couple of adjustements from Mozilla 1.5. One question is why, unlike every other extension I have installed, does not shellblock.xpi show up in the Extensions dialog after installing it? Are has it not intalled correctly. Thanks, Frank

Re:And now for some helpful links:

[Anonymous Coward]

So does this work on .8 and .7? I installed and and so far haven't had any problems. Of course I don't know if I am protected now.

Any no .9 isn't an option. config.trim_on_minimize doesn't work(its the only that makes FF useable on my laptop), and .9 even with a clean profile crashed a few times a week even though I was only using FF .9 approved extensions and haven't had regular zilla crashes for long time.

Re:And now for some helpful links:

[PeterPumpkin]

If you have installed the patch, navigating to shell:// will return a basic Windows Explorer error.

If you haven't, the explorer.exe process will crash, or firefox will flicker, or both.

Blast!

[darth_MALL]

"Note that this only affects users of Mozilla and Firefox on Windows XP or Windows 2000"...there goes a perfectly good Ha-Ha!. You've bested me this time *NIX...But you haven't seen the last of ME! BWAHAHA!

Re:Blast!

[AuMatar]

Sure we have. I haven't seen an ME installation in years.

Re:Blast!

[Anonymous Coward]

But you haven't seen the last of ME!

Don't say things like that! You're going to give all the kids and sysadmins nightmares talking about things like that.

Re:Blast!

[peragrin]

running an windows ME TO install right now. Of course I don't let go on the internet very often, it's not grown up enough, but it tends to handle all my games well.

What's really funny is that my roommate has had 100's of viruses on his windows XP machines where I have none.

Just for the record, this is posted from Konqueror. The real internet machine. Linux for networking, winblows for gaming.

Re:Blast!

[crossconnects]

crossconnects at gmail dot com

Re:Blast!

[Country_hacker]

Funny, I just installed Firefox on an ME machine on Friday for a co-worker. Maybe in the circles you run everybody has the latest XP/OSX/$Distro version, but there's still people out there who don't have the time/money to upgrade, especially in the mid- to low-rent district.

Later, Rory

Re:Blast!

[Darkangael]

Even windows98 is a step up from ME in terms of long-term stability.

Re:Blast!

[mbourgon]

I feel safe, though... my 98 box is still immune.

Re:Blast!

[Anonymous Coward]

To quote my favorite T-Shirt:

Macintosh for Productivity
Linux for Development
Palm for Mobility
Windows for Solitaire

Re:Blast!

[chamblah]

I haven't seen an ME installation in years.

It's obvious you don't work for tech support.

I have techs on the phones that still run into customers with 95 and it's the original install (not saying that it's running that well though).

Re:Blast!

[AuMatar]

No, everyone I know runs linux, 98, or 2K. Nobody I know eve considered buying ME. And only those with new systems have XP.

Re:Blast!

[PedanticSpellingTrol]

I spent most of today trying to resucitate my friendly neighborhood insurance salesman's ME box (virus nuked IE) before finally managing to convince him to upgrade to XP. So now that I've gotten my reputation as a miracle worker, he wants to me to set up a wireless network between it (on the third floor of his home) and a Pentium-120 in his reinforced-concrete basement. Some people cause all the profitable support hassles.

Re:Blast!

[julesh]

People may laugh, but 98 is a great OS for one reason - it doesn't actually do anything. Can't exploit an OS that doesn't do anything.

Re:Blast!

[Anonymous Coward]

I'm doing a ME install right now...

Re:Blast!

[silicon not in the v]

Seriously, we have two computers at home and one is WinXP and one is 98SE. Every exploit I've seen for the last few years has been XP only. I went to XP because I wanted a real Task manager to try to kill stuff, but it's been more of a pain than Win98. I keep thinking that it's kind of cool that 98 is immune to so much of that stuff, and it didn't have that registring the license crap, so I can install one copy on whatever computers I want.

Yes, but releases are available already

[Real Troll Talk]

Releases are available already. One of the (many) reasons I switched to the Gecko browsers from IE, because they actually update their software.

Note how fast it was patched compared to the fact that IE still doesn't have tabbed browsing.

Re:Yes, but releases are available already

[Anonymous Coward]

Note how fast it was patched compared to the fact that IE still doesn't have tabbed browsing.

Would you like to eat a generous portion of CROW with that Firebird?

Re:Yes, but releases are available already

[Anonymous Coward]

This particular bug has been in bugzilla for quite some time. Not sure why you think it was fixed "immediately". Remember, *you* just heard about the issue today and so the patch was not released in a timely fashion as you may believe. Awesome browser though no doubt!

Re:Yes, but releases are available already

[-kertrats-]

How are you comparing Firefox' prompt patching to IE's lack of tabbed browsing? The two have little to nothing in common...

Re:Yes, but releases are available already

[Matheus Villela]

IE users can use IE with tabbed browsing But the solution is like many in microsoft softwares world, with third part software: avant Anyway, IE still a piece of crap with a poor css2 suport and many many other issues, not only security, but the browser allow the pages to do things the user doesn't want.

Re:Yes, but releases are available already

[caillon]

This particular bug has been in bugzilla for quite some time. Not sure why you think it was fixed "immediately".

Because it was fixed immediately. The bug that has been around for 2 years is requesting a generic solution and a policy change, not a specific solution for a specific problem. Furthermore, the generic bug is as of yet unpatched. How can an unpatched bug be the shell bug if there is a patch, xpi and new release to fix the shell hole? Granted, a solution for that generic bug would have prevented this specific bug altogether, however it does not change the fact that the specific bug with regard to shell was fixed immediately.

Only recent Mozilla bug.

[homeobocks]

I guess that this is a big deal because I can't remember the last time Mozilla had a remote hole in it.

Re:Only recent Mozilla bug.

[Anonymous Coward]

It sounds like it is a Windows hole to me, not a Firefox one. Notice it doesn't work with XP SP2, meaning Microsoft has fixed the problem.

Re:Only recent Mozilla bug.

[Carnildo]

Strictly speaking, it's not a hole in Mozilla. It's a "feature" that can be used to turn local holes in other software into remote holes.

Re:Only recent Mozilla bug.

[Anonymous Coward]

Now and again the release notes say something about security, but rarely are they clear on exactly what.

Re:Only recent Mozilla bug.

[Anonymous Coward]

Strictly speaking, it's not a hole in Mozilla. It's a "feature" that can be used to turn local holes in other software into remote holes.

Just like the "features" that Microsoft puts into IE when new exploits are found, right?

Re:Only recent Mozilla bug.

[bwt]

Actually, **Windows** has a hole in its API's that mozilla relied on. So mozilla patched themselves to eliminate a dependency on insecure MS code. In other words, mozilla is working around a microsoft caused security hole. If you use mozilla on linux (or a fixed version of windows), you aren't vulnerable.

Re:Only recent Mozilla bug.

[Anonymous Coward]

Strictly speaking, it's not a hole in Mozilla. It's a "feature" that can be used to turn local holes in other software into remote holes.

The flaw allows web pages to execute arbitrary programs on the client's machine. I consider that to be a hole. It's true that it doesn't inherently allow arbitrary code execution, but I don't think that behavior is required for a flaw to be called a hole.

Re:Only recent Mozilla bug.

[GlassHeart]

Actually, **Windows** has a hole in its API's that mozilla relied on.

That's still a Mozilla bug. Windows cannot be expected to know whether the API call came as a result of the user typing something deliberate, or because a untrustworthy web page said to do so. That knowledge rests in the application, not the OS. In fact, some might even argue that if the user typed the "shell:" command in the browser's address bar, it should probably work!

It does make Linux a safer OS. However, the responsibility to use a potentially dangerous API correctly - even if the API is poorly designed - rests on the application.

Re:Only recent Mozilla bug.

[bwt]

Well, it depends. If the API works as advertised, then, yes -- it is the applications responsiblity to assure it is used securely. On the other hand, if the API does not work as documented, then you cannot place the burden on the application to anticipate how it fails to behave correctly.

Although I do not know which is the case here, it is somewhat telling that the API was appearently changed in later versions of windows.

Re:Only recent Mozilla bug.

[KarmaMB84]

Do other Windows browsers have the problem?

Re:Only recent Mozilla bug.

[Anonymous Coward]

Well, if by later, you mean not-yet-released versions of Windows.

The fix is present in Windows XP SP2.

SP2, however, is only in public beta at this stage.

Re:Only recent Mozilla bug.

[puck01]

Who cares if the API worked as advertised, they knew for two years there was a hole - end of story. Who cares who's fault it is. Fix it. Its tough encouraging people to use Mozilla because its more secure, when a bug like this has been **known** for 2 years. This is nothing short of embarrassing and to argue otherwise is hiding your head in the sand. If the Mozilla guys knew about this all this time and decided to sit on it just because technically it was a problems with the OS, shame on them. They need to step up to the plate and watch out for their users (and their own reputation).

Re:Only recent Mozilla bug.

[Anonymous Coward]

Actually, **Windows** has a hole in its API's that mozilla relied on. So mozilla patched themselves to eliminate a dependency on insecure MS code. In other words, mozilla is working around a microsoft caused security hole. If you use mozilla on linux (or a fixed version of windows), you aren't vulnerable.

(1) Blame Microsoft
(2) ???
(3) Profit

Re:Only recent Mozilla bug.

[TiggsPanther]

What it looks to me like is that both sides screwed up. Mozilla/Firefox passing on requests to a known Windows vulnerability is not a smart move.

That said, as much as Mozilla should have looked into this earlier, so should Microsoft.

Now yes, Mozilla really should have done something about this ages ago. Defaulting to let any OS handle arbitrary protocols is a bad move, let alone Windows. However it seems that the moment it was published exactly how severe this vulnerability was they released both an updated version and a patch. That's definitely points in their favour. So old installs can be fixed and fresh installs can be more secure.

So far it looks like Mozilla have handled this well. Yes, they made an initial mistake, but they seem to have handled it well now. I just hope they can learn and not make any more mistakes like this. if they do learn better it will be major poitns in their favour.
What remains to be seen is what they'll do about protocol-handling in general. Have an option in the UI-menu to alter, add and remove protocols would be nice.

Tiggs

Wow

[Rber0]

Surprised I posted this early with Firefox cracked wide open.

Ahhhh....

[losvedir]

Internet Explorer's finest hour!

bias

[azadam]

"Still, I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites."

Seriously.

Re:bias

[bad_fx]

Seriously, what are you saying? That that statement isn't true?

Um, Seriously, if you think that's not true, you need to get your head examined - of course people are much less likely to target these vulnerabilities, because a much larger percentage of people currently use IE than firefox, not to mention that those who do use firefox are more likely to be at least slightly more savvy web users that their IE using conterparts. Hence there is less insentive for those with malicious intentions to target firefox (for now at least.)

So, how is the truth bias?

Re:bias

[azadam]

"A serious security flaw has been found. But don't worry, it's no big deal!"

It's just frustrating to hear people whine about security via lower market share, but then excuse serious flaws using that logic when it's convenient.

I don't, however, refute the point. I'm just of the camp that would prefer stories to at least feign subjectivity, and leave the opinion for the comments.

Re:bias

[Anonymous Coward]

For a browser which - at least by the users of this site - is expected to be the downfall of the Internet Explorer, the assumption that Mozilla/Firefox is a smaller target is either temporary or an early give-up. It certainly is not an acceptable security strategy (because it is security by obscurity).

Re:bias

[djmurdoch]

of course people are much less likely to target these vulnerabilities, because a much larger percentage of people currently use IE than firefox, not to mention that those who do use firefox are more likely to be at least slightly more savvy web users that their IE using conterparts.

You seem to be making lots of assumptions about the motivation for writing the exploit. If you are a spammer trying to create a million zombies, then you'll target the high market share IE. But if you're doing it just to score points, you'll target Firefox: because none of your friends have done that yet. (Or maybe because your friends all use Firefox, and go around claiming that that prevents them from being at risk. Imagine the look on their faces when you change all their porn to goatse.cx pictures!)

Re:bias

[sh!va]

*sigh* gotta love slashdot. People turn their sarcasm detectors off when they post on slashdot, apparently. What he meant, in non-humourous, non-sarcastic, boringspeak would be something like this:

This is a pretty serious vulnerability in firefox.
Yet, the previous poster claims that he feels safer using firefox because there are fewer instances of firefox out there than IE (true).
By saying this, the previous poster effectively defends firefox instead of "yes, this is a problem, every piece of software has problems, lets get on with it".
If the same thing was exposed in a Microsoft or other company product, the comments would never say, "I still use it because its productive / helps me get my job done / because I like windows / make up some reason to bash Windows but use it anyway".

Hence the word "bias".

Schools need more english-lit-for-geeks classes.

Re:bias

[Anonymous Coward]

There's no reason people wouldn't target this vulnerability too. A vulnerability is a vulnerability, and if there's an opportunity to exploit somebody, a malicious person will take that chance. Nobody is sitting around saying, "If I attack Firefox I'll probably only get a few hundred people, but if I wait for a new IE hole I can attack millions. Muahahaha!" They're going, "Ah ha! A new hole to exploit. Here goes..."

One fallacy of the numbers argument is that being a bigger target means you're more vulnerable. The other fallacy is that being a smaller target means you're less vulnerable.

Re:bias

[Anonymous Coward]

"of course people are much less likely to target these vulnerabilities"

Yet when people use this same logic to underscore the fact that IE is targeted more because IE is used more, they get flamed to hell and back.

Pick a side, but please, pick a side.

Re:bias

[proj_2501]

you mean OBJECTIVITY, right?

Re:bias

[azadam]

Bitch. ;)

Re:bias

[bad_fx]

Yet when people use this same logic to underscore the fact that IE is targeted more because IE is used more, they get flamed to hell and back.

Actually I would be one of the people who agrees that IE is targeted more because it's more popular, as is Windows, etc. I can't see how anything in my original post would suggest otherwise.

I still prefer Firefox though because it has better features, more innovative development (at the moment) and, yes, I feel like it's safer to use. *Shrug*

Re:bias

[Kenardy]

Ummm ... this 'lotsa people use it so lotsa people abuse it' argument held water until Apache took the lead in the web server wars. Yet last weeks MSIE vulnerability du jour required that a IIS server first be penetrated ... not an Apache one.

Apache has had a 2:1 margin over all Microsoft web servers combined for quite some time now. Try to keep up, eh?

Here we go again...

[LostCluster]

I can't help but think that this thread from earlier today can be seen as good news from a security context...

Just how does Mozilla/FireFox think it's going to keep malware from tricking the users into granting permission when the clueless masses come over from IE?

Re:Here we go again...

[XiQ]

Firefox does already include a 3 seconds delay before installing extensions...

Re:Here we go again...

[Pieroxy]

when the clueless masses come over from IE

You do realize that this is probably never going to happen, right?

I mean, IE3 was gaining market shares on Netscape 3 and it was a much worse browser. Why in hell would the clueless masses move to Moz/FF? Not for a technical reason, that has never ever ever happenned. Ever. Never.

Start to realize Mozilla is a tool for us geeks and our families, nothing else so far.

Re:Here we go again...

[_Sprocket_]

Start to realize Mozilla is a tool for us geeks and our families, nothing else so far.

Unless outfits like Dell are able to install a Mozilla-based browser (probably Netscape) and configure it as a default browsing environment. Without fear of reprocussions from Microsoft.

Re:Here we go again...

[sparrow_hawk]

IE3 was gaining market shares on Netscape 3 and it was a much worse browser.

Umm... no. IE3 was at the very least comparable to Netscape 3, and it was in general a nicer browser to work with. Microsoft's business practices (ie. giving away IE) may have been shady, but part of the reason they won the First Browser War was that IE was simply a better browser.

Re:Here we go again...

[Pieroxy]

How untrue could that be....

IE2 gained up to 15% marketshare and was just a piece of crap. IE3 - while comparable to NS3, I admit - was still less powerfull in a few ways that I can remember:
1. didn't have switch in JavaScript
2. Couldn't do rollovers images in menus
3. Toolbar much more rigid than NS3

Then, at that point, you cannot tell me that IE3 won over NS3 because of any technical superiority. IE3 reached almost 40% of the market.

So from that point on, IE4 and NS4 came out. Technically IE4 was a lightyear ahead of Netscape. So far away, it took Mozilla 6 years to catch up.

So I guess we will never know if IE would have won in the case it would have been as crappy as Netscape. But seeing how IE3 went up up up up and NS3 down down down with equivelant technologies, I would guess yes, without a doubt.

So while the techical superiority of IE4 did speed up the process, I doubt it has been anything significant in the outcome of the war.

Re:Here we go again...

[Anonymous Coward]

:P I'd almost preffer IE to netscape...

Re:Here we go again...

[julesh]

No browser can avoid that problem without just disabling the ability to download and run programs, full stop. And as millions of users _want_ a browser in order that they can download and run programs, preventing that would mean instant commercial failure.

Re:Here we go again...

[sparrow_hawk]

Perhaps it's IE4 I'm remembering. I *personally* switched at IE3, partly because of the price.

All the same, when IE3 came out there were *not* a lot of Web sites that required things like switch in Javascript or rollover images. The Popup Menace was still a few years off.

Re:Here we go again...

[Pieroxy]

Perhaps it's IE4 I'm remembering. I *personally* switched at IE3, partly because of the price.

You mean you saved the price to install Netscape? Was your internet connection costly at that time?

Just to be fair...

[DaRat]

Just to be fair, are we now going to get the same sort of condemnation about Firefox developers leaving a known exploit unfixed as when news of an unfixed Internet Explorer is announced? Or, are we just going to say "that's what you get for using Windows"?

Mind you, I love Firefox, but I hate hypocrisy.

Re:Just to be fair...

[almostmanda]

who's leaving it unfixed?

Re:Just to be fair...

[daeley]

Erm, the exploit is fixed. I hate hypocrisy as much as the next person, but RTFP.

Re:Just to be fair...

[Anonymous Coward]

but I hate hypocrisy.

You must be new here...

Re:Just to be fair...

[Carnildo]

Strictly speaking, it's not an exploit in Mozilla/Firefox. It's a hole that can be used to access exploits in other software -- basically, it can turn what was a local exploit into a remote one.

Re:Just to be fair...

[Anonymous Coward]

Hey,

RTF Bug Report. It's been a problem since Sept 2002.

The link is:

bugzilla.mozilla.org/show_bug.cgi?id=167475

Re:Just to be fair...

[smallpaul]

A user having the ability to run code on their own computer is not a "local exploit". It's just a user using their computer. Ar remote site being able to run code on a computer is a "remote exploit". That much is true.

Re:Just to be fair...

[radish]

Yes it's been fixed. Nearly 2 years after it was reported.

Still, I run FF rather than IE, but let's not blow our own trumpets too loudly.

Re:Just to be fair...

[rushmobius]

Yes RTFP and maybe actually read the the items on Bugzilla. Don't be so quick to jump on the bandwagon.

It was debated back in 2002 that this could be exploited, just because it was reported as a bug today, doesn't mean it didn't exist prior to that.

I use Firefox exclusively. There is zero benefit in allowing a browser page from the internet to execute any code on the clients machine, except to render the page.

Supporting fake protocols to allow for geewhizz functionality is just inviting problems.

Re:Just to be fair...

[EvanED]

They left it unfixed for almost two years. The bug was opened Sept 9, 2002.

Next time there's a patch for an IE bug and someone complains about the slow patching time, are you gonna go "who's leaving it unfixed"?

Re:Just to be fair...

[Anonymous Coward]

The Firefox/Mozilla people were, for the last TWO YEARS. Many eyes make bugs...stick around for ages, it seems.

Re:Just to be fair...

[plj]

Yeah. But where is the auto-update feature for Firefox á la Windows XP, OS X, YAST or Up2date?

Last weekend, I converted three people from IE6 to Moz FF 0.9.1, based on the facts that it's more secure than IE. And now I'm reading that it has a critical issue (whether it is a bug or not, but it is an issue). How to get their machines pached without my intervention? Where is that big red bouncing icon that appears when starting FF, which says that "you need to install this/these updates immediately to keep your machine secure"?

Hello, FF developers! Critical FF updates are not found on windowsupdate.microsoft.com! Where is your own auto-update feature?

Re:Just to be fair...

[someone247356]

Perhaps I'm having a slow moment, but the fix seems to be turning an option from a default of On to a default of Off.

If it's a bug shouldn't the fix involve more that turning off a setting?

Any sufficiently paranoid user could have, and probably would have turned it off themselves two years ago.

Now I'm not saying that it's not a dumb feature to have, so if you are going to have it, for heaven's sake at least default it to off. But I can't really equate this to an IE bug that you need a binary patch from Microsoft to remedy.

Re:Just to be fair...

[galaga79]

But there is an auto-update for Firefox, take a look at Options > Advanced > Software Updates.

By default it will periodically check for updates for the main program and extensions. You can even set it up to automatically download and install these updates.

Re:Just to be fair...

[Kelson]

But where is the auto-update feature for Firefox á la Windows XP, OS X, YAST or Up2date?

Tools -> Options -> Advanced -> Software Update.

To check manually: Tools -> Extensions -> Update.

It's not perfect yet, but remember, it's still 0.9.x, not 1.0.

(Wait, you did want an answer, right?)

Re:Just to be fair...

[Anonymous Coward]

Not to be picky, but saying but remember, it's still 0.9.x, not 1.0.

Is horsepoop. You're telling me that at 1.0 there will be no bugs? Or at 1.0 will it be but remember, it's still 1.x, not 2.0.

Unless FF stays at 1.0 forever don't use that arguement.

Also what's it say about Moz 1.x?

Re:Just to be fair...

[mpupu]

Neither of them seemed to work for me. I tried both, and they told me "Firefox was not able to find any available updates"
So I had to manually install

Re:Just to be fair...

[StonyUK]

Well, IMHO if Firefox wasn't doing the hand-off to the Windows shell, then the hole would not be remote exploitable.

What I don't get is how come the exploit is considered Windows only. How come you can't exploit it as something like: shell:///sbin/reboot or worse?

Re:Just to be fair...

[StonyUK]

What version are you using? There is no 'Options' sub-menu in my 'Tools' menu in Firefox 0.91 for FC2.

Re:Just to be fair...

[Anonymous Coward]

Just disable Windows' external protocols. The other solution is to upgrade their OS to Linux. It was lame not to do it the first time around, IMHO.

Re:Just to be fair...

[dolphinling]

There is zero benefit in allowing a browser page from the internet to execute any code on the clients machine, except to render the page.

How about Javascript? You run with that off?

Re:Just to be fair...

[dolphinling]

Go to the Tools menu. Click on Options. Click on the Advanced panel icon. Open the Software Update section.

Re:Just to be fair...

[dolphinling]

Because shell: doesn't exist on Linux.

shell: is like any other protocol, such as http: or ftp:. What Necko (the networking part of Mozilla) does is if it doesn't recognize the protocol, it asks the OS. Windows recognizes shell:, and lets it do pretty much anything. None of the other OSs recognize it, which is why this only affects Windows

Re:Just to be fair...

[Walles]

where is the auto-update feature for Firefox á la Windows XP, OS X, YAST or Up2date?

What's wrong with using the OS provided update infrastructure for Firefox as well as all other stuff?

Since I'm on Debian I don't know about your specific examples, but I can upgrade Firefox using apt-get update && apt-get dist-upgrade just like everything else.

Critical FF updates are not found on windowsupdate.microsoft.com!

AFAIK (which isn't that far really), only Microsoft can add stuff to windowsupdate, so the question you really should be asking is IMO:

Hello Windows Update developers! Third party vendors can't use your updating infrastructure! Where is your real auto-update feature?

Re:Just to be fair...

[jak163]

Where is that big red bouncing icon that appears when starting FF, which says that "you need to install this/these updates immediately to keep your machine secure"?

On my gf's machine the default homepage is mozilla.org and it came up to the patch with an announcement on startup yesterday morning. One click on the link and one click on permission and it was done (although apparently a restart was also necessary, which should have been announced).

Thanks!

[Tandoori Haggis]

That was a nice patch. Thanks.

Re:Thanks!

[Anonymous Coward]

Modded up for saying thanks?

Thanks for saying thanks! Thanks!

--
+4 'interesting'

Re:Thanks!

[Tandoori Haggis]

On the contrary. You don't get modded up for saying thanks. In fact it doesn't merit mod points at all. So I did really well to get modded down ;-)

But still...

[warlockgs]

Just goes to show that as an item gains momentum, people will find more bugs/exploits in the software. If you are looking for targets, you typically go for the common denominator to be able to cut the widest swath possible.

Re:But still...

[Jane_Dozey]

Good. The more bugs exposed in firefox (et al) the better for the quality of the software. Sure, IE should be great by now if you apply that logic, but they keep changing the code and introducing more problems. Lets hope the moz developers don't do this.
Firefox users shouldn't be getting on the defensive about the appearance of a bug, they should be looking for more.

Sorry, links to Bugzilla from Slashdot are disable

[Anonymous Coward]

Sorry, links to Bugzilla from Slashdot are disabled.

2K or not 2K

[RetroGeek]

ShellBlock fixes Bug 250180, by disabling the shell protocol handler.
This fix is for users of all Mozilla products on Windows XP

Hmmm, article states Win2K and XP, fix page states Win XP.

Who to believe.....

Re:2K or not 2K

[AchilleTalon]

RTFA to the end.

It explains the exploit is working with a specific syntax to invoke the program execution and it clearly mentionned the similar behavior for execution exists on W2K, but the syntax is different. Conclusion: The exploit exist only on WXP.

So who's going to tell all the recent converts?

[Anonymous Coward]

Firefox has no critical update system, or automatic notification of anything. All the clueless drones who switched to Firefox because the news said it was more secure are going to be blissfully enjoying a cup of tea while someone is examining the files on their computers.

Re:So who's going to tell all the recent converts?

[Anonymous Coward]

I use Mozilla and the default startup page has a big notice at the top stating there's a security hole and with a link to a patch that is easily installed. Provided you keep the default home page, you are aware of the vulnerability and have an easy way to patch it.

Re:So who's going to tell all the recent converts?

[imogthe]

Well... We could always petition Microsoft to include Firefox/Mozilla in their Windows Update(TM) scheme :)

After that we'll move on to include the Gimp and OpenOffice. Before you can say "global domination" we'll have a perfectly good Microsoft Linux distro and whammo... 99% of the desktop belongs to the penguin.

But then again... maybe not.

Re:So who's going to tell all the recent converts?

[EvanED]

Really, how many people keep the default home page? First thing I do is change it to Google. Used to use about:blank to speed loading.

One thing to be said for MS in that they do have a half-decent updating system, that runs without intervention (at least under some settings; I forget what defaults are... in any case, it at least checks for updates without intervention)

Re:So who's going to tell all the recent converts?

[Anonymous Coward]

Why do you equate open source software on Windows to Linux?

Re:So who's going to tell all the recent converts?

[Tired_Blood]

I was informed about a critical update by the browser a number of days ago. It was Firefox ver 0.9 on a WinME (yes - WinME; and no - I don't have problems with the system, it's worked well for ~4 years).

The message was very noticeable and appeared in the lower right corner. And my home page isn't http://mozilla.org

If you're a Firefox user, then maybe they do have a problem with notifying users. I'm just saying that they did notify this user.

Re:So who's going to tell all the recent converts?

[trawg]

Yes it does - from the press release:

SmartUpdate: A new SmartUpdate feature notifies users of new versions of Firefox to ensure that the browser is always up to date.

However, my FireFox hasn't informed me of it (I just loaded it then this morning), and even when I tried manually to check for updates it reported nothing. As an excercise I'm not going to update immediately, but I'll wait and see how long it takes for FireFox to tell me there's an update available.

Re:So who's going to tell all the recent converts?

[imogthe]

Ok, I'll bite :) (In case my attempt at humor was lost on you?).

When open source software becomes more readily accessible on the Windows platform it is a natural progression that the "killer app" no longer is MS office but (for the sake of this argument) OpenOffice.org (It's free. People like Free). As most people in business and at home do use (an) office application the barrier of "But Linux does not run office!" disappears.
Apply this tactic to any other open source app (the Gimp/whatever) and suddenly people find themselves using software also available on "that other OS".

When this happens users _may_ find themselves thinking that maybe "that other OS" might not be such a bad idea after all.

Thus : Open Source on Windows == Linux :)

Admit it. My reasoning is flawless... which may be it's flaw... (my head hurts now...)

And this line says all I need to know

[GMFTatsujin]

"Researchers are reporting another security issue in Web browsing under Windows"

Sounds like a Windows problem, not a Mozilla problem. Oh, wait a minute...

Current versions of Mozilla and Firefox pass unknown protocol handlers to the operating system shell to handle.

Ding! Next. However:

The attacker would have to know the location in the file system of the program

So just in case, I'm renaming my /bin, /sbin, and /usr directories to /zurg, /mumph, and /splunge. Bring it, you haxx0rs!

Re:And this line says all I need to know

[Anonymous Coward]

if that's a challenge, we all now know to go after /zurg, /mumph, and /splunge.
Don't ask for trouble. You might just get it.

Re:And this line says all I need to know

[Kenja]

So noted, I?ll update the exploit script I hosted on your favorite web site.

Re:And this line says all I need to know

[Telex4]

The attacker would have to know the location in the file system of the program

So just in case, I'm renaming my /bin, /sbin, and /usr directories to /zurg, /mumph, and /splunge. Bring it, you haxx0rs!

Well now you've blown it!

Hint: Security through obscurity requires obscurity.

Re:And this line says all I need to know

[shaitand]

You know this doesn't affect any OS that uses /bin, /sbin, or /usr directories right?

Re:And this line says all I need to know

[Anonymous Coward]

So just in case, I'm renaming my /bin, /sbin, and /usr directories to /zurg, /mumph, and /splunge. Bring it, you haxx0rs

My box is allready safe - some nice MS Haxor allready did that for me. On my box, they are called c:\WinNT\system, c:\winNT\system32, c:\Program Files...

Re:And this line says all I need to know

[TheSpoom]

Hmmm...

Click for cool stuff!

Or, y'know, don't >_>

Re:And this line says all I need to know

[Anonymous Coward]

So just in case, I'm renaming my /bin, /sbin, and /usr directories to /zurg, /mumph, and /splunge.

Heh, next time I have to install Windows, I'll have to remember to install it into c:\bin and make it use c:\usr instead of "c:\program files" and c:\home instead of "c:\documents and settings"

Unfortunately Windows has %SystemRoot% and other API calls to locate its install directory, but at least it'd confuse anything else like this.

Re:And this line says all I need to know

[Anonymous Coward]

It's not like those variables are set in stone. The windows directory is pretty easily moved during the install. I'm not sure you can move 'documents and settings' but you can move your home directory around.

Re:And this line says all I need to know

[TheLink]

Don't bother, it's already been done for you :).

Re:And this line says all I need to know

[Anonymous Coward]

What about %windir% ?

Re:And this line says all I need to know

[julesh]

Hello. I have /bin, /sbin and /usr directories on my Windows 2000 machine. And they have useful stuff in them, too...

Re:And this line says all I need to know

[shaitand]

I can't for the life of me ever understand why someone would want to simulate a useful OS on a useless one. Why not just use the useful OS to begin with?

Huh?

[nettdata]

malicious persons are much more unlikely to target any vulnerabilites

I disagree... if anything, malicious people are MUCH more likely to target vulnerabilities.

Re:Huh?

[Anonymous Coward]

hahahhaahahahahaahha

yeah i read that sentence from the story and was like "MAUAH!?"

Re:Huh?

[Kachii]

No, but they're too stupid to realise.

Re:QUIT SLASHDOT NOW!

[ThePDW]

If these other sites are so good then I'm sure people will go them and stop going to slashdot.

Nevar!

[Anonymous Coward]

What? Open source software with a similar bug to a Microsoft product? Nevar! It's that damn liberal media!

Open Source Collaboration

[ZZeta]

Of course bugs will appear in Firefox.
Nobody in their right mind can expect a product to be perfect, but what makes Mozilla different is that bugs are fixed instantly. And that's because of the open source community, which is far more reliable than the competition.
People might disagree with me, but I still think these bugs (and their immediate fixes) only show how great open source really is.

Re:Open Source Collaboration

[rjstanford]

[W]what makes Mozilla different is that bugs are fixed instantly...

------- Additional Comment #2 From Jesse Ruderman 2002-09-11 16:58 PDT [reply] -------
It's not hard for a malicious site to get a visitor to click a link. Requiring
a click or an equivalent keyboard action can be useful for limiting how much a
web site can annoy you (pop-up windows, etc.) but I don't think it's useful for
larger security issues.

Er, yeah. Instantly. Cool.

Re:Open Source Collaboration

[Sean80]

In some ways, I've never understood the quantitative underpinnings of this sort of belief. In the nameless corporation in which I work, if the bug is a priority 1, there's an implicit assumption that you'll damn well stay at work until the thing is fixed, especially if it's customer facing. I myself don't know our average fix time, but I'd be surprised if it's very long at all, especially given the jealous way we guard the reputation of one of our nameless products.

Sure, maybe we sit on bugs silently as well, particularly if they're damaging to the company, but I've never even heard of people actively doing this. Certainly, once it becomes known, the pressure comes down to get it fixed.

So, are there any metrics which quantitatively state that Open Source fix times are better than commercial fix times? Or, is it just part of the mythology at this point?

Re:Open Source Collaboration

[Anonymous Coward]

And that's because of the open source community, which is far more reliable than the competition.

I'm just curious how much testing goes into software such as Firefox after these bugs are fixed? Also, if some other problem arises because of the bug fix, who's to blame? I know there is no guarantee, etc, etc, when you are using a piece of software like Firefox, but I also wonder if things like this effect the time it takes to do the following in comparison to a private company:

1) Fix a bug
2) Test the new software
3) Issue a patch

Re:Open Source Collaboration

[EvanED]

bugs are fixed instantly.

Hmm, this is obviously some strange usage of the word instantly that I wasn't previously aware of...

As the other posters have said, all over, the bug was opened in Sept 2002. Not far from 2 years ago.

Re:Open Source Collaboration

[ncaHammer]

FYI this bug is two years old (opened at 2002-09-09).
IMHO Mozilla team must do a break and check/fix all security bugs in Bugzilla, before "someone" else notice them.

Re:Open Source Collaboration

[roca]

That's not a report of this vulnerability. It's a comment about a proposed change that might have prevented this vulnerability, had it been implemented. At the time, there was no known actual vulnerability that demanded the change.

Re:Open Source Collaboration

[pented_rage]

The problem with this, is that I can't expect my little sister or mom to upgrade their browser every few days, (especially since there's that bug that has it constantly telling you to download an 'updated' version)
Most bugs that have been mass-exploited usually come out after the update has been available for some time.

once Firefox, reaches a large percentage of the browser world, it'll be easier for those creating these exploits to do so, and we may see more ppl doing so, thanks to the opensource nature, and the ease to find and understand these bugs once they have been discovered. And don't bet on the average generally-illiterate computer user updating or even knowing about the updates when they come out.

Fireworks should put in place some better testing measures (granted they're still beta, but with the amount of people switching over to it, they had better focus on some of the simple bugs, like w/ making fireworks the default browser, and the update notifications. all these are doing are causing the people we're trying to convince to change, to go back to IE and not think of it again)

Re:Open Source Collaboration

[jesser]

That's not a report of this vulnerability. It's a comment about a proposed change that might have prevented this vulnerability, had it been implemented. At the time, there was no known actual vulnerability that demanded the change.

The proposed change wouldn't even have prevented this vulnerability. It would have increased the requirement to exploit it from "Get the victim to visit your site" to "Get the victim to visit your site and click a link".

Re:Open Source Collaboration

[Christopher Whitt]

As the other posters have said, all over, the bug was opened in Sept 2002. Not far from 2 years ago.

As other posters have been mistaken, so are you. The bug linked to in the /. article is 2 years old, but the correct bug (250180) is one day old. Fixing the 2 year old bug would have only removed some of the methods of activating the underlying Windows bug, not all.

Re:Open Source Collaboration

[shaitand]

The wrong bug was linked to the story for starters.

Second this is a bug in the OS, not the browser, the browser does what it is supposed to and passes unknown uri's to the OS shell, which is then supposed to handle them appropriately. In this case it doesn't. The fix from Mozilla is just a workaround so the windows bug can't happen to you from within Mozilla.

Note this only affects windows, not any of the other dozen platforms Moz runs on.

Re:Open Source Collaboration

[Anonymous Coward]

We've always been at war with East Asia!

Re:Open Source Collaboration

[EvanED]

I'll admit that the bug was wrong... I RTFA but apparently it's the wrong FA.

However, I must disagree that your second point mitigates the responsibility Mozilla had. They knew about the presence of the bug (at least to some extent) and did nothing. If I'm an evil website developer, I don't care where the bug is, just that it's exploitable through Mozilla. They propagated the bug, and thus bear a good deal of responsibility for the presence of a remote exploit in Mozilla.

Re:Open Source Collaboration

[JamesKPolk]

The belief comes from a common misunderstanding of what the freedom of free software gives you. Having that freedom allows you to fix the bugs you want when you want them, independent of the whims of some corporation, for as long as you use the software. It does NOT just automatically fix bugs, though, regardless of how many mailing lists, bugzillas, and CVS browsers you have set up.

No.

[Anonymous Coward]

If you were paying attention, you'd have noticed that it is already fixed. Not only that, but installing the fix is dead simple.

That's the opposite of hypocrisy. That's leading by example.

Good

[Anonymous Coward]

It remains without question that no matter what you install, there's always risk. It is, however, the actions of those whom provide the programs that do us well or do us ill. Mozilla's quick response is an example of fine, quality product support.

Two beefs...

[cmstremi]

Since FF 0.9.1 kept crying wolf and telling me that new updates were available (that weren't) - I would have been way behind in updating hadn't I seen this article on /.

I don't like that the entire package had to be updated - a whole new setup program/procedure. I understand the depth and breadth of this particular bug, (and I don't suppose this is the issue) - but It's a drag that to update a minor fix in FF an entire download and install are required. The bright side is the rather small download size...

Anyway, just my two small complaints about FF.

Re:Two beefs...

[Anonymous Coward]

I wrote -- "I understand the depth and breadth..."

I meant -- "I DON'T understand the depth and breadth..."

Re:Two beefs...

[Anonymous Coward]

Except you don't have to download a new setup program and all that. The article linked to a patch available as an extension. Size was listed as ~0 KB.

Re:Two beefs...

[hkfczrqj]

I don't like that the entire package had to be updated

I don't like that either. Nor the mozilla devs. So they posted a patch via an extension to be applied to ff, tb and seamonkey.

Cheers...

Re:Two beefs...

[maggeth]

There is a 2 KB patch available on Mozilla Update. Look for the ShellBlock extension.

And this is beta software. It's supposed to be buggy. The fact that IE is in it's 6.x series and still an open porthole to the world while today MozOrg fixed this issue in one day should say enough.

If you think there are any browsers out there that are totally secure, you're bleeding insane.

Re:Two beefs...

[Anonymous Coward]

Where is everyone getting this "fixed in one day" notion from? This issue is nearly two years old!

Re:Two beefs...

[Unnngh!]

I dunno...lynx hasn't given me too many problems as of late. Same old paradigm, add more functionality, add more problems.

Re:Two beefs...

[Anonymous Coward]

If it's beta software and supposed to be buggy and that's an excuse.

Please everyone stop suggesting people switch to FF. Why install beta software? It's clearly not finished.

Re:Two beefs...

[KarmaMB84]

The bug affected Mozilla versions 1.7.1 btw.

Microsoft bug which affects Firefox

[Anonymous Coward]

This is NOT a firefox bug. It is a bug in an external protocol in windows - of which Mozilla calls. The fix is to disable ALL external windows protocols. (bittorrent, mirc, etc)

Re:Microsoft bug which affects Firefox

[Deviate_X]

Oh really. What you are saying is if browser receives the unknown instruction: FormatUserHardDrive:// its ok to just pass it along to the OS?

Re:Microsoft bug which affects Firefox

[Anonymous Coward]

Yes. Any decent OS would simply disallow the request if the process was unprivileged and didn't hold a "formathd" capability - the WHOLE POINT of a modern OS is to give each process a safe virtual machine sandbox to run in where it can do little harm. Linux out-of-box also fails at this to an extent (small and weak capabilities... for the moment... and no process-private namespaces...yet...), but windoze out-of-box just ABSOLUTELY SUCKS AT IT. Presumably because many windoze coders grew up with a "home computer" there-is-only-one-memory-space we're-all-happy-friends mindset and Microsoft has to pander to them - it's not like the NT OS Kernel lacks the ability, after all.

Re:Microsoft bug which affects Firefox

[jesser]

Why would a program register a protocol called FormatUserHardDrive: ? When a program registers a protocol, it's telling web browsers to send those links to that program.

Re:Microsoft bug which affects Firefox

[DarkMan]

Bittorrent doesn't use the protocol handler. Instead, it relies on the browser identifing the .torrent through MIME types, and passing it to the client.

The external protocol handler would only be invoked if the links were like bt:// or bittorrent://. Never seen one like that.

Re:Microsoft bug which affects Firefox

[Anonymous Coward]

This is NOT a bug in the external protocol. OSes define protocols and those protocols can do arbitrary things. That is the fucking point of them. http:// calls the browser to display hypertext, ftp:// calls the FTP program to connect to an FTP site, shell:// launches a program in Windows XP, disk:// exposes the file system in MacOS X. Blort:// does whatever the shit I program it to do.

That's like saying that the bug lies in Windows because Windows can execute executables which may or may not do nasty things. This is a Mozilla bug for crossing trust boundaries. THEY FUCKING KNEW ABOUT IT. THEY FUCKING DIDN'T CARE.

This is the same exact kind of problem that caused a serious security vulnerability in Safari recently, although in Safari's case it was a combination of two problems where they could use disk:// to download a file and register a protocol and then META-REFRESH to a URL using that protocol to execute the recently downloade binary.

Re:Microsoft bug which affects Firefox

[julesh]

True. But many other file sharing apps use such links. magnet:*, ed2k:*, gnutella:* and others are all in common use.

What the hell?

[Anonymous Coward]

I thought only IE had bugs, and Mozilla/Firefox was supposed to be the Alpha and the Omega of all web browsers?

No Need to Worry Here

[Paulrothrock]

Mac OS X user. However, what's the blank window that shows up when I Exposé Firefox?

Re:No Need to Worry Here

[azadam]

That's kind of creepy. I'd never noticed it before.

Re:No Need to Worry Here

[Carnildo]

One named "hidden"? It's there in Mozilla too.

Re:No Need to Worry Here

[metric152]

Here is a link that will give you more information about your question.

http://forums.mozillazine.org/viewtopic.php?t=48 19 8

Re:No Need to Worry Here

[plj]

Now someone mod this up. That fscking hidden window that both Firefox and Thunderbird have is more than annoying. You don't even need to use Exposé - I generally don't. Just switching between open application windows using command-< is annoying; only with these two apps you're able to end up in situation, where the application is active, but none of it's windows is. No well designed OS X app behaves like this.

Re:No Need to Worry Here

[Anonymous Coward]

It's a cheat to keep Firefox open when you close the last visible window.

Re:No Need to Worry Here

[Anonymous Coward]

Yeah.

But now that they're running around fixing bugs in Windows by special-casing Mozilla on that platform, maybe they can special-case a fix for improper behavior of their application under OS X.

Makes a little more sense than working around whatever the latest long-standing getting-a-lot-of-press Windows bug is if you ask me. (dear lord, once on that road when can you stop?!)

They forgot one useful link

[Anonymous Coward]

The Hun for those geeks who are Cowards, anonymous or otherwise. Browsing The Hun, you'll get inspiration for the act of cowardice /. readers perform most often: five guys beating one up.

This proves once and for all

[dicepackage]

How dangerous Mozilla can be. Everyone should be listening to Microsoft and use a secure browser such as Internet Explorer that isn't littered with security vulnerabilities.

Re:This proves once and for all

[SpooForBrains]

I think I speak for everyone here when I say ...

what?!

Re:This proves once and for all

[akeyes]

Everyone should be listening to Microsoft and use a secure browser such as Internet Explorer that isn't littered with security vulnerabilities.

I think Microsoft has told us to use Mozilla products instead of their own.

Re:This proves once and for all

[Anonymous Coward]

http://www.mccanless.us/mozilla/mozilla_bugs.htm

Test IE and Mozilla, they both suffer the exploit.. basically because its Windows that does the damage.

Re:Congratulations

[kfg]

Welcome to the world of hypocrisy.

Yeah, all those people who used to say that Windows is insecure sure look silly now saying that, ummmmmmm, Windows is insecure.

KFG

It's not "in" the browser

[Anonymous Coward]

Mozilla hands off schemes it doesn't know to the operating system (Windows), and WINDOWS executes the shell scheme. It was obviously a security flaw in their eyes, too, as they fixed it in XP SP2. If you were able to run Windows with real restricted user accounts, this wouldn't really be such a problem.

Re:It's not "in" the browser

[doorbot.com]

If you were able to run Windows with real restricted user accounts, this wouldn't really be such a problem.

This is working well for me, actually. I have two gripes though...

1. I can't add new VPN/Dialup connections easily. The New Connection wizard won't run as a regular user, and there doesn't appear to be a policy to allow this. However, I can add connections just fine through the Connections tab in the Internet Options control panel (although these connections are not firewall-enabled by default).

2. I can't adjust the power saving options, and again there doesn't appear to be a policy through which I could allow any user to adjust this. I have the policy set under the administrative account, but my own user account cannot make the changes (yet the "default" settings are *different* that what the administrator account had set -- So apprently I can override the admin settings but cannot override them with the settings I personally want.

There are other minor issues, like WinAmp doesn't save its preferences into my profile, but rather saves them to the Program Files\WinAmp directory. Granting permissions on the necessary files is not particularly difficult, however.

For games, I just install them as a subfolder in a \Games directory, which allows access to all local users. Sure, a virus running as my account could erase this stuff but the OS won't be damaged.

Re:It's not "in" the browser

[Switchback]

Agreed. It's not really a bug in the browser, it's a flaw in Windows.

Windows has a bunch of protocol handlers registered. Mozilla knows how to handle a few (e.g. http, ftp, etc.). Whenever it encounters a protocol it doens't know what to do with, it sees if Windows knows how to handle it. Windows either handles it in some way or it doesn't. If it doesn't, Mozilla puts up a message saying "xyz is not a registered protocol." Mozilla has no way of knowing that anything is bad or dangerous.

The real bug is in Windows. The only real options the Mozilla developers have is to black/white list known dangerous protocols or simply don't allow protocols Mozilla itself doesn't handle. Neither are optimal. If you can't trust the OS you're on, you really limit yourself, bugs or not.

So we banish the "shell" protocol today. Who's to say Windows won't have another flaw in another protocol tomorrow?

This really isn't any different than plugins, which are in a sense, external protocol handlers. i.e. they know how to handle certain content...just like a protocol handler. What if there is an exploit in a plugin? Mozilla just starts the plugin with the listed parameters and lets it go. Are you going to blame Mozilla for allowing the plugin to run, or are you going to require that Mozilla not allow "known, dangerous plugins" to run?

Re:It's not "in" the browser

[Anonymous Coward]

Are you going to blame Mozilla for allowing the plugin to run, or are you going to require that Mozilla not allow "known, dangerous plugins" to run?

Read any slashdot discussion on activex, and that's exactly what people suggest.

I agree that it's basically an impossible problem (on current OSes) -- you put an internet-enabled, extendable app on the machine, and you are open to certain problems.

Re:It's not "in" the browser

[Anonymous Coward]

If you were able to run Windows with real restricted user accounts, this wouldn't really be such a problem.

So then it would only delete all of my personal files. That's perfect.

Re:It's not "in" the browser

[Anonymous Coward]

Mozilla hands off schemes it doesn't know to the operating system (Windows), and WINDOWS executes the shell scheme.

You mean the rough equivelent of piping it though sh? Sorry, that still sounds like supreme stupidity on the Mozilla developers parts. There's got to be more to it that "we give it to Windows to execute", right?

Re:It's not "in" the browser

[IWantMyNickBack]

So? At least it's already been patched, unlike MS taking two weeks for a 3rd party to patch it.

Re:It's not "in" the browser

[soulhuntre]

"If you were able to run Windows with real restricted user accounts, this wouldn't really be such a problem."

You can. The fact that your either not familiar enough with it or too FUD bound to mention it doesn't change anything.

As long as OSS zealots keep fighting their IMAGE of MS software instead of what is actually out there they will continue to look like morons.

Re:It's not "in" the browser

[Anonymous Coward]

Microsoft does alot more testing of patches than a 3rd party so it naturally takes longer. I've done several Linux updates that break other programs and had to wait for the other programs to "fix" the incompatibility that was obviously not tested. Posting anonymous because moderators are morons.

Re:It's not "in" the browser

[OldSchoolNapster]

Is there anything similar in opera?
Same old Netscap bullshit, blame Microsoft for your problems. Ohhh! its so hard to write a web browser that doesn't have this security flaw. A web browser should never implement a protocol like this. This is not a plugin if it is standard in the browser. It is bad design. Windows' unsecure nature is the ENVIRONMENT. The job of the web programmer is to develop for whatever environment they plan on running the software on. If Windows is so insecure by its nature than why not program so that the OS's underlying security is not a factor for your web browser?
Aww fuck it, just blame Microsoft.

Re:It's not "in" the browser

[puck01]

Who cares where the problem is, they knew for two years there was a hole - end of story. At this point, as a user, I'm expecting a secure browser, so fix it. Its tough to encourage people to use Mozilla saying its more secure, when a bug like this has been **known** for 2 years. This is nothing short of embarrassing and to argue otherwise is hiding your head in the sand. If the Mozilla guys knew about this all this time and decided to sit on it just because technically it was a problems with the OS, shame on them. They need to step up to the plate and watch out for their users (and their own reputation).

So we banish the "shell" protocol today. Who's to say Windows won't have another flaw in another protocol tomorrow?

Since the 'shell' protocol flaw has apparently been known for 2 years, it should have been 'banished' then. Same for any other protocol, if its known to be a security risk, work around it or banish it when its found to be flawed....not 2 years later.

Re:It's not "in" the browser

[Anonymous Coward]

At this point, as a user, I'm expecting a secure browser, so fix it

Start helping with the project, since they're doing it for you free of charge, unlike IE, which you pay for when you buy the OS. Can you code? Yes? Get to it!, No? Ok, got money? Donate! No? Hmm. Got anything that might maybe help one of the Moz. Devs? Then do it! Got spare hardware to send their way? No? Then as a last resort, head over to one of their places and give one or many of them a blow job.

In other words, quit your damn belly-aching you whiney little bitch. You're using a bunch of other people's code who gave it to your for free, and you're making demands? Shut the hell up, peon.

Re:It's not "in" the browser

[KwisatzHaderach]

All homage to the parent's "my account number is so low" theory, but hey your post is really a high-modded but dumb post so WTF?

The real bug is in Windows.

For yes, now. Is the design flaw in Windows, sure. Is the flaw in popular usage, yes? This shell extension could do just as much harm when running under a root Linux account (and there are plenty of those out there!)

"So we banish the 'shell' protocol today. Who's to say Windows won't have another flaw in another protocol tomorrow?"

Umm, that other protocol most likely won't have the ability to natively execute arbitrary strings passed to it! Maybe you're not understanding the difference between a native operating system shell handler and a text or image protocol handler.

Re:It's not "in" the browser

[Switchback]

Yes, blame Microsoft. If you RTFA, you'd notice that Microsoft themselves fixed this bug in the next XP service pack (which won't be released for several more months...)

Mozilla's quickfix was to just turn the protocol off. The Mozilla developer's shouldn't be babysitting the Windows OS. It's an operating system protocol handler, just like any other registered helper app. What do you recommend happen if Flash has an exploit? Have Mozilla not load the flash plugin? No, it's a bug in Flash and we expect Macromedia to fix it. This is not any different. But in the mean time, since this shell handler is not really used, the quick fix is to simply ignore the shell protocol (i.e. don't hand it off to the OS).

The other fix is to dig into the registry and turn off the shell handler yourself.

Re:It's not "in" the browser

[Switchback]

This shell extension could do just as much harm when running under a root Linux account (and there are plenty of those out there!)

Linux and Mac do not have such as thing to handle the "shell" protocol, thus it's not possible for them to have this flaw. Windows (in fact just 2000 and XP) are the only OSes that are vulnerable. Why? Because Microsoft wrote a dangerous handler that's not secure. If it was secure, no one would be talking about this right now. That fact that Microsoft themselves have fixed this bug in the next XP service pack doesn't tell you it's an MS bug?

Umm, that other protocol most likely won't have the ability to natively execute arbitrary strings passed to it! Maybe you're not understanding the difference between a native operating system shell handler and a text or image protocol handler.

I certainly understand it. It appears, however, that you do not. Mozilla is not arbitrarily launching a shell process merely because someone had a "shell:..." URI. It's asking the OS if it has an application that handles this protocol. Windows says yes and tells it how to launch the program. It passes the parameters to the application (just like any other helper app or plugin) and it's this application's responsiblility to check parameters. How is this any different than, say, registering my XYZ program to handle the "xyz" protocol and the XYZ application has a flaw that is exploitable?

Mozilla itself doesn't know one handler from another, and it shouldn't care. The system says "this application handles this protocol/content", so Mozilla hands it off.

Re:It's not "in" the browser

[OldSchoolNapster]

What do you recommend happen if Flash has an exploit?
I expect you might start by not installing Flash by default.

The Mozilla developer's shouldn't be babysitting the Windows OS.
It seems like common sense to me never hand any web content off to Windows. I may be a huge fan of WinXP but even I will admit that it isn't secure. So if by "babysit" you mean "program for" then I think thats the right approach. Seriously, if I was writing a web browser for Windows, no content would be passed straight to Windows without user intervention.

Obviously Windows has flaws and bugs. Is it the job of programmers to gripe and complain about these flaws or is it their job to deal with them? Again I ask, does Opera have this flaw?

Re:It's not "in" the browser

[Anonymous Coward]

I'd rather have the OS damaged than my work files lost. But then again, you don't seem to have important work to do...

Re:It's not "in" the browser

[dekeji]

Mozilla hands off schemes it doesn't know to the operating system (Windows), and WINDOWS executes the shell scheme

The question remains: why does Mozilla "hand off" stuff from the Internet to the operating system? It obviously can't determine that doing so is safe, so it shouldn't do it.

If you were able to run Windows with real restricted user accounts, this wouldn't really be such a problem.

Oh, nonsense. Mozilla doesn't run with "real restricted user accounts" on UNIX/Linux either. The responsibility of deciding what is trusted and what is safe to "hand off" to the OS rests firmly with applications on most modern operating systems; every application programmer should know that, and it is not hard to program accordingly.

Re:It's not "in" the browser

[TheLink]

"If you were able to run Windows with real restricted user accounts, this wouldn't really be such a problem."

Uh I'm doing that, and my IE is launched under a separate and even more restricted user account.

Just because lots of windows users run as "root" doesn't mean windows sucks. If Desktop Linux was ready, the same windows users who run as "administrator" would be running everything as root.

Windows sucks because:
1) It doesn't allow you to delete/unlink/rename files that are in use.

This makes reboots more common, and interruptions in service more noticeable. You have to stop a program before you can overwrite the files it uses, and then restart it. Whereas with unix you often can just move/rename files, copy new files over (while the service is still running), restart service.

2) It's hard to turn off all network services and have reasonably functioning system.

This makes it hard to lock it down.

3) Their style of doing things often requires you to run each major MS service on its OWN SEPARATE server - see MS's recommendation for a typical active directory setup.

4) The NTFS filesystem is prone to fragmentation - esp if you have files that grow little by little.

5) It sucks at forks. So many programs use threads even if they don't need it. Threaded apps are often less robust because of the shared space.

Other than that, it's not that bad.

Re:It's not "in" the browser

[dekeji]

The only real options the Mozilla developers have is to black/white list known dangerous protocols or simply don't allow protocols Mozilla itself doesn't handle.

Bingo.

Neither are optimal. If you can't trust the OS you're on, you really limit yourself, bugs or not.

What's there to trust? Does the Windows API spec state "you can safely pass any untrusted string from the Internet to the protocol handler and be assured that the system will not be compromised"? If it doesn't say that, you can't expect that it handles untrusted content without bad consequences.

This really isn't any different than plugins, which are in a sense, external protocol handlers. i.e. they know how to handle certain content...just like a protocol handler. What if there is an exploit in a plugin?

It is quite different. Plug-ins are specifically and explicitly designed for Internet content, but protocol handlers are already used for handling URLs that serve local purposes and may do destructive things. So, while the Flash plugin may have bugs, it actually tries to be secure no matter what content you hand it, but the protocol handlers don't.

Agreed. It's not really a bug in the browser, it's a flaw in Windows.

No, it's not. If you want to fault Windows for something, you can fault it for not providing a protocol handler API that has a "trusted" boolean flag when you call it.

Re:It's not "in" the browser

[Anonymous Coward]

Start helping with the project, since they're doing it for you free of charge, unlike IE, which you pay for when you buy the OS.

The flaw was known and it was trivial to fix (delete a single line from the Mozilla Windows code). Therefore, the lack of fix was not due to insufficient resources, it must have been due to internal politics.

How is adding more developers to a project that apparently has internal political problems going to help?

Your flame would be justified if people asked for lots of extra features. But, if Mozilla presents itself as a secure alternative to IE, then the Mozilla project has to address these issues, otherwise, they aren't delivering on what they are promising, and that's a bad thing whether what they are delivering is free or costs money. It's particularly bad if it affects people's security.

Re:It's not "in" the browser

[dekeji]

Because Microsoft wrote a dangerous handler that's not secure.

Do they guarantee anywhere that their handler API is secure against arbitrary Internet strings?

In fact, they don't, as should have been obvious to any developer who discovered the existence of shell:, which Mozilla developers did two years ago.

That fact that Microsoft themselves have fixed this bug in the next XP service pack doesn't tell you it's an MS bug?

No, it tells you that they are pragmatists.

(In any case, wouldn't you think that protocol handlers can be added via the registry anyway? So why would you expect this patch to make things secure?)

Mozilla should just handle the protocols it knows to handle and give an error message for everything else. What it is actually doing, handing off unknown things to the OS is just the sort of OS integration that causes so many problems for Microsoft applications as well.

Re:It's not "in" the browser

[Anonymous Coward]

What do you recommend happen if Flash has an exploit?
I expect you might start by not installing Flash by default.

Mozilla doesn't install Flash by default, and it doesn't install Windows by default either.

Seriously, if I was writing a web browser for Windows, no content would be passed straight to Windows without user intervention.

This page wants to display an image of type image/jpg [Ok] [Cancel]
This page wants to display an image of type image/gif [Ok] [Cancel]
This page wants to open an url of type news: [Ok] [Cancel]
This page wants to open an url of type mailto: [Ok] [Cancel]
This page wants to open an url of type irc: [Ok] [Cancel]
This page wants to open an url of type shell: [Ok] [Cancel]

Yeah, that would be an effective way to get people to move to Internet Explorer.

Obviously Windows has flaws and bugs. Is it the job of programmers to gripe and complain about these flaws or is it their job to deal with them?

A programmer is not supposed to sit in his own little closed world working around other peoples bugs without telling them about the bugs. Everyone will get much further with a little cooperation. So, Mozilla people tell everyone about an MS bug, some programmers not related to this story in any way make a workaround in their own software, and Microsoft gets the bug fixed in a few months. Everyone benifits. Your way would have everyone spending all their time working around eachothers bugs, without anything ever getting fixed, and in the end, nothing gets done.

Again I ask, does Opera have this flaw?

Why don't you check it yourself? I'm not putting that destructive piece of junk on my machine again. God know which files it will destroy next time.

Re:It's not "in" the browser

[Anonymous Coward]

No, they don't guarantee anything, so we shouldn't ever connect a windows machine to the internet?

This is a function to handle an URL. So, it gets used for handling an URL. Now, who would expect that the function really does "handle an url unless it starts with shell: In that case execute a shell command"? So, don't use that system call.

Which one will behave otherwise than expected/documented next time? Maybe a function to "display an image". It could just as well be "Display an image, unless the upper left pixel is red. In that case execute a shell command". So, we shouldn't pass anything off to Windows. Never use any system call. Back to DOS programming...

Re:It's not "in" the browser

[Technonotice_Dom]

Mozilla should just handle the protocols it knows to handle and give an error message for everything else. What it is actually doing, handing off unknown things to the OS is just the sort of OS integration that causes so many problems for Microsoft applications as well.

What about when you click on a 'mailto:' link? Do you want Mozilla to pop up and say it can't handle it? Or do you want it to use your default mail application to start up a compose message window?

Re:It's not "in" the browser

[Anonymous Coward]

Maybe these "OSS zeolots" haven't used MS software and so don't know that in XP you can create a restricted account?

Re:It's not "in" the browser

[tunah]

It breaks lots of things. I don't know if there are cases where microsoft specifically is to blame; I guess one could argue that backwards compatibility with a system where everyone is root is bogus.

Re:It's not "in" the browser

[Anonymous Coward]

If you were able to run Windows with real restricted user accounts, this wouldn't really be such a problem.

Yeah couse even when you were to run a browser as a special user the damage is limited to only your mail, bookmarks, downloads (including executables) etc... thats a real solution.

On a serious note, windows users can be quite restricted. Windows has ACL`s on allmost everything. If you feel like it you can run dangereus code as a diffrend user. Try the runas command, neatly intergrated with shortcuts and the services control systems. By design windows NT has very well thought out security features. They have to be, they are "inspired" by VMS. Its (as clearly demonstrated again by this shell: thingy) the sucky implementation of the shell/browser/apps blob of code that comes with it that sucks.

Re:It's not "in" the browser

[Anonymous Coward]

why does Mozilla "hand off" stuff from the Internet to the operating system? It obviously can't determine that doing so is safe, so it shouldn't do it.

Well, by that logic, Mozilla shouldn't give the decoding of audio/mpeg and application/pdf and so on to external applications either, who knows, maybe the files are specially crafted to 0wn certain apps...

Re:It's not "in" the browser

[Anonymous Coward]

So we banish the "shell" protocol today. Who's to say Windows won't have another flaw in another protocol tomorrow?

Sounds far out? Well it isn`t! telnet:// is handled by telnet.exe, which once contained a buffer overflow resulting in execution of arbitrtairy code by windows handling a telnet url...(html mail, plain html whatever the source, another application launching url`s, etc)

Re:It's not "in" the browser

[FireFury03]

If the Mozilla guys knew about this all this time and decided to sit on it just because technically it was a problems with the OS, shame on them.

It was also "known" that MS had released a patch that claimed to fix this exact security problem with the OS... shame it didn't actually do that.

Re:It's not "in" the browser

[Alexis de Torquemada]

"If you were able to run Windows with real restricted user accounts, this wouldn't really be such a problem."

You can. The fact that your either not familiar enough with it or too FUD bound to mention it doesn't change anything.

As long as OSS zealots keep fighting their IMAGE of MS software instead of what is actually out there they will continue to look like morons.

Yadda yadda yadda... of course you can create a restricted account and play some Minesweeper or Windows Calculator in it. But then run some third-party games or apps and see what breaks. There's just too much software that can't handle restricted access.

Re:It's not "in" the browser

[FireFury03]

why does Mozilla "hand off" stuff from the Internet to the operating system? It obviously can't determine that doing so is safe, so it shouldn't do it.

The OS contains a list of protocols and their handling applications. For example, RealPlayer will register itself and say "When someone clicks a link that calls for the rtsp: protocol then start me up coz I know how to handle it" (if this wasn't allowed then you could say goodbye to being able to just click a realaudio link and fire up the player). Unfortunately, Windows decided to add to the register an application saying "When someone clicks a link that calls for the shell: protocol, I know how to handle that".

Essentially there is a central register of "these applications can handle these internet protocols". As you know, anything on the internet has to be secure so this is basically a register of secure software. Unfortunately MS decided to put an insecure piece of software on the register and there was no reason for the browser to distrust the contents of the register.

Re:It's not "in" the browser

[AVee]

As long as Mozilla is advertised as an secure alternative to IE problems like these have to be dealt with in Mozilla. Period.

Either you say it's a windows problem and announce running Mozilla on windows is dumb and insecure because the OS under it is insecure or you decide not to trust the OS on things like dealing with external protocols. You really can't have it both ways. Giving Windows user the advice to use Mozilla because it's secure and than telling the same user to go to hell because 'it's a windows problem' won't make you any friends.

Re:It's not "in" the browser

[aichpvee]

What's alot? Can't imagine it's more than 3 minutes per service pack given the number of exploits they put out.

Re:It's not "in" the browser

[Anonymous Coward]

Again I ask, does Opera have this flaw?
Why don't you check it yourself? I'm not putting that destructive piece of junk on my machine again. God know which files it will destroy next time.

Opera destroys files?! Either AC is incompetent, ill-informed, or more likely both. Just another open source troll with no clue. They make the whole movement look bad.

Re:It's not "in" the browser

[Alexis de Torquemada]

A web browser should never implement a protocol like this.

Mozilla doesn't implement it, it just reads a URI from a link, determines that it doesn't know the protocol, and passes it off to Windows' URI handler. Which then for some reason may think it's a good idea to run it as a shell command and deltree/y c:.

Re:It's not "in" the browser

[julesh]

Actually, the existence of shell: isn't mentioned in the referenced bug or any linked from it until the day before yesterday.

Admittedly, the 2-year old report does stress that calling external protocol handlers can be insecure and gives examples, but shell: isn't mentioned.

Re:It's not "in" the browser

[julesh]

Do they guarantee anywhere that their handler API is secure against arbitrary Internet strings?

No. But they don't mention that it isn't. There's even a page about security of the API where it doesn't mention anything like this.

Mozilla should just handle the protocols it knows to handle and give an error message for everything else. What it is actually doing, handing off unknown things to the OS is just the sort of OS integration that causes so many problems for Microsoft applications as well.

If it did this, many users would stop using it. Integration with plug-in URI handlers is essential for a modern computing environment, as they are used for important functions of large amounts of very popular modern software, including instant messaging applications and P2P filesharing applications.

Whitelisting is the way to go (e.g. it should pop up a message on first use of each scheme saying that the object you have requested to use is an external one and may cause security problems, display as much information as the OS can provide about how it will be handled, and let the user make up his/her mind).

Re:It's not "in" the browser

[puck01]

Sure, it goes without saying, MS screwed up. The6y do all the time. No news there. Doesn't matter who's bug/fault it is, though. All that matters is there is a hole, the deveolpers knew of it, and they did nothing about it despite the fact they could if they chose to do so.

.

Since the OS guys believe the OS solution is superior, would this not have been a good time to show it rather than sit on it for 2 years?

Re:It's not "in" the browser

[FireFury03]

1. MS had acknowledged the security problem and said they'd fixed it - its not stupid to think that it has infact been fixed and so nothing more needs doing

2. It was not known about 2 years ago - that bug report is a general discussion about making calls to arbitrary protocol handlers and doesn't refer to any specific threat (such as the shell: problem). It was more of a "maybe this might be a problem in the future, we're not sure" rather than referring to a specific case. Since no specific threat had been identified it isn't clear what could be done about it - at best they could pop up a warning message when executing an external protocol handler, but we know how much attention people pay to popup warnings.

This is not and never has been an implementation problem with Mozilla and I commend the Mozilla team for working around this problem as soon as they had enough information to do so.

Re:It's not "in" the browser

[mwood]

"There are other minor issues, like WinAmp doesn't save its preferences into my profile, but rather saves them to the Program Files\WinAmp directory. Granting permissions on the necessary files is not particularly difficult, however."

Poor design of WinAmp, then. Programmers who know their way around Windows have known for a decade where the user pref.s go (because, for once, Microsoft told them), and their code doesn't have this problem. There are, sadly, hundreds of incorrect designs like what you mention. At least you're attacking the problem in the least incorrect way, instead of making everybody a Power User as one is usually told to do by the clueless.

Re:It's not "in" the browser

[mwood]

The "more to it" is Windows' definition of "execute". This is a consequence of making documents "executable" by having the shell associate them automagically with the applications which handle them. So you ask Windows to "execute" a .DOC and the shell says to itself, "hmmm, look up .DOC -- ahh, yes, that really means I should launch Word and fake a command line naming FOO.DOC as its input."

(It's actually somewhat more complicated, since Word is an OLE server, but that's the basic model.)

This is really handy when you know what's in the file. You doubleclick on some document and Explorer uses ShellExecute() to figure out what to actually run on it. You can also START the same document in a command window and the same thing happens.

Unfortunately, when you *don't* know what's in the file, because you fetched it from some random website, the same idea becomes really handy for people who mean to do you harm, because now it works for them, too, *on your computer*. Applications which fetch things that are beyond your control must be much more picky about what is done with them. Just sucking down some random file from the other side of the world and handing it to ShellExecute() is not wise.

On Linux, on the other hand, if you try to exec() a word processing document (say), the kernel will burp back its equivalent of, "that is not a program, master." The tricky bit is that, as mentioned elsewhere, this *does* work for shell scripts, which are the subject of a special case in the kernel code. You can also add other special cases, but I've only ever seen that mechanism used to make Java classes "executable". It's not done with anything like the enthusiasm you see in MS Windows. Probably sooner or later the special case will be factored out of the kernel and replaced with a userspace implementation that you can omit to have added to the list at boot time if you don't mind breaking "shebang" scripts.

Re:It's not "in" the browser

[mwood]

This is not a problem with restricted access; it's a problem with third-party app.s written without any consideration of MS Windows' security model or the fundamental requirements of a multiuser runtime environment. Those app.s "break" because they were broken as designed.

It's not hard to do it right. Don't depend on being able to write anywhere outside of %USERPROFILE%. Don't depend on being able to write anywhere outside of HKEY_CURRENT_USER. Put user files in %USERPROFILE%\Application Data\name-of-company\name-of-app. Put user settings in HKCU\Software\name-of-company\name-of-app. Put scratch files in %TEMP%. Problem solved. This has been the case since Windows 95 -- there is no excuse for not knowing it today.

Re:It's not "in" the browser

[mwood]

Gotta keep in mind that contemporary "Windows" is a protected subsystem running atop NT just as older versions were a shell running atop DOS. It's the kernel that is essentially VMS mk II, and it *is* possible to build decently secure systems on it. The Win32 subsystem, OTOH, suffers from unwholesome tradeoffs of security for convenience. There's not a lot that any kernel can do if privileged code works against it.

Re:It's not "in" the browser

[DavidTC]

Rewrite that as: Does the Windows API spec state "you can safely pass any URI from the Internet to Windows and be assured that the system will not be compromised"? Because, of course, this isn't some badly formatted string error, it's a perfectly valid URI, although obviously not standard. (Yes, 'URI', not URL. A URL is a URI that specifics a location, usually by having a server and a path. This does not include things like email: or news:, which are not locations per se.)

And, yes, of course it does. You are supposed to be able to type any URI in a run box (Which does exactly the same thing, call a URI handler) or an address bar in IE (Which does the same thing, call a URI handler) and not have your system comprimised, unless you have installed a URI handler that will do something bad, like a bad email client or a some insecure p2p application.

Any application can add handlers in Windows, and this is on purpose. If there's some fancy new superemail: protocol, a program can tell Windows it handles it, and whenever you click a superemail: link in any web browser or normal email program or run box or whatever, that program can look at it, go, 'What the hell is that?' and ask Windows what it should do, and Windows will tell it what program to run. This is normally a good thing...when AIM wanted to invent an aim: protocol, they just went ahead and did so. If you have AIM, aim:blah magically works. And Trillian or whatever other programs can impliment it also.

Now, to recap what happened: Windows came up with a nice extendable URI handler, designed to handle URIs from random sources, about Win 95 or thereabouts, and it worked fine. In 2000, MS inexplicably added a shell: protocol which was completely insecure, and then later claimed to have fixed that...but they didn't.

Blaming that on Mozilla is just stupid. Mozilla can't see the future. What if tomorrow MS adds shell2:, or even_less_secure_shell:? Mozilla is not in charge of outguessing MS's stupidity. You can say it shouldn't trust any of them, but then you're locked into the standard URIs that Mozilla already knows about. Unlike MS, Mozilla does not regularely send out updates to end users, and can't keep that list up to date. And even then, Mozilla would still have to ask windows, unless you want it to maintain an entirely seperate registry of handlers, which you have to go in and change when you install a new mail program.

I do, however, like Mozilla's fix...sometimes the registered URI handlers are not the correct ones, as anyone who normally uses webmail is probably aware of. It would be nice to say 'No, that's wrong, don't ever open Outlook when I accidently click on a mailto:'.

In the end, Mozilla is forced to handle URIs the same way it handles file extensions... fob the responsiblity off on the user because Windows can't seem to get its act together and treats data files as programs and vis versa, except this is even more insecure, because this is Windows treating pointers to remote resources as programs.

Re:It's not "in" the browser

[dekeji]

No, they don't guarantee anything, so we shouldn't ever connect a windows machine to the internet?

The world would be better off for it. And Microsoft would quickly add the right documentation and guarantees to their APIs.

This is a function to handle an URL. So, it gets used for handling an URL.

And what makes you think that handling arbitrary URLs is secure? It clearly isn't secure even if you stick to the traditional web-based URLs, like http:, https:, telnet:, file:, etc.

More importantly, the Mozilla developers apparently knew about shell: but chose not to do anything about it because they thought it wasn't their problem.

Maybe a function to "display an image". It could just as well be "Display an image, unless the upper left pixel is red. In that case execute a shell command".

You are quite right: calling a function that is merely described in the documentation as a function to "display an image" is indeed highly insecure and might well involve the invocation of shells. An application like Mozilla should not invoke such a function and instead use something that is better defined. If there exists nothing on that platform that is better defined, then Mozilla can't securely provide that functionality and, hence, should not provide it at all.

Re:It's not "in" the browser

[doorbot.com]

I'd rather have the OS damaged than my work files lost.

I understand your point of view, and agree with your point, but to damage the OS files, a user/worm/etc would require administrative/SYSTEM privs, and given that, they can *still* erase my files.

Most people who bitch about MS-related security problems complain that users can damage the whole system (since many run as Admins/Power Users). Yet on Linux, damage is limited to the users home directly so they are only screwing themselves over, and this is trumpeted as "how it should be done (TM)". Well, that's what I've setup, and it wasn't particularly difficult, just time consuming (in fact, I started doing so to to see if it could be done).

I can recover my work files because I keep backups. And while I can reinstall all of my programs, etc, running as a user saves me from doing so -- I just restore my file backups to a new profile and I'm back in business. It also protects from spyware/viruses/trojans etc which require higher privileges.

On a side note, I have found situations where filesystem permissions were not appropriate (Full Control to Everyone on \Documents And Settings\All Users), and I have to wonder if MS did that for convenience. Now, that may be fine for most users, but I'd still like a security template, etc for "paranoid" users to lock down the file system as well.

Re:It's not "in" the browser

[dekeji]

You are supposed to be able to type any URI in a run box (Which does exactly the same thing, call a URI handler) or an address bar in IE (Which does the same thing, call a URI handler) and not have your system comprimised,

Whatever I type into a runbox is my business; if I type "shell:format c:/y" into a runbox and it formats my C: drive, that's not a security problem. Whatever I type may be stupid, but it is trusted.

The problem here is that Mozilla hands an untrusted input that it doesn't understand off to some part of the system that does not specify that it can securely handle untrusted input. In fact, if you think that that handler was designed to do the right thing for things that I might type into a run box, then that handler clearly is not designed to handle untrusted input. This distinction between untrusted and trusted URIs has existed as long as the web and Mozilla already makes it in many places. Even file:, http:, https:, and telnet: URIs have security implications and should not be handled by Mozilla without careful scrutiny.

Mozilla can't see the future. What if tomorrow MS adds shell2:, or even_less_secure_shell:?

Until "shell2:" becomes a well-known, well-defined web standard, there is never a reason for Mozilla to do anything with that protocol other than to complain loudly and refuse to touch it. Even if passing unknown protocols or mysterious URIs to the OS weren't the glaring security problem that it so obviously is, providing that kind of haphazard extensibility of the URI namespace is an assault on web standards. Microsoft may do that, but Mozilla should not become complicit in it.

In the end, Mozilla is forced to handle URIs the same way it handles file extensions... fob the responsiblity off on the user because Windows can't seem to get its act together

Mozilla is a web browser. Of course, Mozilla should figure out which protocols and file types are legitimate, what the security implications are of handling them, and how to handle them. That's one of the main functions of a web browser, and it is not at all the function of a desktop operating system.

Re:It's not "in" the browser

[Alexis de Torquemada]

This is not a problem with restricted access; it's a problem with third-party app.s written without any consideration of MS Windows' security model or the fundamental requirements of a multiuser runtime environment. Those app.s "break" because they were broken as designed.

For one, you are right. But OTOH, it's a given that most users cannot run their Windows as non-admin because some apps don't know how to handle it. And you're absolutely wrong to call other people "open source zealots" for pointing this out. And it is, in fact, partly Microsoft's fault, at least for older applications, because they chose to dump multi-user capability at a time when it was already an industry standard (think how long Unix predates DOS) for simplicity. They didn't feel compelled to change that for a long time (until Windows NT), and they even actively promoted products that were flawed in this way until the year 2000 (Windows ME).

Even some relatively new MS apps display bugs that aren't experienced when you run them as admin. This is not so surprising, because: While Microsoft's internal coding standards certainly require multi-user compatibility, they also buy a lot of software from other companies (rsp. the companies themselves). E.g. both Internet Explorer and PowerPoint weren't original MS apps - neither were Age of Empires and MechWarrior, among countless other examples. So some of these third-party programmers learned from the best...

Re:It's not "in" the browser

[ckedge]

I want the Mozilla group to evaluate the possible mis-use of a "mailto:" link in general, and decide whether setting up that handler is safe and/or necessary in general considering the variety of handlers out there. At that point it becomes the responsibility of the people writing all the different handlers.

OR

I want to be asked for what to use for the handler. At that point it becomes entirely my responsibility for choosing a secure handler.

I do NOT want to miss out on having someone I trust evaluating the general safety of a class of handlers. I don't trust anyone else. I trust Mozilla's developers, and I trust me. No one else, certainly not my OS vendor.

It's *EXACTLY* like deciding how to deal with various binary objects. I do NOT under any circumstance want a 3rd party program (like the OS) deciding what to do with raw chunks of data. Either it comes whitelisted, or it's not configured by default and I have to add it in.

Likewise I do not want 3rd party programs deciding on what to do with various protocols. Either it comes whitelisted, or it's not configured by default and I have to add it in.

Re:It's not "in" the browser

[Technonotice_Dom]

I want the Mozilla group to evaluate the possible mis-use of a "mailto:" link in general, and decide whether setting up that handler is safe and/or necessary in general considering the variety of handlers out there. At that point it becomes the responsibility of the people writing all the different handlers.

Remember, if Mozilla doesn't know about a handler, it will pass it to the underlying OS to decode. So that could be a mailto handler, an rstp (streaming video) handler etc. If a remote exploit came out that targetted RealPlayer or something (a common program to handle rtsp AFAIK) then it wouldn't be up to the Mozilla team to protect against a link to it, that's what the OS layer is for.

I want to be asked for what to use for the handler.

The choice is there - in the Windows registry - that's where the handler data is stored and what will happen when the handler is called. If you don't like the way something's handled, you can change it.

I don't trust anyone else. I trust Mozilla's developers, and I trust me. No one else, certainly not my OS vendor.

I don't think it's Mozilla's job to make up the failings of your OS vendor - if you don't trust them then your problem lies elsewhere.

Likewise I do not want 3rd party programs deciding on what to do with various protocols.

That seems to contradict what you were just saying about you wanting "someone I trust evaluating the general safety of a class of handlers" - you say that you trust the Mozilla team - but aren't they a 3rd party program?

The protocol handling is down the OS at the end of the day - if Mozilla can't handle the type itself then it's up to the OS to work out what to do with it. As others have pointed out, a shell handler isn't the brightest idea ever.

If you look at the patch source for Mozilla, all they're doing is flipping a preference that enables blacklisting of protocols then telling Mozilla to blacklist the shell one. Yes it works, but it isn't a system wide fix. A system wide fix would be to remove the shell handler (I doubt it's actually used) - this is just a quick fix for Mozilla, and not actually fixing the root of the problem (i.e. Windows).

I do agree with you about the whitelisting - maybe a good option to put in Windows (assuming the default set of handlers isn't dangerous (i.e. shell handler)) would be a confirmation dialog box to appear when a program tries to register a new handler.

I'm thinking of something like the box that appears when a site tries setting your homepage - it'd probably have to be off by default but it'd be a good option for those who really want to maintain the security of their systems. Also a control panel applet that defines the protocol handlers (like the file types one) so they can be edited.

But there's no chance of Microsoft ever implementing that :)

Re:It's not "in" the browser

[mr3038]

You can [run Windows with real restricted user accounts].

Yadda yadda yadda... of course you can create a restricted account and play some Minesweeper or Windows Calculator in it. But then run some third-party games or apps and see what breaks. There's just too much software that can't handle restricted access.

So, you're saying that instead of requesting those third party software developers/manufacturers to fix their broken products, you opt to run your box wide open (that is, everything under Administrator account). It's your choice and if you get burned, don't come back to manufacturers of software that does work under restricted access.

I'm running my W2K system with restricted access. For those third party apps that are broken and I cannot live without, I run those with Superior SU so that only those pieces of software are run with administrative access. Admittedly, not perfect, but much better than running web browser/word processor/whatever with administrative rights. Currently my list of programs that I use and that need administrator access are:

• DScaler (because it loads hardware drivers on the fly),
• Nero (newer versions probably could handle cd-rom burning from user space?),
• Palm Desktop (this piece of software is just broken but I haven't looked for anything else. I hope that it isn't broken enough to randomly delete files or run other programs).

Under linux, there's absolute no reason to always run root. You can usually configure even hardware access via different groups so that you only need to add your user account to group that has access to hardware device you absolutely need.

Re:It's not "in" the browser

[jak163]

This shell extension could do just as much harm when running under a root Linux account (and there are plenty of those out there!)

But it's not smart to browse the Internet as root. And if you're not browsing as root anything that requires root access will also require the root password. In XP on the other hand you have root access by default.

Re:It's not "in" the browser

[Alexis de Torquemada]

So, you're saying that instead of requesting those third party software developers/manufacturers to fix their broken products, you opt to run your box wide open (that is, everything under Administrator account).

No I don't. But that's the way most non-geeks do it.

I'm running my W2K system with restricted access. For those third party apps that are broken and I cannot live without, I run those with Superior SU so that only those pieces of software are run with administrative access. Admittedly, not perfect, but much better than running web browser/word processor/whatever with administrative rights. Currently my list of programs that I use and that need administrator access are:

That's fine, but the average user doesn't know how to do that, thus he/she just runs the machine as admin. After all, what's all the talk about Windows being easy to use worth if you have to set fine-grained application rights?

Under linux, there's absolute no reason to always run root. You can usually configure even hardware access via different groups so that you only need to add your user account to group that has access to hardware device you absolutely need.

Absolutely, and the best thing is that the defaults are ok for most non-geek users. It's also quite simple for distributors to make things more secure than they would typically be under Windows. E.g. if a user is a member of the "dialup" group, you can configure the system in a way that allows dialing of a set of exisiting ISP numbers, but doesn't allow dialing of arbitrary numbers (you need root privileges to add them). This would make it very hard for dialer programs even if they existed for Linux. It's not that these things were absolutely impossible to realize in Windows, but the status quo is a lot worse - unless you're an expert and know how to work around the limitations.

Re:It's not "in" the browser

[dekeji]

What about when you click on a 'mailto:' link? Do you want Mozilla to pop up and say it can't handle it? Or do you want it to use your default mail application to start up a compose message window?

It should verify that the supplied address strictly conforms to E-mail address standards and then invoke the user's default mail application.

In general, Mozilla can invoke protocol handlers whose function it knows after verifying that the arguments passed to those protocol handlers are safe for that protocol. It can do that for mailto: because it understands its semantics. It can't do that for shell: because it doesn't even recognize the protocol, let alone know what kinds of arguments would be safe to pass to that protocol handler.

Re:It's not "in" the browser

[Technonotice_Dom]

It should verify that the supplied address strictly conforms to E-mail address standards and then invoke the user's default mail application. By using the standard handler system provided by the underlying OS or desktop system?

In general, Mozilla can invoke protocol handlers whose function it knows after verifying that the arguments passed to those protocol handlers are safe for that protocol.

Sorry, in my opinion, this isn't up to Mozilla and its opinion. If a particular handler cannot be trusted with certain arguments then either the OS should not provide the handler and it should be disabled, or the application that the handler calls should check the supplied data.

It can't do that for shell: because it doesn't even recognize the protocol, let alone know what kinds of arguments would be safe to pass to that protocol handler.

Surely safe arguments are for the OS or the application that handles shell (presumably cmd.exe or something) to check? Maybe a flag should be used to indicate that the supplied data is potentially unsafe and it is still up to the default handling application to decide what to do with it.

Say you had an rtsp URL - surely it isn't the browser's job to understand the URL for starters and also have an opinion on its safety. The main reason behind my argument is that remember - any application on the system could call that handler, including Internet Explorer and other browsers/e-mail applications/messaging apps etc. Can you imagine the nightmare of each program trying to verify and check all the possible protocols people might want to link to?

What happens if a new application emerges that registers its own handler (e.g. AOL Messenger I believe uses 'aim:') - databases would have to be updated to allow the application to work, the maintainer of the databases would have to determine safe URLs and filter for anything other than that (and you'd have to get the specs for the app too, not easy with closed source) - and all maintainers would have varying positions on whether AIM is a safe application. It's a complete nightmare. It cannot be done on a per application basis.

The only effective solution IMHO, is a layer at the operating system level defining either how "safe" an application is or even better - for the application that registers the handler to judge for itself.

Speaking about OS layer stuff, it's obvious that such a system wouldn't/couldn't be implemented for few years, even if they wanted to. Maybe it's a new possibility for an application? One that intercepts all handlers (by overwriting the values in the registry) and presents a dialog box to the user asking whether they want to load the application, "always do this" (while the application remains the same) and maybe regularly updates itself with security information from an central database so if it's realised a handler has an exploit, the program can put up a big warning against it.

Of course the database would have to be trusted, open and very secure - and only the security concious people amongst us would actually use such a program.

Remember - most people on Windows use Internet Explorer. If Internet Explorer doesn't understand a URL, it passes it to the OS - that's where the security layer should be.

Re:It's not "in" the browser

[dekeji]

Sorry, in my opinion, this isn't up to Mozilla and its opinion. If a particular handler cannot be trusted with certain arguments then either the OS should not provide the handler and it should be disabled, or the application that the handler calls should check the supplied data.

There are two types of handlers: those without restrictions that deal with trusted input (stuff a user types) and those with restrictions that deal with untrusted input (stuff that comes in over the web). On a desktop, you need both because you have both kinds of input. Either the OS may provide them or applications.

The only effective solution IMHO, is a layer at the operating system level defining either how "safe" an application is or even better - for the application that registers the handler to judge for itself.

It's not a "level" of safety, you need two different APIs (or a flag). Applications that treat all input as untrusted are unsuitable for desktop use. However, applications that know what they are dealing with (and Mozilla does) can transform untrusted input into trusted input. In fact, they already do that all the time anyway.

Remember - most people on Windows use Internet Explorer. If Internet Explorer doesn't understand a URL, it passes it to the OS - that's where the security layer should be.

Well, why don't we put everything into the OS then? Mozilla can become an IE theme, with all the rendering and handling of all web standards implemented by the OS.

But Mozilla has written on its banner that it implements web standards, and it tries to implement them better than whatever Windows does. That means Mozilla need to know how to interpret HTML and how to interpret URLs/URIs that it encounters. As part of those operations, Mozilla is highly qualified to determine which URLs/URIs are "safe".

Furthermore, no matter where this security layer "should be", the fact is that it isn't in Windows and that the Mozilla developers knew that. Therefore, they should have addressed this problem with a Mozilla-based workaround until Windows implemented what they thought was "the right way". Leaving users with gaping security holes is never the right thing to do, no matter what disagreements there may be between OS designers and application designers.

Re:It's not "in" the browser

[Bert64]

Which is precisely why i have crontabs setup to backup my homedir to a root-owned directory every so often...
A system which automated this in realtime, but delayed deletes/writes on the backup would be nice.. if you deleted something you would have say 24 hours to recover it from the backup.

hows is this different than file:///

[adamshelley]

in ie if i type

file:///c:/windows/system32/mspaint.exe

I can load the program, in firefox it prompts me to download it and disables the open option.

does this mean IE has always been vulerable to this type of bug?

Re:hows is this different than file:///

[rjstanford]

Not really - there's a difference between typing it into the "Address" bar and clicking on it in some website. Or clicking a link within your intranet for that matter. IE has different security zones with different models for just this reason. In fact, checking it on a website shows that clicking on such a link as you provided does absolutely nothing, whereas keying it into the address bar launches the app. Your security settings may vary, of course.

Re:hows is this different than file:///

[adamshelley]

ahh. thanks.

Re:hows is this different than file:///

[Transcendent]

No, it's just that IE recognises the security level as being local, hence you can open the file directly.

Strange coincidence?

[hunterx11]

Isn't this a bit like the bug that Safari (and OS X URI handling in general) had earlier?

hold the phone, chester!

[Anonymous Coward]

"Note that this only affects users of Mozilla and Firefox on Windows XP or Windows 2000."

That sounds like a windows bug to me...not a mozilla bug :) Just my 2c

Re:hold the phone, chester!

[Anonymous Coward]

Well, kinda. It's a bug in Windows, but honestly, Mozilla should never be passing things to Windows. It's like hiring a bunch of retired Secret Service agents to guard your house, and then telling them to just give your sensitive information to the guy in the van.

A question for other firefox users

[Anonymous Coward]

anybody else having problems with the location/recently visited dropdown menu?

About 25% of the time when I click on the down arrow, the dropdown "recently visited" list briefly appears and then goes away. Click on the down arrow again: the list displays and remains there so you can choose the desired link.

Any solution for this? It's driving me nuts, and I can't find a bugzilla entry for it.

Firefox and Windows 98

[cool_st_elizabeth]

so glad I didn't "update" to Win XP.

Re:Firefox and Windows 98

[Anonymous Coward]

Except that you run an OS that bluescreens with fair regularity, has been known to break its own system files, and is all around just generally unstable and sucks.

Re:Firefox and Windows 98

[cool_st_elizabeth]

With comments like that, I can see why you are called an Anonymous Coward.

Note to self...

[node 3]

Remind sales force to re-emphasize our commitment to security. Suggest that if they are asked about Firefox to take on the blank stare which indicates you would laugh at the customer's foolishness if you weren't so extraordinarily polite.

If that doesn't work, teach the sales force the monkey-dance.

Also, float new IE motto: I... LOVE... THIS... BROWSER... YEAH!

-Steve Ballmer

secunator

[trekiloslem]

new security company, fraud and ict sec.., I need help! wanna be my accomplice? Only open for the ict section, need folks who know nip, tcp/IP, ipSec, des/PGP, fourthfloor, nsk, an most urgent html security and programming.. check this out.. Helt seriost trenger jeg folk som snakker norsk ihvertfall, som kan deler av overnevnte, og/eller som har annen sikkerhets relatert bakgrunn innen hacker/cracker miljo.. dette er viktig for aa faa edge paa de andre etablerte firmaene som finnes allerede.. Give me a pip in tnys@start.no Og folkens, vaer seriose da.. trenger ikke crapmail!!!!!!

Firefox causes a change of heart?

[Anonymous Coward]

Still, I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites.

Woah, so malicious persons using Firefox suddenly grow a heart and decide not to harm the little folks in Mozillaville? I guess the spirit of open source has a similar effect as the spirit of Christmas in "The Grinch Who Stole Christmas". The little script kiddie who learned the true meaning of software development... <sniff, sniff> Neato!

<Reads again> Oh, I think you meant to say that compared to Internet Explorer it's not as tempting a target. Oh well. ;-(

Re:Next!

[Carnildo]

Well, for all those who are browser-shopping, FireFox gets marked off the list of contenders. Who's next?

NCSA Mosaic?

Shell: Why?

[MisanthropicProgram]

At first I thought it (Shell:) was for running plug-ins, but then the fix would disable plug-ins - so that's not it or is it?

Re:Shell: Why?

[TrancePhreak]

From what I read elsewhere, Mozilla/Firefox passed any unknown commands to the OS. Shell: being the command to run something, it would have run whatever followed that command.

Re:Shell: Why?

[Anonymous Coward]

Wrong choice of words. It should be:

Mozilla/Firefox passed any unknown URLs to the OS. Shell: being the URL to run something, it would have run whatever followed that URL.

Notice how "URL to run something" doesn't make sense. Because an URL is not supposed to be something that runs a command.

Fooling yourself

[Anonymous Coward]

Still, I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites.

Depending on obscurity? Shame on you.

No, it doesn't.

[SHEENmaster]

There are no known exploitations of this in the wild, so it in no way shows that attackers are going for the common denominator of Mozilla installations.

Also note that this is a problem with Windows URI Handler rather than Mozilla. Mozilla passes any protocol it doesn't understand to Windows, and Windows uses it to execute a local file. That's why this problem doesn't exist in anything but Windows.

This just goes to show that Microsoft makes insecure software, and that insecurity often bleeds into otherwise trustworthy programs.

Re:No, it doesn't.

[Anonymous Coward]

Recently there were URI handler issues discovered with MacOS X. And what about KDE/Gnome? Maybe Mozilla just has no support for this stuff under unix.

Re:No, it doesn't.

[rjstanford]

Also note that this is a problem with Windows URI Handler rather than Mozilla. Mozilla passes any protocol it doesn't understand to Windows, and Windows uses it to execute a local file. That's why this problem doesn't exist in anything but Windows.

By that argument if someone asked Mozilla to delete some files, but rather than deleting them through unlink() it passed it off to the shell to do through rm, that would be Linux's fault? C'mon. At best, its passing unvalidated input to a secure user context (which Mozilla needs to allow its users to do things like save files, delete cache entries, etc).

This just goes to show that Microsoft makes insecure software, and that insecurity often bleeds into otherwise trustworthy programs

Hey, I like Firefox as much as the next guy (especially its DOM explorer), but there's no need to join the FUD camp to bash its rivals.

Re:No, it doesn't.

[nizo]

Are versions of windows(95/98/NT/ME) aside from 2000/XP affected? If not, it would seem to me that Microsoft introduced a bug into the OS from 2000 on?

Re:No, it doesn't.

[Anonymous Coward]

Are versions of windows(95/98/NT/ME) aside from 2000/XP affected? If not, it would seem to me that Microsoft introduced a bug into the OS from 2000 on?

Not sure about previous versions of Windows, but XP Service Pack 2 release candidate fixes this problem.

Re:No, it doesn't.

[Anonymous Coward]

I love how security is something that everyone bashes MS for, when to be honest is something "new". Not to mention that the other OSes have equally disturbing bugs. The issue isn't Microsoft, MAC OS, or Linux for that matter... the issue is popularity. If you're popular, you're bound to be targeted. It's very unfair to say that Microsoft and it's cronies are terrible. I've recently uninstalled FireFox due to a VERY nasty memory leak that after only 5 MINs OF USE, the browser was taking up 220 MB, even on initial install it takes up to twice as much memory as IE. (both have about:blank as home page).

I also like the group think that because it's not mainstream, it's better and more secure. That just shows you the narrow minded thinking that happens in these groups with little critical thinking of the important matters. But, as always, I guess the populous is all for security over effciency. It's kinda like that with America in general...

Re:No, it doesn't.

[DarkMan]

. At best, its passing unvalidated input to a secure user context ...

Thing is, this is the default action for URI schemes that the browser is unaware off.

If you don't know what the scheme is, how can you validate the parameters passed to is, given that, by definition, you don't know anything about it? The difference with the 'delete some files' example is that in that case the browser is aware of what is being desired to occur.

Microsoft handles this problem in IE by a specific block on shell: and I think that's the solution used by Mozilla now.

Re:No, it doesn't.

[FryGuy1013]

You would hope that you can click on aim: links in the browser, yet I wouldn't want the browser to know what exactly aim: is doing. You are comparing apples to oranges. Saying you tricked the browser to run unlink(foo) rather than exec("rm foo") is different than trusting an arbitrary protocol that is already set up in windows.

Re:No, it doesn't.

[dolphinling]

Mabye *n*x just doesn't have insecure protocol handlers? (Don't ask me...)

Re:No, it doesn't.

[dolphinling]

IIRC, no. shell: didn't exist back then.

what mozilla users should know

[Anonymous Coward]

about the shell: protocol security issue

Re:Congratulations

[Anonymous Coward]

not that truth matters to moore fans

you smug asshole. truth matters equally to left-wing ideologues (moore) and right-wing ideologues (you).

How is this ...

[Anonymous Coward]

timely when the bug was opened in 2002 (checks calendar); seems pretty old.

Firefox/IE?

[Wofser]

" Still, I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites." So you not using Firefox becouse it is safer than IE, just less likely to be exploited. What if Firefox had 30% of the browsermarket?

Re:Firefox/IE?

[Anonymous Coward]

if firefox gets 30% of the market then it gets lots more people looking and fixing bugs. So it actually becomes more secure as more people use it.

arielb

Re:Congratulations

[Jane_Dozey]

Please point out the hypocrasy.
I don't hear the OSS community pretending their software has no bugs or holes.

/dev/tty

[Anonymous Coward]

Mozilla have been fairly lax about security problems if they think they are obscure or something. Search bugzilla for the file: protocol and you can find a few. Mozilla allows (since ever and at least up to version 1.7) http-sourced documents to open file: URLs, including /dev/tty. For some reason they think this is not worth fixing.

Re:/dev/tty

[Anonymous Coward]

Here's a couple for ya:

http://bugzilla.mozilla.org/show_bug.cgi?id=2907 9
http://bugzilla.mozilla.org/show_bug.cgi?id=916 57

Wasted time

[Number_1_Bigg$]

That took most of 90 seconds to fix, and no restart. Firefox is great.

Update to 0.9.2 and....

[Silvers]

What do you know? A new update is already available.

Can't they *fix that* already? It's been in .9.0, .9.1 and .9.2!

Re:Update to 0.9.2 and....

[rayde]

yeah seriously that is pretty annoying.

Re:Update to 0.9.2 and....

[Blaskowicz]

.9.2 includes the fix for the flaw, I believe it is even the only difference with .9.1

In all fairness...

[DanielJosphXhan]

And I don't think anyone is pointing to IE and saying "look at this one flaw".

The point is that IE operates much the same way a sewer grate does. There's a whole lot of holes. And it takes a long time to get them fixed.

If it were a comparison to Firefox, we have one exploitable hole, compared to how many for IE?

Re:In all fairness...

[Lehk228]

IE operates much the same way a sewer grate does

full of holes that let shit get through?

Monoculture, my ass.

[CaptainSuperBoy]

OK, that's it you guys. No more talk of how IE is so insecure because of Microsoft's 'monoculture.' Security issues, it seems, are a way of life in software. There are plenty of other arguments against Microsoft so there's no reason to use this one any more.

Personally I'm still going to use FireFox. It's a better browser than IE and I'm happy that they patched it in a single day. It's a little worrisome that this issue sat around on Bugzilla, hopefully this will motivate the Mozilla team to figure out some procedures to keep security bugs from slipping through the cracks.

Re:Monoculture, my ass.

[Abcd1234]

Who said that? Monoculture cannot possibly be the reason *why* IE is so riddled with holes... that doesn't make sense. Code quality has nothing to do with popularity, and I've never seen anyone suggest that.

However, the IE monoculture is one of the reasons why 1) so many live exploits exist for IE (people target it because it's popular) and 2) why an exploit in IE is so damned devastating to the Internet community.

So, please, take your straw man and go home.

Re:Monoculture, my ass.

[Anonymous Coward]

Please read before posting. The security hole is in Windows. Firefox has to cover Microsoft's ass. kthx

Re:Monoculture, my ass.

[Anonymous Coward]

Please read before posting. The security hole is in Windows. Firefox has to cover Microsoft's ass and Micrsoft's own holes. kthx

Re:Monoculture, my ass.

[Anonymous Coward]

Please preview before posting the same comment twice. kthx

Re:Monoculture, my ass.

[jhoger]

The point of the "monoculture" idea in relation to browsers is that internet security is best served by having many different browsers, rather than just one since then they won't all have the same vulnerabilities.

The theory is that heterogeneity builds resistance into the system.

As far as I can tell, this incident doesn't challenge that idea...

So what was your point?

Re:Monoculture, my ass.

[Anonymous Coward]

No more talk of how IE is so insecure because of Microsoft's 'monoculture.'

You never heard that from me! IE is so insecure because:
1. most decisions about what features to put in it were based on market dominance, NOT technical merit
2. Microsoft just has had NO interest in looking for security issues until recently
3. Windows is such a tangled mess of interwoven spaghetti code that NO ONE can predict the consequences of any combination of events
4. Microsoft puts absolutely no emphasis on code quality

The fact that they are a monoculture just guarantees a disaster for each and every one of the endless stream of security holes that flows forth from Windows, IE, IIS, etc, etc.

So climb back in your hole, troll!

Re:Monoculture, my ass.

[CaptainSuperBoy]

The eWeek article says "Mozilla flaw," not "Windows flaw." It also says this:

Current versions of Mozilla and Firefox pass unknown protocol handlers to the operating system shell to handle.

I don't mind the occasional security hole, it's unavoidable. But don't pin this one on Windows. No browser should be passing unchecked commands from a web page to the shell.

Re:Monoculture, my ass.

[Anonymous Coward]

Month after month we get new vulnerabilities in Internet Explorer, and a single vulnerability arises in Mozilla, and suddenly we aren't allowed to criticise Microsoft? Come off it. The Mozilla project is beating the largest software company in the world by something like 100-1.

Re:Monoculture, my ass.

[Anonymous Coward]

No browser should be passing unchecked commands from a web page to the shell.

No OS should be executing unchecked protocol handlers. There's no problem on Mac and Linux, so, sorry, Windows bug.

Re:Monoculture, my ass.

[Anonymous Coward]

In this case, the browser is passing a URL to Microsoft's OS standard URL handler API, not the shell directly. For some benighted reason, Microsoft thought a "shell:" URL scheme was a great idea, and then left the security up to the application, not the OS, and then didn't tell anyone.

Re:Monoculture, my ass.

[KarmaMB84]

The Mozilla developers knew about the possible ramifications of passing anything a webpage wanted to to the URI handler back in late 2002. They basically refused to fix it until an exploit appeared. Sounds a lot like MS, doesn't it?

Re:Monoculture, my ass.

[Grrr]

You may be filtering out AC posts, but for once here's a gem responding just to you.

And, I'll add, you said
The eWeek article says "Mozilla flaw," not "Windows flaw."

This is your attempt at humor, right?
Do you work for eWeek - or just let their headline writers do your thinking for you?

Sheesh.

<grrr>

Re:Monoculture, my ass.

[CaptainSuperBoy]

So what is the OS supposed to do if Mozilla says "go run this program?" Magically detect that it's a security risk?

Re:Monoculture, my ass.

[Anonymous Coward]

RTFA - it's a windows bug vulnerability that Moz passes to the OS, because that's what it does with unrecognized protocols.

Re:Monoculture, my ass.

[Anonymous Coward]

No, they knew that a rogue program could register a handler do to bad things. But that rogue program would be the exploit in itself, and not have anything to do with Mozilla. Mozilla would just be the victim.

The problem is that (what noone apparently knew) that the rogue program was Windows itself.

Re:Monoculture, my ass.

[Mant]

You did notice that Windows 2000 and XP are only OS effected by the exploit? Mozilla doesn't say "go run this program" it says "I have a something I don't know about, what does the OS have registered to do with it?"

Windows itsn't supposed to run a shell: request like this, MS was supposed to have fixed the bug in XP SP1 so that it wouldn't do this. You don't need to "magically" tell shell: is a security risk, it very obviously is. The Newsforge article has more details.

That was nice.

[SteveXE]

Its always nice when a patch installs in 3 seconds with no issue and no demand for a reboot. Today was the day i switched to Mozilla, ive been using it for about 2 years now off and on but i just cant take IE and its security chasms.

Re:2K or **NOT** 2K

[Anonymous Coward]

Windows 2000 is **NOT** vulnerable. A few folks on a security mailing list and I have been testing it. The code can be executed within IE 6 and Firefox as it is a command that gets passed to the OS. You can execute the commands from the Start button as well.

Article text, in case shell: gets Slashdotted

[ydnar]

Shell Directory

Visit our country and business websites around the world.

Shell for Motorists

More than 20 million customers a day visit Shell service stations for fuels, motor oils, carcare products and more.

Shell for Businesses

Shell offers oils, fuels, financial services, dynamic business solutions and more to businesses of all sizes.

Shell for the Home

Shell offers a range of products and services for the home - from natural gas and electricity to fuels and lubricants.

About Shell

An overview of the Group

Investor Centre

Results, share prices and more

Media Centre

Latest news from Shell

Jobs & Careers
Discover exciting career opportunities with Shell

Share Prices
Prices delayed by 20 mins
RD - Amsterdam 42.15
STT - London 398.50 p
RD - New York $52.20
STT ADR - New York $44.74
Visit the Investor Centre

Latest news
Qatar Petroleum and Shell sign Development and Production Sharing Agreement for Pearl GTL Project

Qatar Petroleum and Shell sign Development and Production Sharing Agreement for Pearl GTL Project

08/07/2004 - Qatar Petroleum (QP) and Qatar Shell GTL Limited (Shell), a company of the Royal Dutch/Shell Group, today signed an integrated Development and Production Sharing Agreement (DPSA) that provides for the fiscal and legal terms for the Pearl GTL project.
Saudi Aramco signs agreement to acquire strategic shareholding in Showa Shell

Saudi Aramco signs agreement to acquire strategic shareholding in Showa Shell

05/07/2004 - Aramco Overseas Company B.V., a subsidiary of Saudi Arabian Oil Company ("Saudi Aramco", the national oil company of Saudi Arabia), today signed an agreement to acquire a strategic shareholding in Showa Shell Sekiyu K.K. ("Showa Shell").
06/07/2004 - Toyota and Shell launch trial of D-CAT and Gas to Liquids Technology to reduce car emissions
02/07/2004 - Jobs and Careers go global with the Shell Career Newsletter
01/07/2004 - Shell announces portfolio actions and writedowns
More news

Features

Proved reserves restatement
Latest information

The Shell Report

Our progress in contributing to sustainable development

Annual Reports

Royal Dutch/Shell Group of Companies Annual Reports

Tell Shell
Email comments or join our open forum

US residents

Apply for a Shell Credit Card or pay your bill online

Terms and Conditions | Privacy Policy

Use of, and copying from, this site is subject to our terms and conditions. Please read our privacy policy.

Re:Sorry, links to Bugzilla from Slashdot are disa

[Charlie Bill]

That's why you need Mozilla with that handy "Launch This Page in IE" plugin. Referrer=null.

How can you people DEFEND this?

[Anonymous Coward]

Why is it OK for Mozilla to screw up, but not OK for Microsoft?

This particular type of exploit hit Safari, too.

Konqui

[bogaboga]

Yes, that's why I will continue using Konqueror on Linux [for now]. BTW since Konqueror is written using QT which can be used to deploy cross-platform apps, why don't we have Konqueror for Windows?

Re:Konqui

[cranos]

Because for Windows development TrollTech demand a hefty licensing fee. Linux dev is GPL but Windows dev is closed.

Re:Konqui

[Maljin Jolt]

And how do you read your slashdot user page? It does not render properly (or sometimes at all) on Konqueror. As well as many other webs, because style engine is broken.

BTW, my Mozilla 1.7/linux on "shell:/bin/ls" says

Alert! shell is not a registered protocol

So, I see no problems with mozilla on linux.

Note, your Konqueror probably has some other obscure protocols, such as system:, settings: or programs: which may render your machine vulnerable by means you can't even imagine. You really should check if they are on just now.

Re:Konqui

[Anonymous Coward]

Konqueror exists for Windows. Check out KDE on Cygwin at Sourceforge. Last time i checked it was a slightly older, incomplete version and it ran slow. Currently i don't use Windows anymore so i really don't know what's going on.

Re:Konqui

[mlk]

QT is very expenive for Windows uses.

Or you can use KDE-Cygwin (I have before), which is slow.

Re:Konqui

[julesh]

And how do you read your slashdot user page? It does not render properly (or sometimes at all) on Konqueror.

Strange. I have the same problem in Mozilla. I think Slashdot's broken, not the browser, though.

Firefox pass unknown protocol handlers to the O/S

[shailu]

In the definition of a URI (Uniform Resource Identifier), the technical name for a Web address, "shell:" is not a protocol like http but a scheme. Some schemes map directly to protocol handlers in the browser itself or externally, such as those that handle audio and video media. Current versions of Mozilla and Firefox pass unknown protocol handlers to the operating system shell to handle. In this case, the location passed to the shell is a program name that the shell executes. Is it still security hole in Mozilla????

EDITORS!

[fermion]

Why do we still get daily stories about how bad MS Windows programs are. It is just flamebait. Anyone on /. who still uses MS Windows knows that they need to check bug reports hourly and download updates daily. By the time it gets posted to /. it is too late to help. Half the internet has already been devastated.

I say no more! We gain nothing by making fun of those poor souls that must use MS Windows. We should have sympathy for these misguided children and not publicly air their misfortunes.

Stop the Madness! We, like Fox News, must limit ourselves to positive MS stories. But we can do even more. We can actively search for negative *nix stories in hope that our misfortune will make those hapless lusers feel better.

Update system

[supercytro]

Whilst it's easy to take pot-shots at Microsoft when it comes to IE, their update system isn't too bad. Firefox needs a easy to use mechanism for automatically retreiving and installing critical update, in a manner similar to MS windows update service.

Even better, take a leaf out of Norton's liveupdate program.

Re:Update system

[kisielk]

Yeah, great idea. Then it can automatically download exploits instead of going through the trouble of tricking the user in to visiting an exploit site :)

Re:Update system

[naelurec]

hmm... aptget? up2date? portupgrade? perhaps instead of every single program having its own update mechanism, it should be one update mechanism for the entire machine? Seems to make more sense to me. I hate having to run a live update for antivirus, antispyware, windows, yada yada yada..

Re:Update system

[Anonymous Coward]

That deals with Linux, but what about Windows? (presumably Windows Update won't carry patches for this!). Firefox will need a cross-platform way of doing this.

Re:Update system

[galaga79]

There is an auto-update for Firefox, take a look at Options > Advanced > Software Updates.

By default it will periodically check for updates for the main program and extensions. You can even set it up to automatically download and install these updates.

Re:Update system

[tunah]

Agreed. It's just the sheer frequency of updates that annoys me (not that I don't want them, but there shouldn't be so damn many).

There is autoupdate functionality, it's not fully enabled and having a few issues as yet, so I'm not sure if they're using that to announce this patch. Post ff 1.0, it should work as well as IE's system.

Re:Update system

[Anonymous Coward]

Considering how often Mozilla/Firefox will nuke your browser stetings and bookmarks, I don't think that's a good idea. Whenever someone brings this up, people chime in that "it's beta software, you shouldn't expect it to be perfect". If they're going to implement anything in the way of auto updates, then the damn installer AND the browser must be solid an very tolerant of importing.

Re:Update system

[batkiwi]

Auto-update doesn't pick this one up on my XP box, though, making it useless since there's a security update out there!

Re:Update system

[Chester K]

There is an auto-update for Firefox, take a look at Options > Advanced > Software Updates.

And it's constantly telling me to upgrade Firefox 0.9.2 to Firefox 0.9 :(

Re:Update system

[Arngautr]

emerge -uD world does this count (ussually only works for gentoo linux though)

Shellblock XPI...

[antdude]

I just installed Shellblock XPI for Mozilla v1.7 from http://update.mozilla.org/extensions/moreinfo.php? id=154. How can I check it is installed?

Re:Shellblock XPI...

[pixas]

try the link on this page: http://www.malware.com/stockpump.html

Re:Shellblock XPI...

[Wanderer2]

How can I check it is installed?

Try this page: test page

After I installed the patch (without restarting Mozilla), all four example links were available to click on. Clicking on the fourth link, marked "Clicking this could crash your system!!!" did cause Mozilla to go crazy. It kept opening new windows stupidly fast until it crashed.

After it died, I restarted it and went back to the page - now three of the links are completely disabled (I can't even highlight them), and the link that does work (the one with the example iframe exploit) has no malicious effect - the iframe no longer shows the Windows tip but is empty instead.

So my version of Moz clearly wasn't fixed until it had been restarted.

Re:Shellblock XPI...

[RoTNCoRE]

That'll teach me to be a lazy /.er... I didn't read the thing about having to restart, and clicked the last link...good thing I have a fast index finger on the mouse, and could "Close group" and then end processes through CTRL-ALT-DELETE. But not before firefox took 100mb ram.

Incorrect bug link

[jesser]

Eweek and Slashdot linked to bug 167475, implying that Mozilla developers knew about this hole in 2002. Fixing bug 167475 would have done approximately nothing to protect Mozilla users against the shell: hole in Windows, and that is why bug 167475 hasn't been fixed.

The correct bug number for this hole is bug 250180.

Re:Incorrect bug link

[Platinum Dragon]

And if you read that bug #, it reveals that:

1) The problem is due to the shell: function, which passes the arguments to Windows XP for handling. The function was disabled in IE6 for the same reason it's being disabled in Moz/Fox now. In short, it's a hole in the Moz codebase caused by an insecure Windows capability. Thank you, well-paid Microsoft programmers.

2) The bug was opened on July 7. Today is July 8. One day.

Nice.

Intentional

[kyjello]

This is added intentionally so that Mozilla contains all of the features of Internet Explorer.

Oh yes, that's right! I went there.

Re:Intentional

[peachpuff]

"This is added intentionally so that Mozilla contains all of the features of Internet Explorer."

From what I've heard, that may actually be true. Supposedly, they were handing off 'unknowns' to the same OS-level URI handler that IE uses. The only reason I can think of for that is to make exotic designed-for-IE/Windows links work.

Most IE users probably consider running arbitrary code to be a feature. Seriously.

almost like ...

[zoloto]

Wow, if trends like this keep happening pretty soon us Linux users will have the full feature set of Internet Explorer!

oh yeah! /sarcasm_off

Re:almost like ...

[Anonymous Coward]

But only as long as we run Windows.

This bug (like the last security hole in Mozilla) affects only Windows.

Demonstration?

[TCM]

Where can I find a demonstration or a Howto-Repeat?

Oh boy

[alexburke]

Mozilla/Firefox Bug Allows Arbitrary Program Execution

Gates team, light your flamethrowers!

Re:Firefox pass unknown protocol handlers to the O

[rjstanford]

Is it still security hole in Mozilla????

Yup. Because Mozilla, as a local application, has a much higher set of privs than a remote website does. This is basically taking code (high-level instructions, but code) from a known insecure zone and telling the OS to run it without any built-in safeguards. And what do you know: we have an exploit.

Here's a fun example of how IE gets it right. Take the URI file:///c:/windows/system32/mspaint.exe from another example on this discussion. Type that into start/run on a Windows box - it works. Type it into the Address bar of IE - it works. Toss it into a webpage on the local machine and click on it - it works. Toss that webpage onto a remote server and click on it - it doesn't work any more. Different behaviors for different levels of trust. Mozilla defeats this by passing things to the shell with the same level of trust as the user has given it, the local program, which includes the (necessary) ability to mess with the filesystem.

You mean 22 months and 90 secs

[Anonymous Coward]

Well, 22 months and 90 seconds actually, if you count from when the bug was found in September 2002.

Please ...

[altp]

Please, just take the networking stack out of Windows.

Apparently no network application can be secure on it.

"updates available" bug fix

[joshds]

A lot of people have the problem where, even after they've updated to firefox 0.9.1 (or now 0.9.2) the automatic update still says that there is a new update available (annoying).

Here's the fix:

Enter about:config in the location bar.
Enter update.app in the filter field. (Click on Enter)
Reset any prefs that appear in bold.
Restart Firefox.


taken from FireFox support newsgroup. [http://www.mozilla.org/support/]

Re:"updates available" bug fix

[klui]

This doesn't work. I had to manually remove the entries from prefs.js before the new update popup dialog would stop showing up.

Re:"updates available" bug fix

[joshds]

worked for me and a dozen or so others -- who all had upgraded from 0.9 -> 0.9.1 -> 0.9.2

Microsoft knew

[Anonymous Coward]

Microsoft must have known about this hole, since Internet Explorer disallows the shell: protocol. When they found out about this hole, they had three choices:

1. Remove the shell: protocol, making all browsers secure.
2. Change Internet Explorer to disallow using the shell: protocol, leaving all other browsers vulnerable.
3. Change Internet Explorer to disallow using the shell: protocol and alert other browser makers to do the same.

They went with the second choice.

Re:Microsoft knew

[Anonymous Coward]

The point that the parent is trying to make is that MS could have changed their URI handler so that this would not be a problem for any app not just IE. Apparently they have done this since the WinXP SP2 beta disables this "functionality" and the issue does not exist. Can anybody verify this?

I think there is enough blame to go around on this one. The way the MS URI handler works is dumb in the situation and the Mozilla developers should have seen the potential problems with this. Apparently they did not realize that it could be exploited to run arbitrary code without user intervention and this is why no change was made. I guess there really is no fix for this either since all their "patch" does is turn off the shell functionality completely.

Taken out of context...

[Phil John]

...they didn't realise at that point that this could be launched without user interaction, that is what was posted to full disclosure - when that was written it was believed that a user had to be fooled into clicking on that link - a whole different ballgame.

True, I think this was something that should have been looked at earlier, but the same day the no-user interaction vuln was posted, there was a fix.

Is there a (proper) fix yet for the download.ject problem? No, even with the temporary "sticking plaster" that microsoft launched onto windows update this week there are still ways to exploit the problem. It will be months until a proper patch that fixes that will be released, if it is ever released at all.

Lets keep things in perspective and in context please.

Re:Taken out of context...

[rjstanford]

...they didn't realise at that point that this could be launched without user interaction, that is what was posted to full disclosure - when that was written it was believed that a user had to be fooled into clicking on that link - a whole different ballgame.

Be fair. A slightly different ballgame. You're still executing arbitrary code from an insecure site in a secure context without a sandbox.

Re:Taken out of context...

[TheLink]

"they didn't realise at that point that this could be launched without user interaction, that "

Right, which is why I should trust software written by such developers?

They're just as crap as the IE developers, so why should people bother migrating from the defacto standard. And since I do know how to secure IE, most of the IE security bugs won't even affect me.

For many years Netscape was neck to neck with IE in the race to be the buggiest most insecure browser. It looks like the same developers are coding Mozilla and they have learned very little. In fact when they started with Mozilla they bloated it out - bloat was part of the plan. As proof there were plenty of people release stripped down browsers using the mozilla rendering engine.

I gave up on mozilla because it was bloated, and despite all that bloat it still wasn't really that functional - they must have been too busy making it infinitely skinnable or something else more "important".

Moderation

[CaptainSuperBoy]

Anyone else notice the horrendous moderation on this article? It seems the OSS zealots are out in force tonight, eager to hide any comments that potentially threaten their arguments. I posted a similar comment to this one and it was called flamebait. Why? I guess these comments are too dangerous to the groupthink here on Slashdot.

Re:Moderation

[Anonymous Coward]

Exactly right. I find it quite amusing what scared little slash-sheep will do to any post which goes against the approved mindset.

Re:Moderation

[Anonymous Coward]

Personally,

I think that before you can obtain moderator points you should be forced to meta-moderate some posts.

But, thinking about it, that might not help either if the same set of clowns who unfairly moderate meta-moderate.

Re:Moderation

[Anonymous Coward]

Anyone else notice how all the Microserfs are in complete denial tonight?

An OS bug has existed for two years without a single patch from Microsoft, and they're jumping over themselves to lay all the blame on Mozilla. Despite the same problem affecting other applications.

Because it's an OS bug.

Get it? Bug is reported to Microsoft. Microsoft says they're going to fix it. Then proceeds to put their collective thumb up their ass for close to 2 years, if not longer.

Just because Mozilla first reported the bug in 2002 doesn't mean someone didn't report it to MS years earlier. After all, unlike Mozilla, Microsoft's bug tracking database isn't public.

Mozilla is a cross platform application. Unlike every other platform it runs on, the OS manufacturer intentionally left this vulnerability open for years. Crap, if they run around fixing all of Microsoft's bugs, when will they find time to develop Mozilla further? They need to spend their time improving the browser, not patching the myriad of poorly designed parts of Windows.

Re:Moderation

[CaptainSuperBoy]

Sorry, I trust eWeek over random anonymous OSS zealot guy.

Re:Moderation

[Anonymous Coward]

Well then why don't you read the article. Eweek confirms what the parent states. In fact this OS hole is fixed in WinXP SP2 they say so at the end of the article.

Having said that the mozilla/firefox developers must take part of the blame too. Why would they leave this type of functionality enabled when it has basically no value and is an obvious potential security problem? Especially when there "fix" is to completely disable the shell functionality. Why didn't they just do that 2 years ago when it was suggested that this might be a security problem?

Re:Moderation

[Anonymous Coward]

...an obvious potential security problem?

Obvious? I never thought of it. I must be getting stupider :-(

But then, no one else thought of it either, that makes me feel better. :-)

</sarcasm>

What moron put in "shell:"?

[Animats]

That feature just screams "security hole".

Hello? Browsers must not execute arbitrary programs on client machines. Is there anybody who doesn't get this yet?

And why aren't we running browsers in jails yet, anyway?

Re:What moron put in "shell:"?

[CTho9305]

RTFBug. Since MS decided programs should be able to register protocol handlers (e.g. irc://, telnet://), Mozilla behaves like a good little windows program, and passes any unknown protocols (shell://, vbscript://) to the OS. It's a flaw in the whole setup that windows uses here, and MS changed the behavior for XP SP2.

Re:What moron put in "shell:"?

[Maljin Jolt]

And why aren't we running browsers in jails yet, anyway?

Last time I asked THAT on slashdot, I got modded flamebait troll insightful. It's funny to see you got the same.

So, what exactly prevents you from running browser under very very limited user?

Re:What moron put in "shell:"?

[twitter]

And why aren't we running browsers in jails yet, anyway?

Is such a thing possible on a single user mode OS like Windoze?

Nice of you to blame Mozilla, but that does not hold much water when you consider that the same browser does not have the same hole on other OS.

Re:What moron put in "shell:"?

[IntlHarvester]

And how is this handled under Gnome etc? Does one need to manually set up protocol handlers like "ssh://" for every application?

Re:What moron put in "shell:"?

[TrancePhreak]

Windoze might not have multiple users, but Windows XP sure does. Heck, even Windows 98 did. That being said, I've never actually seen a Windoze system deployed.

Re:What moron put in "shell:"?

[evilviper]

why aren't we running browsers in jails yet, anyway?

Because most of us like to be able to save files... And I don't mean inside a single directory, where we have to move them out of later.

OTOH, I'm running Firefox under Systrace (not helpful for Windows users, but I digress), which basically allows me to use ACLs to decide what a program can do. Sure, let's allow it to do all the syscalls it needs to start-up, but it needs to ask my permission before it can read any files outside of it's own directory, and it can't, under any circumstances, do XYZ, blah, blah blah.

Re:What moron put in "shell:"?

[cduffy]

I can't speak for GNOME, but KDE has a central registry of URL handlers. The downside to implementing it at this layer, of course, is that it isn't usable (or, at least, used in practice) by non-KDE apps.

(Incidentally, I use neither GNOME nor KDE -- I find that ion, while less than newbie-friendly, lets me work most efficiently).

um, it's /funny/ not offtopic

[Anonymous Coward]

nt

Biased. IE is vulnerable, so is Firefox

[fastdecade]

Yes it's very biased, he's probably just a bit naieve if he believes that one true statement is enough to win an argument. I'll tell you why.

"Still, I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites."

Yep, maybe that's a bit true (debatable though). But it's only one of dozens of reasons why Firefox is safer than IE, and there are also dozens of reasons why IE is safer than Firefox. To wit:

• "I feel safer using IE since very intelligent, highly paid, people work all day on its security features"
  
• "I feel safer using Firefox since any developer can fix the problem and publish a patch immediately"
  
• "I feel safer using IE because its designed for a single platform"
  
• "I feel safer using Firefox since its open source review process hardens code before it is published".
  
• "I feel safer using IE because its harder for malicious people to discover flaws in closed-source software
  

My point? His statement is biased because he's pointed out only one average argument in favour of Firefox, whereas there are many arguments that can be made in either direction.

Re:Biased. IE is vulnerable, so is Firefox

[bad_fx]

My point? His statement is biased because he's pointed out only one average argument in favour of Firefox, whereas there are many arguments that can be made in either direction.

Interesting point... So, by your reasoning, anything a person says or writes is biased, unless they point out all and every single arguement for and against whatever it is?

By the way, I'm curious as to how the way a person feels be biased?

"I feel like it's warmer today than yesterday."
"I feel hot."
"I feel cold." ...All biased?

Re:Biased. IE is vulnerable, so is Firefox

[fastdecade]

Interesting point... So, by your reasoning, anything a person says or writes is biased, unless they point out all and every single arguement for and against whatever it is?

Interesting point too. Yes, you would have to point out all arguments to be completely unbiased. This is of course, theoretical nonsense.

In practice, "unbiased" would be approximated by a balanced argument covering both sides, even if one side was concluded to be superior "overall". The poster, on the other hand, has used the existence of one argument (less prominent a target) to justify his overall position (it's safer). Now, for any typical definition of "biased", that's what I call seriously biased!

Re:Biased. IE is vulnerable, so is Firefox

[Anonymous Coward]

Yes.

Re:Biased. IE is vulnerable, so is Firefox

[timmyf2371]

Interesting point... So, by your reasoning, anything a person says or writes is biased, unless they point out all and every single arguement for and against whatever it is?

That would actually true - the statement in question is the poster's opinion, but it is actually biased. During my time at highschool studying English, we regularly had debates where the students would prepare a speech on a controversial topic - ie, abortion/open source/etc - and we would have to put forward points both for and against the subject in matter, and our own opinions also, before debating with the rest of the class.

So it is an opinion of the poster in question to say that he feels safer with Firefox, but of course, there are arguments for and against.

That's it...

[Anonymous Coward]

dillo, here I come!

Now I look like an ass

[Anonymous Coward]

Now I look like the fool.
I spent effort convincing all of my friends and relatives to switch from IE for their own safety.
Now I need to remind them to upgrade because the software does the same stuff (and worse) that IE does.

I'm genuinely angry at the presence of this bug.

Re:Now I look like an ass

[Anonymous Coward]

Yes. Yes, you do. And you know what? You invited it. You put your blind faith in a piece of software because of the inane rantings of a bunch of zealots. Did you learn anything from this experience? I doubt it.

Re:Now I look like an ass

[Anonymous Coward]

Well if you call the mainstream press and CERT a bunch of zealots than you are correct. After about the 100th IE bug of the year everyone who has a column even remotely related to computing has come out and advised people to consider switching browsers. This was not based on blind faith as you have put forth but on past performance. IE has there bug of the week that we must all update IE (when MS actually bothers to release a patch) for but mozilla's bugs are fewer in number and frequency comparitivly.

While i consider this bug just as bad as the worst IE bugs MS needs to shoulder some of the blame for the way the URI handler works. Apparently they know this and have fixed it in service pack 2 for windows xp. Despite this huge bungle by the mozilla developers i will stil run firefox and advise everyone i know to do the same.

Bad way

[phorm]

Which is basically to say:

IE bad because it is integrated into the OS
Moz bad because it calls the OS because it's not integrated

Both are bad. In fact, this is quite bad for Moz, as one of the touted improvements is that not being OS-integrated avoids such issues.

Basically, you're passing on data from the windows URI handler... so it's almost like importing a windows IE/Web insecurity into Moz. Perhaps if Moz just imported the windows URI handlers as a datafile, and stripped out known baddies?

Re:Bad way

[KevinKnSC]

Basically, you're passing on data from the windows URI handler... so it's almost like importing a windows IE/Web insecurity into Moz. Perhaps if Moz just imported the windows URI handlers as a datafile, and stripped out known baddies?

Relying on stripping out "known baddies" means that what you're really relying on is your list of known baddies. Any new baddie is, by definition, not on that list. Stripping them out is a start (web pages don't need access to shell://), but it's not a complete solution.

Re:Bad way

[phorm]

Well, the alternative to that would probably be to either not allow any that aren't known good (hey, how come this dumb browser won't open file X!), or allow all or all that aren't known bad but with a warning beforehand. Unfortunately, hoards of spyware/virus infested machines show up how well users pay attention to warnings/disclaimers/etc

Re:Bad way

[Anonymous Coward]

IE bad because it is integrated into the OS
Moz bad because it calls the OS because it's not integrated

Sounds more like a problem with the OS. Maybe we shouldn't use that part.

Re:Bad way

[antiMStroll]

" Which is basically to say:..

Not at all. Mozilla falls down by trusting the multiple OSs it supports to securely handle something it doesn't understand. You did notice the part of the story that specifies this as a Mozilla/XP/2K exploit, right? No problem in Linux or *Bsd, etc., so I don't know how this OS intregration angle is relevant at all.

Re:Bad way

[Anonymous Coward]

I guess it's just me, but what's wrong with an application putting up an error box that says, "Protocol 'shell://' is not handled by this application. Check Edit->Preferences... for configuration options."

Then, provide a list of checkboxes in the preferences for all of the handlers. Break the list into three groups: built-in to Mozilla, provided by plug-ins installed into Mozilla, provided by operating system. There must be some way for Mozilla to query to OS to find out what's supported, so the checkboxes can be built once at init time and then refreshed if it ever comes across a protocol that isn't in the list at all (this allows for new handlers to be installed without even restarting Mozilla).

Just my $.02

Re:Bad way

[Anonymous Coward]

If I had any mod points I would mod this (Score:-1, Dumbest Fucking Idea I've Ever Read). But I don't so I won't.

Re:Bad way

[dolphinling]

From the article:

The developers considered changing from scheme blacklisting to whitelisting, in which case all schemes and protocols would be disallowed unless explicitly allowed. Mozilla Foundation spokesmen said a future version of the browsers will change to whitelisting, but the interim fix just disables the shell protocol. Several other schemes, such as vbscript, are already disabled by default.

So in other words, this fix only changes a pref which is easy to do without a huge download, etc. and is easy for the clueless, since it requires one click. Future versions will have a fix for the problem in general, rather than just this specific case.

Re:Bad way

[Anonymous Coward]

Why do you think this is a dumb idea? Or are you too dumb to support your idiot flame?

Re:Bad way

[mpe]

Not at all. Mozilla falls down by trusting the multiple OSs it supports to securely handle something it doesn't understand. You did notice the part of the story that specifies this as a Mozilla/XP/2K exploit, right? No problem in Linux or *Bsd, etc., so I don't know how this OS intregration angle is relevant at all.

Also no problem with Win NT or Win 9X. So arguably the reason behind the fault is something Microsoft did in Win 2000

Re:Bad way

[stemcell]

Also no problem with Win NT or Win 9X. So arguably the reason behind the fault is something Microsoft did in Win 2000

I hate to be picky but isn't Firefox designed for XP / 2k - so you'd think the devs might consider security flaws in them to be an important issue.

Re:Bad way

[FireFury03]

IE bad because it is integrated into the OS

Not entirely accurate - IE is bad because parts of it run in ring zero. This gives it a marginal speed boost but is a major security problem. Anything running in ring zero is essentially allowed to do anything - it's less restricted than being root on a linux system. So if one of the parts running in ring zero gets exploted then the exploit can do absolutely anything (wipe your hard drive, install key loggers, etc).

In contrast, if you're running FireFox under Linux, it is running as _your_ user. If it gets exploited, it's only your files at stake, it can't go look at the files belonging to all the other users and it can't modify system files since they're owned by root. It also means it can't do nasty things like hooking the keyboard interrupt to sniff your keypresses or install the network sniffer to log your network traffic.

Moz bad because it calls the OS because it's not integrated

I'm sorry, but making calls to the OS is absolutely the right thing to do - one of the reasons for having an OS is to provide library functions for common tasks. Otherwise, each piece of software has to implement it's own (lots of work) and they will invariably act in a different way (inconsistency is *BAD*).

The problem here is that the OS was badly designed in the first place - there is absolutely no reason to implement a "shell:" protocol handler. The other problem is that Microsoft has again shown itself to be incapable of resolving problems - the number of times I have seen an MS patch claim to fix a problem and later find out that it never fixed that at all makes me wonder if they test any of these fixes at all or if they just cobble together some code and release it.

Perhaps if Moz just imported the windows URI handlers as a datafile, and stripped out known baddies?

The problem with filtering known exploits is that you have to know about the expolit first - once you know about it the party responsible for the buggy code should fix it instead of every other 3rd party application having to fix it itself. What's worse is that this exploit had been found and Microsoft had told everyone they had fixed it so noone needed to worry anymore.

Re:Bad way

[adamh]

With respect it's not at all easy for the clueless.

If I go to the firefox home page - there's no mention of it, if I go to the support page there's no mention of it. If I go to the download page I see a reference to 0.9.2 but no release notes telling me that there's a security problem.

So as an average user how would I know or find the fix? Answer: I wouldn't.

Re:Bad way

[ttldkns]

so it's almost like importing a windows IE/Web insecurity into Moz.

It is in fact an IE insecurity too as i just tested it with internet explorer and windows 2000 at this link: http://www.mccanless.us/mozilla/mozilla_bugs.htm

so it is infact an OS vunerability and not browser specific. Infact, we have a patch and IE doesnt. That makes me feel good :)

Re:Bad way

[jrumney]

If I go to the download page I see a reference to 0.9.2 but no release notes telling me that there's a security problem.

0.9.1 was the same. The release notes were unchanged since 0.9 and there was just a note saying "minor bugfixes" in one place, and another note saying "critical update" somewhere else. Firefox is a great product, but they really need to do something about keeping users informed about their releases. We can't all be expected to browse through Bugzilla to see what has changed between releases.

Re:Bad way

[SillyNickName4me]

> If I had any mod points I would mod this (Score:-1, Dumbest Fucking Idea I've Ever Read). But I don't so I won't.

In order to obtain and use mod points, you must be logged on as a user.

I'm seriously saddened that you did not logon as user and used possible mod points you might have had, your contribution to the discussion would have been even more valuable!

Re:Bad way

[wellard1981]

I hate to be picky but isn't Firefox designed for XP / 2k

Mozilla is a cross-platform web browser, it has not been specificly designed to run on one type of operaing system, such as Windows. There are also packages for most flavors of Linux/UNIX, including the source code.

so you'd think the devs might consider security flaws in them to be an important issue.

What Mozilla are doing is passing anything that the browser does not understand over to the OS, with a small hope that the OS will understand what it means. The bug aparantly affects Internet Explorer too, so it's more of a bug in the Windows OS more than anything.

Re:Bad way

[Anonymous Coward]

In order to obtain and use mod points, you must be logged on as a user.

I'm logged on as a user. I'm also posting this anonymously. It's like magic!

Re:Bad way

[stemcell]

As far as I'm aware IE does not directly run the shell: protocol but provides a dialogue offering the option to run / save / etc.

And yes, Mozilla is cross-platform, but Firesomething is designed for windows (with ports being a secondary consideration) - it doesn't seem unreasonable to expect some security protocol changes in light of that fact.

--
Stem

Re:Bad way

[rwise2112]

It is in fact an IE insecurity too as i just tested it with internet explorer and windows 2000

Odd! The article indicates:
The shell: syntax works only on Windows XP systems. According to one report, similar functionality is available on Windows 2000 but with different syntax.

Re:Bad way

[beeblebrox87]

Firefox is designed for Linux AND Windows. It has been the goal of the project to provide equivalent levels of support for both systems since it was called Phoenix.

IMHO, they should worry more about security with the Linux version than the Windows one, as anybody using Windows has pretty clearly shown that they don't care much about security anyway.

Re:Bad way

[maximilln]

Mozilla falls down

Mozilla isn't doing anything IE doesn't do. Clicking on shell: links in IE works like a charm.

Did you RTNA? (nice)

Re:Bad way

[mwood]

What seems to be going on is that Mozilla-for-MS-Windows uses the time-honored method of punting unimplemented file types to ShellExecute() in the hope that Microsoft has provided a handler. The problem with this is that Microsoft *has* provided handlers for all sorts of things you do *not* want others to be able to run on your box remotely. Worse, I don't know of any place to find a definitive list of stock filetypes. Worse still, any other product can add to the list on your box, and doesn't have to tell you it has done so. The actual outcome of ShellExecute() ought to be documented as "undefined".

I think that a whitelist is a capital idea here. There is no good way to know what to put into a blacklist.

Re:Bad way

[Anonymous Coward]

Stripping [baddies] out is a start (web pages don't need access to shell://), but it's not a complete solution.

Your right, it's not a complete solution, but it would have prevented this. Don't try and mitigate the issue by saying "but, if a meteor had fallen on the user, there is no way Moz could have prvented that - even if they did do the right thing in the first place!" it's just more smoke.

Tackle the known problems, do the simplest thing first - rules that obviously weren't followed here.

Re:Bad way

[ttldkns]

I just tried it on XP and the shell links worked in a worse way to the windows 2000 system. At the same time IE also was affected by this in the same ways as mozilla, apart from the DoS style attack.

The mozilla guys are being slated for what is blatantly a windows bug and i woulodnt be surprised if this link technique also worked in word and excel.

Re:Bad way

[UTPinky]

Obligatory Rumsfield quote...

"Reports that say something hasn't happened are interesting to me, because as we know, there are known unknowns; there are things we know we know.... We also know there are known unknowns; that is to say we know there are some things we do not know. But there are also unknown unknowns -- the ones we don't know we don't know."

Re:Bad way

[Anonymous Coward]

Someone said that this problem was supposed to be fixed with XP SP2, well from clicking on that link you provided I can tell you guys that it's not fixed as of SP2 RC2 build 2149.

Re:Bad way

[krewemaynard]

...anybody using Windows has pretty clearly shown that they don't care much about security anyway.

i use mozilla on windows (when i do use windows...blecch) BECAUSE i care about security, you insensitive clod!

Re:Bad way

[rwise2112]

I agree that it is a windows problem (not a bug, but a bad choice), but the article states several things which do not match your experience or the AC indicating that it is not fixed in SP2.

I quote the article:

"Internet Explorer is reported as being less vulnerable. When the user clicks on the link, it opens an "open/save" dialog box in which the user is allowed either to run the program, save it to disk or cancel. Mozilla and Firefox simply run the program without any further user action.

and

"eWEEK.com tested the reported vulnerability on Mozilla Firefox and confirmed the reported behavior. We also confirmed the appearance of the open/save dialog on Windows XP SP1. In our tests on Windows XP SP2, links with the shell: protocol failed to operate at all.

I wonder if some other update is changing the behavior?

Re:Bad way

[vonahsen]

versus Microsoft who tells you on Windows Update "a flaw was found that could allow an attacker to run arbitrary code on your machine"

Re:Bad way

[dtperik]

Yup, I click the "exploit" test link, and all I get is "Shell is not a registered protocol"... must only be a Microsoft Windows problem.

Re:Bad way

[ttldkns]

i've been having a lot of grief from that box and it installed SP1 twice for some reason so it might have something to do with it...
i only skimmed the newsforge article. cheers for the info :)

Re:Bad way

[Eideewt]

You would? Why is that? Are you just a generally spiteful person, or would you be willing to actually give us your motive? By the way, that doesn't need answering.

To the person who had the idea: Probably they want to make the browser as easy to use as possible, without needing technical knowledge.

Re:Bad way

[Reziac]

In fact, I just had that very thought:

I am trying to migrate some "ordinary users" off IE, but they are used to Windows Update handling critical IE updates for them, and they certainly are NOT going to manually check some update site for another browser. How, if at all, are automatic security updates being handled for the Mozilla family?

Re:Bad way

[Bert64]

Actually under X11 it is possible to log keystrokes as an unpriveleged user, but you can only log the keystrokes on an X session you have access to... You can even do it remotely if the Xserver is configured to allow you.

Re:Bad way

[Anonymous Coward]

isn't Firefox designed for XP / 2k

You have got to be kidding, aren't you.

Back in '98 when the mozilla project started noone cared about XP.

AFAIK, MacOS, Solaris, Win98, and Linux as targets each had about equal influence on it's design goals. Win200 and XP had none.

Re:Bad way

[Anonymous Coward]

... click here for a more detailed analysis.

Re:Bad way

[j_d]

it'd tell you automatically because the browser checks for updates on startup?

Re:Bad way

[sepluv]

They are. When 0.9.2 came ou,t users of 0.9.x (where x When I was warned I checked the details of the flaw and it told me the only difference was a setting change in the new version so I changed it manually (although I could have downloading a small XPI to automatically fix it or downloaded the whole new version, 0.9.2).

Re:Bad way

[0BoDy]

there's only a couple problems with that:
1. Yes, you're correct that _most_ windows users don't care about security, or privacy, for that matter, but those people using firefox apparently _do_, since that's the primary reason I tell people to use it.
2. Also, I don't want more span drones, and So I think that all OS's should be reasonable secure, and tht no web browser should get away with the type of security vulnerabilities exibited by IE. Mozilla is absolutely taking a step in the right direction. The idea that people in government office might potentially use IE, scares me. I'm glad that there's a choice users and admiistrators can make.

Re:Bad way

[Reziac]

Ah, okay, that's good to know. Thanks!

Re:Bad way

[sepluv]

sorry meant to extrans... They are. When 0.9.2 came out users of 0.9.x (where x2) where warned by the new security-fix/new-version update system that a new version was available. When I was warned I checked the details of the flaw and it told me the only difference was a setting change in the new version so I changed it manually (although I could have downloading a small XPI to automatically fix it or downloaded the whole new version, 0.9.2).

Re:Bad way

[Ari_Haviv]

You could also say that someone who uses the internet, no matter what OS doesn't care about security

Heretic, YOU MUST BURN!

[Saeed al-Sahaf]

Heretic, YOU MUST BURN!

Blacklisting vs. Whitelisting

[Temporal]

The developers considered changing from scheme blacklisting to whitelisting, in which case all schemes and protocols would be disallowed unless explicitly allowed.

Duh.

I have been saying this for some time now: Never use blacklists. Always use whitelists.

If you forget to put an insecure operation on a security blacklist, you have a security hole. If you forget something on a whitelist, you just have an inconvenience.

I am disappointed that the Mozilla developers did not have enough common sense to use whitelists in the first place. But then, it seems like most computer security schemes are blacklist-based, which explains why computers are so insecure.

Re:Blacklisting vs. Whitelisting

[Anonymous Coward]

Well, if you are so special then why don't you lend them your services?

I have to listen to shitheads just like you at work all day. They think they are the hottest thing around and do nothing but complain about other apps when in fact the stuff they write is the worst I've ever had to deal with.

What exactly have you contributed to the world? ... besides the waste heading to your sewer.

Re:Blacklisting vs. Whitelisting

[Temporal]

Uhh... http://www.evlan.org

Re:Blacklisting vs. Whitelisting

[ZorbaTHut]

Eww.

One of the big disadvantages to the whole blacklist/whitelist things is, indeed, inconvenience. But you seem to be thinking it's just a minor inconvenience where, to a lot of people, it's major.

Example: A while ago (I don't know if they still do, but it wouldn't surprise me) Unreal registered unreal:// to open games. You didn't have to do anything, it just worked. A lot of sites relied on this (click hyperlink, open unreal, badabing badaboom).

Now, if the web browser used a whitelist, there's a few options. First off, it could be utterly impossible for Unreal to register even with user assistance - bzzt, this is bad. Remember, users want things to be easy.

Second, it could require the user to go through the steps to add unreal:// to their settings. Also bad, because the Unreal coders don't want to have to change their installer every time the interface changes. Plus it's irritating for users. Bzzt.

Third, it could ask the browser/OS to register itself, and the browser/OS could pop up a confirmation box. But we already know users can be duped into clicking just about anything ("You MUST click Yes for real 100% hardcore xxx porn!") and so this wouldn't exactly be a rock-hard barrier. Bzzt.

Fourth, it can do what it does now, which is also flawed. Bzzt.

I personally think solution 3 is the best one - but if Windows doesn't already have hooks for things like this, it might not be practical for Mozilla to add a happy little dialog. There might be a way to query the system about what it *would* do it if we happened to pass it an unreal:// url, then prompt the user to see if that's what they really want to happen, but I bet that's exploitable also ("What's this rundll thing? Oh, the line says 'free porn'! I'll click yes")

I'd agree that more security = better (and more convenience = better too - the trick lies in balancing the two), but just saying "we should use a whitelist" leaves so much undecided that it's almost useless.

Re:Blacklisting vs. Whitelisting

[Anonymous Coward]

I have been saying this for some time now: Never use blacklists. Always use whitelists.

Well you obviously haven't been saying it loud enough!

But then, it seems like most computer security schemes are blacklist-based, which explains why computers are so insecure.

Now you've solved computer security, could you do something about cancer please?

White/blacklisting does have a simple answer: it depends.

Re:Blacklisting vs. Whitelisting

[Temporal]

I agree that the third option is ideal. Provide the user a simple on-demand interface for adding stuff to the whitelist. The interface should warn the user of the security issues. If the user ignores the warnings, well, that's their problem.

Re:Blacklisting vs. Whitelisting

[Anonymous Coward]

Duh. It's not so simple, Einstein.

The issue isn't listing from a set of unknowns. It's listing from a set of things that are already categorized.

The question was whether to whitelist or blacklist Windows protocol handlers. And because of the differences of these methods, the question is really "do we want to entrust client system actions to Windows protocol handlers?" (Which is really not as simple a question as "can we trust they will be secure?" Don't mistake that too.)

Should the browser protect a Windows system from itself? I think so. Windows has a bad track record. I'd whitelist. I am not disappointed the Mozilla developers didn't choose this route. I'd say I disagree, but not that I'm disappointed. I expect they will change their minds, anyway.

Re:Blacklisting vs. Whitelisting

[Anonymous Coward]

Uhh.. You take a dump, call it a programming language and expect what?

Re:Blacklisting vs. Whitelisting

[Anonymous Coward]

Haha, I half expected you to come back with RandomBSD or WhoCares Linux. I gave you too much credit.

Social problems vs technical problems

[Anonymous Coward]

Keeping malware from tricking users isn't a technical problem to solve. You can provide the tools for the user to make the right choice in as clear and simple manner as possible, but you cannot /force/ a user to be educated.

You cannot solve the social problem of user ignorance with technology.

(Of course, you CAN solve the technological problems that allow malware to install itself without user action...)

I knew it!!!

[Koil]

Funny...the timing of this couldn't have been worse. I have been reading /. for a while now, and just the other day downloaded Mozilla, and then FF, then uninstalled FF and stuck w/ Mozilla, all on my work PC ,just to see the differences between the two. Well, I d/l'ed & installed it, and within 25 min of checking /. , CNN and Yahoo I had AdDestroyer, Virtual Bouncer and something else loaded onto my machine. After hearing how all of the /.'ers praised the open-source marvel that is Mozilla, I figured I must have clicked an ad-banner on accident somewhere and let something in (3x accidently clicking banners?? must have been really tired). I ran ad-aware and after the 3rd time through, it found and removed everything and we're all honky dorey once more. **Now** I know where it came from, it was so close after the install of Mozilla there is no way it could be anything else. This goes to show me a few things. 1) Don't believe everything you read. Check it out for yourself, and download Ad-Aware right after. 2) IE is the big corporate megolith swinging its clumsy and vulnerable code all over the place, but I really hope people realize that once these browsers start to get the attention that IE has had, the same vulnerabilities will be exposed in them as well, and the whole problem that MS has had to go through will occur for Mozilla/Opera/whatever....patching patches, breaking your software with software fixes...Not that I am an MS fanboi, but it does get a little "Anything not MS" heavy on here now and again. For now, I'll stick with IE. It does everything I need, I'm comfortable with it, and it didn't download crap from banners within the first 30 min. I used it. ...I did like the tabbed browsing though.

Re:I knew it!!!

[Anonymous Coward]

Sigh. You realize of course that this is a WINDOWS FLAW, right? Mozilla/Firefox is just doing the proper thing and handing off the protocol to Windows. The people at Mozilla are fixing Microsoft's problem and disabling this feature that is BUILT INTO WINDOWS. Get it?

"**Now** I know where it came from, it was so close after the install of Mozilla there is no way it could be anything else."

No you don't. No one who has ever used Mozilla has had 3 pieces of spyware installed withint "25 minute" of visiting CNN and Yahoo. Sorry but your misinformed as to where you caught those items. Again if they were installed it would not have bee n a Mozilla issue. Blame Windows for letting you install apps without your knowledge.

"For now, I'll stick with IE."

Enjoy your game of Russian Roulette and having to deal with spyware and trojans on a daily basis. I'm sorry to hear you think that going with IE is a just as safe as using Firefox even though every computer security expert in the world advises against it.

Even though I think your borderline Trolling I will give you one piece of advice. Use Avant. You'll still get nailed by spyware and other problems occasionally but at least it makes using IE bearable.

Re:I knew it!!!

[TrancePhreak]

Avant Browser and MyIE 2 are both programs that make use of IE for displaying and both contain tabbed browsing.

Re:I knew it!!!

[Koil]

Cool...thanks for the tip.

I'll check them out, although I've become pretty savvy at my own tabbed browsing...alt-tabbing. :)

Re:I knew it!!!

[Anonymous Coward]

In Soviet Russia, Tabbed Browser Exploits You!

Re:I knew it!!!

[Anonymous Coward]

Yeah, that's it go with IE because its just so much better against spyware.

What a load of crap! I run mozilla/firefox exclusively and I get basically no spyware on my windows box. When i ran IE the system was full of that junk.

This was coming...

[metalmaniac1759]

Somehow I saw it coming... Some big MS conspiracy thing. Get someone everyone believes to say - "Switch to Firefox!"

And when Firefox starts getting all the media - SWOOSH! Here come the BIG Firefox bug. So you see other browsers AND open source programs are really buggy.

Welcome to MS software. Glad to have all your money.

Re:Firefox pass unknown protocol handlers to the O

[fermion]

Type that into start/run on a Windows box - it works. Type it into the Address bar of IE - it works. Toss it into a webpage on the local machine and click on it - it works. Toss that webpage onto a remote server and click on it - it doesn't work any more. Different behaviors for different levels of trust

This is where is unclear who gets it wrong. Assuming that there is a legitimate need to run a local command from the browser line, where is "the single, unambiguous, authoritative representation" of the security protocol to reside. Is the check for security clearance within MS Windows accessible to every local program? If this is the case then Mozilla was written incorrectly because it duplicates knowledge. Or is the check for security protocols within IE and not available to every other browser. In this case MS is at fault because it promotes the duplication of standard bits of knowledge.

Dropping the previous assumption, why do we need to run arbitrary local programs from within a browser, especially without a bullet proof sandbox.

Grammar Nazi

[Anonymous Coward]

You meant to say, "objectivity."

Welcome to Windows Update

[Anonymous Coward]

Welcome to Windows Update

Pick updates to install

There are no critical updates available at this time. (Snigger)

Re:Sorry, links to Bugzilla from Slashdot are disa

[Dreadlord]

Or you can set network.http.sendRefererHeader to 0, and Mozilla [Firefox] won't send the referrer header.

Mozilla needs patch management

[klui]

Nice to have the fix, but...

1. When I launch FireFox 0.9.1, I get no notification that a critical update is available.
2. After I update, there is no dialog that tells me I need to restart FireFox (and Thunderbird) unlike what the website says.
3. After I downloaded the patch, choosing Tools>Extensions doesn't show that a patch has been applied. Only the ability to search for updates exists, but before I applied the patch, I clicked on it and it says no updates are available.

Add to the fact that on a laptop of mine, even after I have uninstalled all older versions of FireFox, it still says that FireFox 0.9.1 is available when I have installed FireFox 0.9.2

Re:Firefox pass unknown protocol handlers to the O

[rjstanford]

Is the check for security clearance within MS Windows accessible to every local program?

Urm, I surely do believe so. That's why the user can even set it in their control panel - Internet Settings I believe - rather than just in IE (although IE does wrapper that .cpl to let you set them from with itself as well, purely for convenience). Its been a while since I did any Windows coding though so I couldn't tell you off the top of my head, and I'm too lazy to go look.

The Mozilla apps in general do seem to shun using standard approaches to things like this. At least they use local printers, though, they're not falling completely into the WordPerfect trap of providing "better" (mostly but not always) solutions to things they don't need to mess with. This is just an example of failing to take existing (yet OS-dependent) features into account.

Re:Congratulations

[Anonymous Coward]

Where do you get those earplugs?

Re:Target the obvious vulnerablities

[Anonymous Coward]

Or maybe it's the fact that IE represents an easier target due to its much larger user base and long list of gaping holes.

Re:Congratulations

[Anonymous Coward]

Er, I think you need to look up 'hypocrisy' in a dictionary and get back to us.

Re:Target the obvious vulnerablities

[thebatlab]

"Or maybe it's the fact that IE represents an easier target due to its much larger user base"

It's fun to repeat what was said earlier isn't it

RTFBR

[jefu]

(Read the F-ing Bug Reports)

Reading the bugzilla entries for this and related bugs (an earlier post has the bugzilla url for this bug) is interesting in itself.

It shows that the developers well understood the security implications of the bug - but they were also trying to fit the browser into the MS scheme of things in which programs seem (I'm not a windows expert at that level) to be able to register protocols (shell:, vbscript:, irc:) that they get to handle. Disabling this in windows would then lead to Mozilla/Firefox behaving differently than they've come to expect.

It was further pointed out that mozilla could require a "yes" click in a dialog window, but that that would lead to other security issues.

Interesting reading.

Re:RTFBR

[TheLink]

They could have always made it a configurable option and made it secure by default. But no.

Probably the very same people who wrote Netscape are still writing Mozilla.

Re:Congratulations

[Anonymous Coward]

Agreed. People just need to realize that Moore is the Limbaugh of the Left.

What's left?

[AK Marc]

If IE is out, and so is Mozilla and related browsers, it seems that we should all be on Opera (or, if we aren't in it for the pretty pictures, let's all go back to Lynx).

MOD UP

[Anonymous Coward]

This is a Windows issue. This of course won't stop everyone here from flaming though. Too bad you weren't the submitter.

Re:Propaganda continues

[Anonymous Coward]

All good points... And currently riding at -1, Flamebait. Sad. Very sad. Still, this place isn't short of fuckwitted moderators.

Webpage should highlight the patch more

[klui]

It's really not obvious when you go to Mozilla.org that there's a patch available. It should be on the right-hand-side instead of down in the middle of the page on the left-hand side. Also, mozilla.org/products/firefox doesn't tell you there's a patch available!! Hopefully, my email to its webmaster will help fix this soon.

Some other fixes:

[twitter]

Note that Linux versions of these browsers were not exploitable. You can take advantage of this with free downloads from these helpful people:

• Mepis
• Fedora
• Debian use the new installer, Testing rocks.
• Feather Linux for those of you still running your favoite 486.

I doubt they will block Slashdotters.

It's less effort, really it is. We now return you, of your own volition, to Windoze hell.

Re:Some other fixes:

[ktulu1115]

I think you meant the following link instead:

Fedora

Re:Some other fixes:

[twitter]

yep, thanks.

Re:Congratulations

[Frizzle Fry]

I don't hear the OSS community pretending their software has no bugs or holes.

YMBNH

Duh!!!!

[Anonymous Coward]

Is that cos WINDO$$$$$$$$ is SHIT??

I eagerly await your responses.

MOD UP!

[Anonymous Coward]

I was about to post the same remarks, but I couldn't have said it any better.

Vocabulary nazi

[Anonymous Coward]

Choice of words is not "grammar".

Yes it would be Linux fault or addon

[Anonymous Coward]

Reason just try to do that by the same fault I will not work. Thinking URI is a URL processor Linux has a URL processor and no fault.

This is case of a core function being defective. Over looked facts Number 1 I can call this from a Microsoft Office document with a macro just as simple as mozilla can.

So the flaw is not restructed to Mozilla also Outlook Express and Outlook both have the same flaw point. It had to be fixed. Basicly it was a cancer effecting everything linking to a core function what really sould not been able to do what it could.

Ie URL is [protocol]://[content] It would be fun to try same fault with a simple click though on Internet explorer O that right they already have.

ie Microsoft created a Protocol call shell Another case of don't trust Microsoft created anything.

Unsigned Patch!

[nlinecomputers]

I tried to install this patch and it said it was unsigned!!!! Not to be paranoid but how can I confirm this is real? I don't like to install patches that I can't get PGP signed key for or some other method to validate the code.

This is headlined wrong...

[shaitand]

This is a windows hole, not a Mozilla hole. The Mozilla team has just decided to implement a workaround so the windows hole won't hurt you when using their browser. That is also why it only affects Mozilla on windows and why they debated whether to do something about it for so long.

DOH

[nurb432]

And just right after the HSD reccomends people switch from IE to Mozilla...

Bad timing.

Fix:

[mlk]

Download the fix here!

I'm so scared, Mr. Cluster, can you help?

[twitter]

Just how does Mozilla/FireFox think it's going to keep malware from tricking the users into granting permission when the clueless masses come over from IE?

You can never keep employees from being tricked, but that's a data segregation and HR issue. Only give people information they need and only give sensitive information to people you know you can trust.

Running a free OS like Linux or BSD is a good start. As the current exploit shows, sticking a better browser on top of Windoze does not make it safe from auto exploits. Systems with real user level permissions and a diverse selection of software running are much safer for everyone.

Got any better ideas? Rip your network card out? Go back to IE and it's own plugin systems?

No problem for that other alternative browser...

[Rits]

Opera long ago decided to *not* pass on any protocol or scheme to the operating system, except for a few well defined cases (ftp, telnet, mailto). Users of Opera 7 can add specific protocols/schemes manually in the prefs if they want.

Lesson of today: there is always a danger in presenting yourself as 'the save alternative'. Proper engineering can reduce risks, but there are never garantees. Not that this example was especially worrying imho: you'd still have to be tricked to visit a specific website that plans to harm you. Not that likely unless you to tend to visit the bowels of the web...

This has been addressed by MS

[commodoresloat]

It requires clicking on a link in order to execute. MS has plainly addressed this vulnerability when it was a problem in IE, and their solution is the same for Mozilla.

Re:This has been addressed by MS

[HungSquirrel]

It requires clicking on a link in order to execute.

No, a sneaky little bastard could use <meta> refresh tags as well.

Re:Hahahaha

[Anonymous Coward]

ahahaha hahahhah hahahahahahh hahahahaah ahahahahahahaha hahahaha hahahahahaha hahahahahaha hahaa hahahahahahaa haa ahaha ahahahaha ahah haha ha ha ha ha
I couldn't possibly laugh any harder... Oh wait, yes I can...
ahahahah ahahahahaha aha hahahaahaha ahahhahahahahaaha ahahhahaahahah ahahahhahahaahahhhahahahahaahahahah hahahahaahahah hahahahahaahah
Stupid hubris ridden OSS sheep!
ahahahahahahah ahahahahahaha ahahahhahahahaha ahahahahahahah hahahahahahahhahahahahahaha hahahahahaa hahahahahahahhaha hahahahahahahahahahahhahahahahahahaahahaaaaaaaa
O MG how I am laughing at you. Yes YOU. You wanker who thinks just because something is "Open Source" that it is made of magical fucking pixie dust and will automatically be secure.
haahahahahahahahahahahahahahahah
And never mind the fact that most IE exploits have a patch available before they're publicised, while this Moz/FF bug is fucking 2 years old...
ahahahahahahahhahaahhaahahahahahahaahaahah aha
OMG I am laughing my fucking ass off.
How does it feel to have your whole pretense fucking collapse around you? To know that no-one will ever pay attention to you just-so stories ever again? Pretty bad I think so I just can't help sending you a bit of schadenfreude.
hahahahaahhaahahhahahahahahahaahah ahhahahahahaha
Fucking noobs. OMG this has just made my day. And the inevitable censorship of this post is going to complete it. Can't handle the truth, eh? ahahahahahahahahahahah OMG bliss.
ps. How many mod points you got left, son? It doesn't cost me anything to repost. I know you don't like what I say, but you lack the power to do anything about it! Sorry!

0.9.2 Release Notes?

[thedillybar]

Apparently they haven't gotten to writing the release notes for 0.9.2. Is this "shellblock" thing the only fix? Sounds like it would be much easier to install the shellblock.xpi extension. (redundant I know)

BUT, since I have XP SP2 installed (the latest release candidate), I can ignore 0.9.2 altogether? Or are other bug fixes included in this release?

Re:0.9.2 Release Notes?

[jesser]

The only changes were the security fix and the version number. That's why there isn't a 0.9.2 at all on Mac or Linux.

Re:0.9.2 Release Notes?

[TiggsPanther]

Is this "shellblock" thing the only fix? Sounds like it would be much easier to install the shellblock.xpi extension.

Yes, it would. That's probably why on the mozilla.org page about this particular flaw they have a link to the XPI first, and the newer version second.

Having a new version containing the fix as well (and with a number increment so that you know whether your install-file has it or not) is a good idea for anyone wanting to install from today or later.
If they didn't do this, any downloads of any of the three programs would be vulnerable from the word go. This is not a good thing.

The alternatives would be the two usual ways mott software from many companies (including bugs in other Moz versions) get fixed.
1 - By patch only, no new version. So any fresh installs will be vulnerable and need the patch applying.
2 - By new version only - no patch. So fresh installs are safe, but old versions need a complete download/install.

By doing it this way it provides a quick method of closing the vulnerability in 0.9.1 as well as providing a version that installs without this bug.

Tiggs

Browsers

[AdmV0rl0n]

Having to run a windows site I was once again looking at the ADODB:stream bug and pondering directions to take and look into.

Some of the issues I pondered was if I spent a lot of time ripping out the user access to the none removable IE, and installing either Firefox, Mozilla, or another browser, or a combination of that or similar.

On the browser side, removal of Active X and the IE gubbins brings security, but also none working websites. Perhaps a lot of companies aare going to move back to the standards that form web rather than MS specific technology. I can't blame them, as most people outside tech areas like slash tend to use or aim for market leading pitches. The bulk of users use IE.

That will continue to be the issue, however, looking deeper into this, I looked at machines and figiured I would have to keep IE patched, but in addition, if I role another product or more, I merely add quite possible extra vectors of concern and attack.

All the browsers go through security and exploit issues, at least from time to time. What I settled on was continuing with IE. Its built into windows, there is'nt an easy undo for that.

Somewhere between Sunday/Monday, MS got a patch out. IMHO while this is not perhaps upto the highest levels of OSS error and fix correction, it is'nt bad or horrific.

In the main, so long as they deal with issues quickly and provide answers, I can tolerate them. They are not as bad as some make out.

The history of Mozilla is not as bug free and exploit free as much of the recent comments try to indicate. In truth, we will continue to have security issues with software, and it is how the vendor responds that should be critiqued.

AdmV

Serendipity! Vindication in under one day!

[Anonymous Coward]

I just, I mean JUST predicted earlier today that even releasing a windows mozilla browser was an incredibly bad idea,a short sighted "transitional crutch" I termed it, and using an analogy that it was akin to being an enbaler for an alcoholic. I posted it on the mozilla plugins article thread. Last I looked no replies, no mods, but HERE ya go, an example of what has happened, and an indication it will happen in the future as well. Now THIS. LOOK at this. It doesn't matter that this time it was fixed in time, because NO ONE can predict when and how an exploit will be discovered and used. Even though, this time, it wasn't widely exploited, I think it proves my point, that sometime, somehow, someone will figure out an exploit and it WILL be deployed extensively, and it WILL infect a LOT of windows boxes running mozilla, and it will give a serious blackeye to open source in general.

Either go all the way to changing the OS AND the browser, do the right thing, all the way,or don't bother, it's naieve wishful thinking and at best a finger in the dike stopgap measure to try and make windows "secure" on the internet, and at best an incredible waste of time and resources in the OPEN source coding community. You either support open source, or you don't. You either support windows closed source and their dismal OS and their mafia like business practices or you do not. If you are working for free for Redmond you are nuts, and are doing no one any sort of long term service. You aren't a "little bit pregnant", you either ARE or you AREN'T.

And even with this evidence, no one will admit the huge mistake in making a windows port of moz/firefox. They will keep doing it until they get BURNT BAD.

Re:Serendipity! Vindication in under one day!

[Planesdragon]

You DO realize that there have been some rather high-profile bugs, malware, exploits, and viruses for Linux (and even BSD), don't you?

And you also realize that, if Gecko had only been put in Free Computing systems, it would have essentially rotted away to nothingness years ago.

Of course, you're also completely ignoring the amazing PR spin Mozilla is for Open Source. Sure, it has a bugs and holes--but those bugs are publicly filed, honestly reported, and fixed in a VERY timely fashion.

(Then again, you're comparing Free Computing and pregnancy.)

Re:Serendipity! Vindication in under one day!

[Anonymous Coward]

Yeah I tried posting the severe bugs in Linux but was rejected...only to see a post about a MS bug that was completely trivial the same day. Slashdot editors are more biased than Fox News.

Re:Serendipity! Vindication in under one day!

[Anonymous Coward]

You're suggesting changing the OS and the browser and then calling Firefox "naieve wishful thinking?" What color is the sky in your world?

Re:Serendipity! Vindication in under one day!

[aksuur]

I heard asteroids have no atmosphere.

Re:Serendipity! Vindication in under one day!

[dolphinling]

Well obviously there has to be a Liberal Media somewhere...

Re:Serendipity! Vindication in under one day!

[Anonymous Coward]

Either go all the way to changing the OS AND the browser..

Why? What sort of stupid logic is this? Why should the user run only Open Source on Open Source and Closed Source on Closed Source? That has to be one of the dumbest fucking things I've heard in a while. If I want to use a new email client, should I change to OpenVMS, too?

Re:Serendipity! Vindication in under one day!

[Anonymous Coward]

Yes, in the same way that it's formally logically correct to say, "If my underwear is wet, then the Earth is approximately spherical."

Re:Serendipity! Vindication in under one day!

[FireFury03]

Of course, you're also completely ignoring the amazing PR spin Mozilla is for Open Source. Sure, it has a bugs and holes--but those bugs are publicly filed, honestly reported, and fixed in a VERY timely fashion.

I really hope that if the mainstream media does stories on this they will make it clear that:
1. This is not a problem with the browser, it is a problem with the OS
2. The problem with the OS was alegedly fixed by a previous MS patch... except it wasn't - MS obviously don't test their patches.
3. Even though it was not Mozilla's own problem they still jumped and fixed it within a day of the report.
4. Microsoft knew about the latest IE hole 10 months before it was exploited and still did nothing about it.

Re:Serendipity! Vindication in under one day!

[Anonymous Coward]

4. Microsoft knew about the latest IE hole 10 months before it was exploited and still did nothing about it.

The fact that you didn't see a result doesn't mean they "did nothing about it". Considering your point #2 -

MS obviously don't test their patches.

It's plausible that MS required 10 months to test all the ramifications of their fix. Considering theirs is the predominant OS on the planet, that's not unreasonable - otherwise you'd be back to bitching about them breaking something again.

Fucking idiot.

(Score:-5, Pro-MS)

Re:Serendipity! Vindication in under one day!

[Epi-man]

Either go all the way to changing the OS AND the browser, do the right thing, all the way,or don't bother, it's naieve wishful thinking and at best a finger in the dike stopgap measure to try and make windows "secure" on the internet, and at best an incredible waste of time and resources in the OPEN source coding community.

I totally disagree with you. As a user that is stuck on an XP platform because where I work I have no say (and I am far from alone here!), I am absolutely overjoyed that the coding community "wastes" its time and resources to allow me to use my home browser at work. Last time I checked, the community was not out to "make windows 'secure'," but was instead out to make good software for people to use freely. Granted, I am probably starting another flamewar here (which free, blablabla), but I think you need to leave it to the people doing the coding to decide how to spend their time and energy and not foist alternate agendas upon them.

Re:Serendipity! Vindication in under one day!

[Magius_AR]

1. This is not a problem with the browser, it is a problem with the OS

What arrogance.

Does IE have this bug?
If not, it's a FIREFOX BUG...aka, it's a serious security flaw the Firefox browser has that other browsers due not.

As this program remains in pre-release numbers, and still does not even come close to dominating market share, I'll be _very_ interested to see what further flaws are discovered in the future.

I'm sure the typical arrogant "Firefox is impervious" argument will reign on Slashdot though.. The only real advantage Firefox has over IE is that it's more _defaultly_ secure. Install enough plugins (such as the ActiveX plugin) and you can make Firefox just as dangerous as IE. On the flipside, turn off enough "features" and IE can be made very secure.

Windows flaw...pish...if I put something in my browser that was capable of calling "rm -rf /", would you also blame the inventor of the rm program? Or how bout the shell? Maybe the OS? *smirk*

Re:Serendipity! Vindication in under one day!

[FireFury03]

What arrogance.

Does IE have this bug?
If not, it's a FIREFOX BUG...aka, it's a serious security flaw the Firefox browser has that other browsers due not.

As a matter of fact, the shell: bugs have plagued IE - this is a bug with the operating system that needs to be fixed at the source rather than _every single_ internet application needing a workaround.

I'm sure the typical arrogant "Firefox is impervious" argument will reign on Slashdot though..

I would never suggest that any software is completely secure - any programmer who believes otherwise is not worth employing. However, there is "less secure" and "more secure" - IE is a very insecure browser built ontop of (into) a very insecure operating system (mainly because MS take so long to fix problems after they've been discovered). Mozilla, FireFox, Opera, etc are reasonably secure browsers. Of course if you run an insecure OS then that compromises the security of everything running on it and there is only a limited amount of work those applications can do to correct for this.

The only real advantage Firefox has over IE is that it's more _defaultly_ secure.

Most of the people who get hit by the security problems are the people who do not know anything about security - they're the people who won't be selecting and deselecting options. Those of us who tweak the config ourselves are the reasonably safe ones so the default should be security. Additionally, installing ActiveX is a really stupid thing to do as it is the single biggest security hole in IE and is infact listed on the FireFox feature list as a security improvement by *NOT* running it.

Windows flaw...pish...if I put something in my browser that was capable of calling "rm -rf /", would you also blame the inventor of the rm program? Or how bout the shell? Maybe the OS? *smirk*

Windows holds a register of all the programs that can handle various internet protocols. Someone saw fit to add "shell:" to that register - whoever that was is to blame (and it sure as hell wasn't the browser)

Re:Serendipity! Vindication in under one day!

[Anonymous Coward]

Being actually good is not "spin." It is simply actuality.

"...amazing PR Mozilla is..."

And which viruses are you talking about? Malware? I've seen bugs and worms, based on exploits. I have not yet seen popular malware or adware or even viruses. Don't muddle these together.

Re:Serendipity! Vindication in under one day!

[dossen]

Does IE have this bug?
If not, it's a FIREFOX BUG

IE (version 6.0.2800.1106.xpsp2.030422-1633 (not kidding, that's what it says), which appears to be the latest version (no patches pending in the update utility)) opens shell: URIs. So the answer to your question is YES, IE has this bug

Im on pins and needles

[koan]

Waiting for the homeland propanganda......errr homeland security to advise us not to use it.

Win 98 VS Win XP

[Anonymous Coward]

Is it just me, or are Windows XP and 2000 ***more*** insecure than Win 98?!!!

It seems that just about each "new feature" that Microsoft has introduced into XP and 2000 has allowed a whole family of new exploits!

This is just Microsoft's curse on all "early adopters"!

P.S.
An "early adopter" is anyone who doesn't wait nearly a decade for Microsoft to work out all the bugs and security holes. This time limit seems to be getting longer not shorter, with each release!!!

How long will it take for Longhorn to be secure? Or, maybe Microsoft is going to give up entirely on "ease of use"?!

your ass indeed Mr. Superboy.

[twitter]

OK, that's it you guys. No more talk of how IE is so insecure because of Microsoft's 'monoculture.'

No, IE is insecure because it's a piece of shit. Had you read the article summary, you might have noticed this is a Windoze problem:

Note that this only affects users of Mozilla and Firefox on Windows XP or Windows 2000.

The OS is a piece of shit too and you can't fix it by putting a better browser on it any more than you can make a VW bug into a Porche by upgrading the engine. As the same browser does not exhibit the same problem on other OS, you must conclude the OS is a fault, not the browser.

Apologies to VW for comparing the fine VW bug to M$'s OS.

Pull your pants up now, Captian, no one else is interested.

Windows ME

[Anonymous Coward]

Sure, it's a crappy OS that crashes at the drop of a hat, but once again, no one cares enough about ME to exploit it.

Here's what I think is happening with the update

[Tired_Blood]

The update feature is telling those without a version 0.9.1 that an update exists. This includes 0.9 and 0.9.2 (I just made the .2 install and it still complains).

Also, the webpage that comes up says "Firefox 0.9.1 is the award winning preview of Mozilla's next generation browser. ..." while the file that's linked on the same page is ".../releases/0.9.2/FirefoxSetup-0.9.2.exe".

Looks like whoever setup the notification system read the wrong number.

Re:Firefox pass unknown protocol handlers to the O

[roca]

Mozilla does support different levels of trust. For example, a page on a remote website can't create an IFRAME whose SRC points at your local filesystem. A local file can do that. So I don't know what your point is.

This bug is about which Windows HTTP protocol handlers should be trusted. 'shell:' was trusted when it should not have been.

No problems here

[lamber45]

I tried all the links on the test page, but I just got a message-box saying "shell is not a registered protocol". Could it be that I'm using Mozilla 1.4 on Linux?

Re:A clear advantage - read the C/C++ specs

[Anonymous Coward]

If that was supposed to be C code, then

int main()

is invalid, it should be

int main(int, char**)

If it was supposed to be C++ code, the you should use

#include<cstdio>

for including C library headers and then reference printf as

std::printf

and the

return 0

in unnecessary in C++.

I won't even bother to mention using streams instead of C library output functions.

RTF specs!

Updates

[AnomalyConcept]

I thought Firefox (and possibly other Mozilla products) had an update reminder?

Netscape?

[cachorro]

So does this affect the 7.x releases of Netscape as well?

Re:Netscape?

[Anonymous Coward]

When I tried the test at mccanless.us, Netscape 7.1 on Windows 2000 was affected. The Mozilla patch fixed the problem (after restarting Netscape). I would expect Netscape 7.0 and probably 6.x to be affected, too.

Use a text editor

[ishmaelflood]

Anything important is text, so just use a text editor as your browser.

Re:Use a text editor

[Anonymous Coward]

View > View Mode > Embedded Advanced Text Editor

Done and done. Mind you, if Konqueror were vulnerable to this, or a similar exploit, it wouldn't change anything other than the fact you can't click on links in a text editor so you'd manually have to copy the URLs.

Re:Use a text editor

[Anonymous Coward]

*highlight* *middle click* *read read read* *highlight* *middle click* *read read read* *highlight* *middle click* Oh !@#$, that was /evilvirus.txt, wasn't it? !@#$ !@#$ !@$# !@--

This bug report isn't the same..

[osssmkatz]

This bug report is about executing unknown protocol handlers in other places except . Mozilla has had for a while now, a blacklist of bad protocols that it should not pass to the OS.

With this patch, "shell:" was added--quickly because the infastructure was there.

--Sam

I'm so lonely

[Anonymous Coward]

It's been almost two months since graduation, and I'm still living on campus, by myself, in a hundred twenty square foot single. I haven't left the building in more than three weeks. Perhaps the Chinese delivery place will wonder why I stopped calling. More likely, they won't even notice, and wouldn't care if they did. My so-called friends packed up and left without saying goodbye, and the only phone call I've answered since then was a wrong number; the other party hung up immediately. I've had all this time alone to absorb the crushing emptiness of my life and let it ferment. I dwell on the horror of solitude, knowing the company of strangers is infinitely worse. Life has spit me out filthy and wet and passed me by with nary a thought. If this comment gets modded down tonight, I am going to kill myself. The method: asphyxiation by carbon monoxide inhalation. The place: the parking lot behind my dorm. Yes, I'm aware Slashdot is not the appropriate forum for this kind of thing, yes, I'm aware of the dripping pathos. Call this a cry for help or whatever you want. I'm sure I'll merit at least a two-line summary in the death notices. -J.D. in NYC

Re:I'm so lonely

[Anonymous Coward]

Please kill yourself, and clean up the gene pool.

Re:I'm so lonely

[Anonymous Coward]

That's not necessary, it is unlikely that he will reproduce.

Re:I'm so lonely

[Saeed al-Sahaf]

That's what you get for living in a Quad and majoring in poly sci. Go for it.

Re:I'm so lonely

[Anonymous Coward]

Fucking Jesus H. Christ on a pogo stick, I could have saved someone's life but Slashdot banned my IP.

Re:I'm so lonely

[Demented_D]

get a job?

Wrong

[Mitchell Mebane]

That's not a report of this vulnerability. It's a comment about a proposed change that might have prevented this vulnerability, had it been implemented. At the time, there was no known actual vulnerability that demanded the change.

Sorry, that's not true. It was indeed a report of a vulnerability. The Mozilla team did not fix the vulnerability until an exploit appeared yesterday.

I hate having to say this, but that doesn't sound so different from Microsoft, does it?

Choose your evil

[nasteric]

Choose your evil. Internet Explorer or Mozilla/Firefox.

Oh good

[Anonymous Coward]

So this is how M$ get's revenge; make the browser it self a a security flaw.

The real difference between IE and et.al.:

[Anonymous Coward]

I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites.

That's the shallow reason. The solid reason is that when these things happen in Mozilla (et. al.), they're seen as bugs, and they treated like bugs - SPLAT! When bad shit happens to IE, not only are the bugs far less certain of quick repair, nor is it just that some of them just aren't going to get fixed. It's that basic underlying causes such as Active X's fundamentally broken security model CANNOT ever be fixed. It's borked by design, and not all the Gate's coders, nor all the Gate's men (jumping up and down, damply, still muttering "developers? wherefor art thou, developers?") can ever put poor Mr. Exploder together again.

But don't worry, the next Great! New! version will solve all these problems by refusing to connect to any internet site that doesn't pay danegeld to be part of the Trustworthy Commercial Advantage Network. (some sites may require an additional access fee. please insert wallet for hours of exciting tours of the Gates Museum of Once Useful Old Computers.)

--
I am not anonymous! I am the number six!

Thank you sir...

[xgamer04]

I probably would have just installed .9.2, but your tip saved me the time/headache.

Re:A clear advantage - read the C/C++ specs

[Old Wolf]

Maybe you should read the specs.
int main(void) is valid in C and C++.
Including stdio.h and calling printf (not std::printf) is valid in C++, although it is deprecated.
Using C library functions instead of streams is entirely valid, too.

WTF is an XPI? Super secret instructions required?

[Anonymous Coward]

Okay, I'm a Firefox newbie but this has to be a common enough question: What the heck is an XPI?

Am I missing the obvious "to install this patch, follow steps a, b and c" readme.txt file which a ready for prime-time product like Firefox should have?

It's not like I'm trying to install fancy blinkenlights or some doohikey that'll let me change the title from "Firefox" to "FireWhizzBang" or something: I'm trying to install an apparently simple security patch.

Shouldn't a patch be a self-extracting, simple to install "Double click this to run" file?

I'll say this for IE: When there's a patch available, I just download, run it and it's done. Do I have to learn the super-secret mystery open-source handshake before I'm allowed to install a frickin >100kb patch?

Damn straight it's a bug in Windows!

[argent]

Not only that, but it's a known (almost) ten year old bug in Windows - the use of the same set of handlers for local and remote services - and one I've been trying to tell people about for that long.

Mozilla and Firefox should NOT be using this functionality, they should be doing ALL their own URL parsing and handling on Windows, Linux, Mac OS X, and so on, because they can *not* depend on the native OS to do security right.

Even Apple doesn't do it right (see how they 'fixed' the help: problem), and Microsoft has refused to fix it on their side even under threat of judicial dismemberment.

From the article:

Is this really a security hole? When Mozilla receives a shell: request, it passes it on to an external handler in Windows. The "fix" for this is to disable this functionality which, as far as I can tell, is totally unnecessary to begin with. External handlers -- programs outside Mozilla -- have no specific security model, so the only way to deal with them is to make individual exceptions like this one. Messy? Yes. But that's Windows.

The only way to deal with this is ONLY use external handlers you know are safe, rather than using all but the handlers you know have holes in them. Anything else is just following Microsoft's lead into a decade of virus-mania.

Re:Damn straight it's a bug in Windows!

[julesh]

The only way to deal with this is ONLY use external handlers you know are safe, rather than using all but the handlers you know have holes in them.

The only problem is that the ability to add an arbitrary handler to your system is extremely useful: it allows people to use a web interface to pass commands to your applications.

If Mozilla didn't allow this, a huge number of people would switch back to IE.

Re:Damn straight it's a bug in Windows!

[argent]

The only problem is that the ability to add an arbitrary handler to your system is extremely useful

Lots of things that are extremely useful and convenient are also very dangerous and should only be allowed after review. Of course if the user needs to override the carefully limited set of handlers that the browser enables by default, they should be allowed to do it via a configuration panel on a per-site-and-protocol basis, but nothing should be enabled by default unless it's known to be secure.

EG:

"The site my-internal-server.mydomain is attempting to use the install-driver: protocol. [Allow once] [Enable this protocol for this server] [Enable this protocol for this domain] [Cancel]. *WARNING* The install-driver: protocol is not normally enabled. It may allow my-internal-server.mydomain to take over your computer. Check with your system administrator if you're not sure you should allow this."

If Mozilla didn't allow this, a huge number of people would switch back to IE.

The same statement can be made of many other security flaws in IE.

**sigh**

[knightrdr]

If anybody bothered to actually read about this "exploit" it's not even that serious of an issue.

This has been blown way out of proportion by all the paper MCSE's running around here.

oh, so nice.

[twitter]

Writing M$ is always a sure sign of maturity. Go back to reading your tentacle porn books, you fucking nerd.

Constructive and polite, what a nice little troll. Why don't you you fix your problems instead of going back to playing with your Windoze and FUDding Mozilla?

Re:WTF is an XPI? Super secret instructions requir

[Doppleganger]

Here you go.. an obvious, step-by-step guide.

Don't even need to double-click anything, it installs from inside the browser. No need for self-extracting executables.

What About Automatic Update?

[videodriverguy]

Although many people have (partly as a result of press coverage) changed to Mozilla/Firefox, not all of them read Slashdot or are technically knowledgable.
At least with a problem in IE, many users will be patched automatically by the Windows Update process. That is not going to happen with Firefox. To me this is lack of automatic updates is much more serious than this individual problem.

Note - I personally use Firefox and not IE.

This IS 100% Mozilla's fault

[MobyDisk]

...Is this really a security hole? When Mozilla receives a shell: request, it passes it on to an external handler in Windows. The "fix" for this is to disable this functionality...

I am shocked that everyone here is sticking on Mozilla's side. I love Mozilla, and have used it since the beta versions. I install it on mom & pop computers all the time for security. But this is definitely Mozilla's fault. Mozilla should not pass unknown protocols to explorer. IMHO, that defeats the purpose of Mozilla. That would be like coding Mozilla to pass ActiveX controls to Internet Explorer since it doesn't support them.

I treat Mozilla as a standalone app, and I consider that an advantage. I'm not vulnerable to scripting exploits, MS Office exploits, etc. But now I am told it passes some work to Explorer. I consider that a bug. I don't want it to pass everything except shell: to IE. I want it to pass nothing to IE.

Re:This IS 100% Mozilla's fault

[spitzak]

I agree. This is a big screw up by Mozilla. The fact that Windows provides you with calls (like write()) that can damage your system does not mean the bug is in Windows, which seems to be the excuse being presented by everyone here. It is Mozilla's job to call such potentially destructive things only if it thinks it is safe.

Re:This IS 100% Mozilla's fault

[evilviper]

But now I am told it passes some work to Explorer. I consider that a bug. I don't want it to pass everything except shell: to IE. I want it to pass nothing to IE.

Hmmm. To play devils advocate... Would you be blaming Mozilla if there was a bug in Acrobat Reader, or Shockwave Flash?

Re:This IS 100% Mozilla's fault

[Anonymous Coward]

Not to mention the fact that: If this is a Windows bug, how come NO OTHER BROWSER HAS THIS PROBLEM?

Oh, and here is another one. Since Mozilla is Open Source, presumably this flaw isn't such a big deal since everyone could have simply fixed the code themselves and recompiled when the original bug was listed. Can I get a show of hands as to the number of people that actually did fix and recompile two years ago? Anyone?

Re:This IS 100% Mozilla's fault

[gregm]

No, but I don't want stuff like that installed out of the box either. I realize that the more crap (plugins) I load into my browser the less secure it is. shell should have 100% been disabled by default and when you turn it on there should be an explanation of wtf it does and maybe even a warning about possible security probs. Or maybe it should require a plugin that you have to download and install. So Moz says sorry I dunno what shell: is unless the plugin is installed that hands the shell request off to winblows.

Mircrosoft should have fixed this the right way and they are certainly partly responsible but moz is responsible too. The line that bothered me was the one that said something like if Mozilla doesn't know what to do it hands the request off to the OS. At least that's what is supposed to happen with shell:. Allowing the OS to collect the trash is fundamentally wrong.

Re:This IS 100% Mozilla's fault

[Anonymous Coward]

Alas, you've pointed out one of the faults of Slashdot's moderation system - One never has moderation points when it's needed. Sorry about that, this post deserves more attention.

Re:This IS 100% Mozilla's fault

[argent]

Mozilla should not pass unknown protocols to explorer.

Absolutely agree.

They do the same thing in Mac OS X, which is why the "help:" hole impacted Mozilla as well as Safari. It's 100% Mozilla's fault, and 100% Microsoft's fault. Both of them 100% ignored basic security.

Re:This IS 100% Mozilla's fault

[julesh]

Yes. The problem is that MS's documentation on this API makes it look like it is safe.

Re:This IS 100% Mozilla's fault

[Anonymous Coward]

Yes. The problem is that MS's documentation on this API makes it look like it is safe.

But the great Moz QA and peer-review process didn't catch the fact that it wasn't safe? Oh wait, they did, two years ago, and they CHOSE NOT TO do anything about it.

Re:This IS 100% Mozilla's fault

[julesh]

As hundreds of other people have already pointed out, the bug filed 2 years ago, while it would have helped if it were fixed _would not have solved this problem_. Read it. It would have just stopped the use of and tags to open shell: URIs, not tags or form submissions, and probably not javascript either.

Also, the reported wasn't aware of this specific problem. One poster was aware of another protocol scheme that could be used to cause problems, which was subsuquently blocked -- i.e. they fixed the reason the problem reported was dangerous without fixing the "bug" itself. And, as fixing this "bug" would have damaged Mozilla's functionality, this is probably a good thing.

Re:This IS 100% Mozilla's fault

[MobyDisk]

Excellent question! My answer is no, for two reasons.
1) Those things don't come built-in to Mozilla - I have to download them and install them explicitly myself.
2) Because they provide a useful feature. Passing protocols to IE provides me no benefit (that I know of). I call those things "misfeatures."

Re:This IS 100% Mozilla's fault

[evilviper]

1) Those things don't come built-in to Mozilla

Only for license reasons, really. Netscape (v6, v7, etc) come with Flash, as well as Java (doesn't Mozilla come with, at least, Java? It used to, as I recall)

2) Because they provide a useful feature.

That's all a matter of perspective. I don't find Flash, Acrobat, or Java plugins to provide any useful features.

On the same note, many would find passing registered protocols to the OS very useful. Clicking on a "telnet://" link would open the terminal program... Clicking on a "mailto:" link could open the default mail program, etc. Those are real useful features.

Concern has been around since 2002

[DragonHawk]

The security exposure is apparently due to the fact that Mozilla, running on MS-Windows, will hand off any "URI scheme" Mozilla does not recognize to the OS. This only happens on MS-Windows. Since Windows may (and indeed, does, by default) know about URI schemes that do things you would not want a web page doing (like run programs), this is considered a problem for Mozilla.

I have to agree that this is a Mozilla issue. To use a slightly contrived comparison: I read my mail using UW Pine. If someone sends me a script via attachment in email, I do not want Pine to test and see if the interpreter in the she-bang line is available on the host OS. My OS is not my mail reader; I do not want my mail reader allowing everything my OS can do. Ditto my web browser.

There appear to be at least three Mozilla Bugzilla Bugs related to this (likely a lot more):

#1 = Mozilla Bug 163767 (20 Aug 2002)
"Pref to disable external protocol handlers"
http://bugzilla.mozilla.org/show_bug.cg i?id=163767

#2 = Mozilla Bug 167475 (9 Sep 2002)
"Disable external protocol handlers in all cases, excluding <A HREF"
http://bugzilla.mozilla.org/show_bug.cgi?id =167475

#3 = Mozilla Bug 250180 (7 Jul 2004)
"Shell: protocol allows access to local files"
http://bugzilla.mozilla.org/show_bug.cgi?i d=250180

It appears that Mozilla developers have been worried about this kind of problem going back to at least Aug 2002 (see #1 above). #1 talks about an option to disable external protocol handlers (URI schemes) by default. I have to say that would be the right thing to do. "Secure by default" is the correct approach.

#2 talks about an approach that uses context to determine if an external handler should be invokved. Basically, it assumes that if a user clicked a link, they wanted to invoke the handler; anything that happened implictly (such as image loading) should not invoke an external handler. I do agree with those who commented (in that bug) that this is not the right approach. It adds complexity, and it still fails to address the fact that clicking a link is not something that should just up and run anything the web page wants. If I wanted that, I'd use MSIE.

#3 is a reference to the "shell:" URI scheme in particular being abused this way. It blocks the "shell:" scheme to prevent that abuse. It does nothing to prevent abuses of other possible schemes, though. I suspect we may see this "feature" of Mozilla rear its ugly head again in the future.

This is not a failure of Open Source in particular. Nor does it prove Mozilla is crap or Microsoft is okay after all. It means that people make mistakes. This should not surprise anyone. Stop pointing fingers and fix the problem.

Re:Concern has been around since 2002

[KarmaMB84]

MSIE blocks the shell: scheme for internet sites. Mozilla should have done this all along since no site has any business messing with that scheme.

Re:Concern has been around since 2002

[julesh]

#1 talks about an option to disable external protocol handlers (URI schemes) by default. I have to say that would be the right thing to do. "Secure by default" is the correct approach.

Unfortunately, external protocol handlers are an important feature which, if disabled, would cause many people to feel that Mozilla was unusable as a browser. They are important for anyone who wants to use Mozilla alongside instant messaging applications, P2P file sharing applications, and other similar networking utilities. They can also be used to implement user interfaces for multimedia CD-ROMs (see my parenthetical remark below).

#2 talks about an approach that uses context to determine if an external handler should be invokved.

The approach suggested in this bug would have prevented any automatic exploitation of this hole. But it's easy enough, as stated in one of the comments, to trick a user into clicking a link. It would have been helpful, and makes some sense (although the case isn't as clear cut as suggested in some of the comments in that bug - you can have an external protocol handler supply data to the application, and this would be useful for instance to allow Mozilla to view web pages generated by a DLL installed locally without needing to run an HTTP server).

Re:Concern has been around since 2002

[maximilln]

I have to agree that this is a Mozilla issue

It's not a Mozilla issue. It's an issue with using an OS which keeps a registry. It's an issue with users who demand to be able to open any data format in any application and have the OS automatically spawn the correct application because the users can't be bothered to match data types with applications. It's an issue with the media industry wanting seamless integration of their data to their application without allowing the user to save that data to disk.

The "shell://" handler is only a logical extension of the real issues. Is it a Mozilla issue if clicking on an .mp3 in your web browser exploits your favorite media player? Is it a Mozilla issue if clicking on a .wmv in your web browser exploits your favorite media player?

This wouldn't be an issue if we didn't have users who clamored for seamless idiot-proofing and a corporation who happily gave it to them.

Re:Concern has been around since 2002

[DragonHawk]

"It's not a Mozilla issue. It's an issue with using an OS which keeps a registry. It's an issue with users who demand to be able to open any data format in any application and have the OS automatically spawn the correct application because the users can't be bothered to match data types with applications."

I guess that means that *nix is also a lousy OS.

(Hint: Look up what /etc/mailcap does some time.)

The issue is not that Mozilla spawns external programs. The issue is that Mozilla does so without asking.

This is a Mozilla problem

[DragonHawk]

"Agreed. It's not really a bug in the browser, it's a flaw in Windows."

I disagree. I feel this is a Mozilla problem. (It may be a Windows problem, too, but that's not the issue here.)

Let me explain in terms of Linux, another Slashdot favorite:

I run mainly Linux on my home and work PCs. The Linux OS looks at the start of any executable file to determine how to run said file. If it recognizes a particular "magic number", it invokes the appropriate handler (ELF, a.out, Java, etc.). If it recognizes a she-bang line (first line starts with "#!" followed by the path to a program), it will run that program. Otherwise, Linux feeds the executable to the default shell (/bin/sh) and hopes for the best.

The fact that my OS can do all of these things does not mean I want Mozilla to do them. If I click a link that leads to an executable file on the web, I do not want Mozilla to hand-off the executable to the host OS (Linux) to see if Linux can find a way to run said executable.

Make sense?

Re:This is a Mozilla problem

[scenic]

Mozilla doesn't do what you described... it doesn't hand off any executable to the OS.

Your analogy isn't quite right... let's think about this another way... you have a plugin you've installed that has a security flaw in it. Is Mozilla (or IE or any other browser) responsible for the security flaw?

The registration of external protocol handlers is common practice across different platforms and browsers. I use OS X primarily at work and at home. I also run Linux here and have a Windows laptop at work. All three platforms use external protocol handlers to register helper applications.

The part that I think is significant is that the OS registered a protocol handler that isn't safe in an internet context. So, you either blame the browser for doing what the OS manufacturer recommends you do... or you blame the fool who wrote the insecure protocol handler (and why the hell would you want a "run any program" protocol handler????)

Sujal

Re:This is a Mozilla problem

[Anonymous Coward]

This is not an executable, it's an URL (or at least it looks like one), and Windows is supposed to handle it as an URL.

An URL firefox doesn't understand could be news: - and calling Windows' URL-handler is supposed to open the news reader. Or mailto: which is supposed to open the mail client. (Those examples won't work for Mozilla itself, because it has it's own mail and news reader). The point is, that we are talking about something that's supposed to be an URL, and that mozilla wants to open when asked to. It's not supposed to execute any file specified by the web page.

Re:This is a Mozilla problem

[hackstraw]

let's think about this another way... you have a plugin you've installed that has a security flaw in it. Is Mozilla (or IE or any other browser) responsible for the security flaw?

Look though my comment history and see what I think of plugins. (hint, they suck)

Yes, this is a mozilla problem. Here is the deal. When you develop an application where anyone in the world has input to that program you check the input for valid data and reject anything that is not valid. Period.

A uri handler called shell:// is stupid. Thats as if your leaving an open rsh or ssh port with no password. Again, this is the first time I've heard of such a handler, and I don't know exactly what it does or is supposed to do but the fact that its called shell tells me that its not something that belongs on an internet application. Name me one more network application that would accept arbitrary commands without a password to be run on a computer. Just one.

Re:This is a Mozilla problem

[maximilln]

From what I understand Mozilla is only doing what any competent web browser is supposed to do: ask the OS what protocols it knows about. If the OS knows about shell:// then the browser hands it over.

IE does the same thing quite happily.

Re:This is a Mozilla problem

[scenic]

right, but how does mozilla know that a particular URL is not valid? So, "shell:" seems obvious to you, but it wasn't registered by Mozilla. Windows has a handler called shell. Mozilla is simply doing what the OS provider says to do... hand off unknown protocols to the local system to see if you have helper applications (for example, telnet:// or ssh://).

We agree about the stupidity of a shell:// handler... but Mozilla didn't provide it. I'm not sure what "valid data" they should be checking for here... the only thing I see at this point is that they need to start maintaining a black list of protocol schemes... Of course, if a particular bit of spyware/adware becomes popular, for example, they'll just be chasing down changing schemes.

Sujal

Re:This is a Mozilla problem

[hackstraw]

As of January of this year, this is the list of recognised uri schemes.

All are very specific, and none of them run arbitrary commands.

Here is the RFC for registering new URL schemes.

and here is the guidelines for creating new schemes.

Re:This is a Mozilla problem

[scenic]

And browser vendors never implement de facto standards or anything not set up as a IETF or W3C standard...

Right. This is getting silly.

Sujal

Re:This is a Mozilla problem

[ckedge]

but it wasn't registered by Mozilla.

It's Mozilla's problem because Mozilla allows arbitrary unknown handlers to be registered by third party software (aka MS Windows) that they and the user do not control or have an up front choice about.

Mozilla shouldn't trust arbitrary data coming in from the net, and Mozilla shouldn't trust arbitrary interface-configuration-requests coming in from automated 3rd party software internally.

hand off unknown protocols to the local system to see if you have helper applications

An equivalent would be handing off unknown binary files to the OS to see if it knows what to do with them - which every single human can easily see is utterly stupid and entirely the fault of the browser.

Someone else said The Mozilla developer's shouldn't be babysitting the Windows OS.

BULLSHIT, it's not babysitting, it's preventing the OS and any internal 3rd party application from becoming an interface without explicit knoledge by the Mozilla and/or Users themselves.

Someone else said It's an operating system protocol handler, just like any other registered helper app.

Don't register every tom dick and harry fucking handler that you don't know a fucking thing about, not without explicit permission from the user.

Someone else said What do you recommend happen if Flash has an exploit?

Someone installed the Flash plugin/handler, consciously and willingly. It's not a fucking submarine job. ALLOWING submarine jobs is irresponsible.

The key question is - who set up the interface? Did a user or 3rd party install software say "hey, Mozilla, do this when this occurrs", or did Mozilla say "hey, I don't know what to do with this, let's just throw it against the wall and hope it works".

Mozilla set up the interface, Mozilla bears the responsibility of possible mis-use.

Re:This is a Mozilla problem

[scenic]

Mozilla set up the interface, Mozilla bears the responsibility of possible mis-use.

They didn't set it up... this is the way the OS asks applications to behave. You're misstating the way it works.

Re:This is a Mozilla problem

[DragonHawk]

"Mozilla doesn't do what you described... it doesn't hand off any executable to the OS."

No, it hands off an arbitrary command to the OS, which (for purposes of security) is the same damn thing.

"All three platforms [*doze, Mac, *nix] use external protocol handlers to register helper applications."

Yes. On *nix, you can find /etc/mailcap for that sort of thing. The critical difference is that Mozilla does not blindly run anything it finds in /etc/mailcap without asking the user first.

"The part that I think is significant is that the OS registered a protocol handler that isn't safe in an internet context. "

I do not believe that there is anything in MS-Windows that promises the protocol registry is always safe to use. It's simply a mechanism for mapping "protocols" to "handles". It is not a mechanism for displaying Internet content.

"why the hell would you want a "run any program" protocol handler?"

For a generallize shell interface (which *doze has), it makes sense to have a "default protocol" which handles everything. Again, *nix has similar things ("if an executable file's type cannot be determined, run it through /bin/sh and hope for the best"). Sure, Mozilla does not invoke those capabilites, because doing so from an untrusted source (the Internet) is dangerous. So why does Mozilla do it on *doze?

I can't believe I'm defending Microsoft Windows, but the fact of the matter is, there was a clear danger here, and the Mozilla people have known about it for years. (See another of my comments in this thread for details.) This should have been fixed a long time ago. (Again, the fact that it was not fixed just means that the Mozilla people are fallible, just like all other humans.)

Re:This is a Mozilla problem

[scenic]

you're not differentiating between a protocol handler and /bin/sh... this is just silly.

auto-update no worky - ?

[real_smiff]

nice, doesn't seem to work though. says there are no updates, or it couldn't find any, something like that. for both methods you suggested (and for several other plugins i've got insalled). anyone else got firefox's auto-update to work?

Re:auto-update no worky - ?

[Anonymous Coward]

If you cannot start installation, check the preference Enable software installation, in a preferences panel Preferences > Advanced > Software Installation.

Source:
http://white.sakura.ne.jp/~piro/xul/doc/installati on.html.en#install

And reset update settings bug:
http://slashdot.org/comments.pl?sid=113895&cid=964 7983

Then Tools / Extensions, and click Update.

But I still do not know why from menu Tools/Settings/Advanced/Update Now - button it shows errors on Tabbrowser extensions, but from Tools/Extensions/Update -button it updated and installed new version of Tabbrowser extensions ok. Strange.

shellblock.xpi The 56k modem fix for older version

[Anonymous Coward]

Blocks the protocal that trigger the problem. Basicly gives mozilla a handler for the protocal that is required for the problem to work that leads nowhere but to a void.

Now 6k has to be one of the smallest browers patchs I have ever seen. Question what Is the Smallest IE patch???

Please note microsoft created this protocal all protocals used in URL should never have this fault the riskes are too high.

Mozilla VS IE

[GISGEOLOGYGEEK]

The real difference between them ...

When a bug is found in IE, everyone blames Microsoft.

When a bug is found in Mozilla, everyone blames Microsoft.

hey, wait a minute ... what the hell!

Re:Mozilla VS IE

[smash]

If you RTFA, you'll notice that the problem is with Windows explorer - Firefox is simply passing links handled by explorer.exe to windows.

Also, if you RTFA, you'd realise this was supposed to have been fixed in a Windows service pack, but isn't.

So yes, I blame microsoft :)

Problem doesn't exist on any other OS running firefox...

smash.

Re:Mozilla VS IE

[KnightStalker]

I was about to disagree with you, but I changed my mind mid-comment. Having an external protocol-handling system sort of puts the burden of responsibility on the protocol handler to check things for security, and having a "shell" protocol handler is absurdly insecure. The fact that IE doesn't pass along shell:// urls leads my paranoid brain to suspect that Microsoft set this up deliberately as a trap -- they can say "Look, the competition isn't any more secure than we are." AIM has the same bug, BTW.

Re:Mozilla VS IE

[GISGEOLOGYGEEK]

ya ya ya, keep talking and prove my point more.

You are saying that the program that receives the malicious command should just blindly pass it along to windows, pass the buck, who cares about the consequences.

But when a MS product does anything like this all hell breaks loose, that the attack should have been prevented where it was received, not down the line.

warning, an analogy follows this statement, all analogies are inherently imperfect but I'm sure you will manage to get the damn point ....

Would you keep a firewall up that although secure in some ways, still simply passed an obvious very high risk command onwards for the operating system to deal with? umm do I even have to say the word NO?

But its OK, its an open source product, so passing the buck on is not considered evil the way it would be for an MS product.

Open your eyes, its a case of the open sourcers being totally unable to admit there could possibly be an 'MS style' fault with one of their products.

Re:Mozilla VS IE

[smash]

I see your point, however to exploit this, its a windows exe that will be overflown, etc - not firefox.

This bug does not exist if you run firefox on anything else.

And... its fixed before an exploit is in the wild for it.

There's unfixed security holes still in IE that have been first mentioned on mailing lists years ago.

Try the "see! ie isn't that bad!" thing all you like, but Mozilla's security record is no-where near as bad as IE's is - and won't get that bad, ever, due to different design decisions - whether its as popular as IE is, or not.

smash.

Re:Mozilla VS IE

[pe1chl]

Originally IE did the same thing as Mozilla does now, this was once identified as a bug/security issue, and then it was fixed in IE itself, not in Windows.
So others that have the same problem need to be fixed independently. This has now happened.

To know if IE really does not pass shell: urls, type one of these in your address bar:
shell:windows
shell:cookies

Re:Mozilla VS IE

[Anonymous Brave Guy]

Mozilla's security record is no-where near as bad as IE's is - and won't get that bad, ever, due to different design decisions - whether its as popular as IE is, or not.

Y'see, the problem is that statements like that just don't have any credibility left when you're looking at vulnerabilities like this. The bug in question is a "complete wipe-out" style vulnerability. The issue was known by the Moz dev team years ago, and they decided it was WONTFIX. Yet even IE fixed this one a while back.

The problem here is not the specific bug, it's the attitude/lack of awareness demonstrated by the Mozilla dev team when faced with a critical vulnerability. The attitude of so many people in this thread -- "It's a Windows fault, not our precious Mozilla!" -- is almost as scary.

Sorry guys, the honeymoon's over. Mozilla can crash, can take out all your stored e-mail, can be exploited to damage the rest of your system, and doesn't get fatal security flaws fixed for years, just like IE. It may still be a better product, but there's no mileage left in claims that it will always and necessarily be so.

BTW, assuming there are no exploits out there for this vulnerability is staggeringly naive. Just because no widespread worm/virus-style exploits are known doesn't mean it hasn't been used by the geek who disliked the other guy down the hall or by the company emloyee wanting a quiet raise.

Re:Mozilla VS IE

[julesh]

The issue was known by the Moz dev team years ago, and they decided it was WONTFIX.

That was actually a different but related issue. Even if that had been fixed, this would still have been a problem, as clicking on shell: links would be able to execute arbitrary programs.

Fixing that bug would also have disabled some useful behaviour.

Re:Mozilla VS IE

[argent]

Firefox is simply passing links handled by explorer.exe to windows

And why in the name of all that's holy is it doing that?

Re:Mozilla VS IE

[argent]

So others that have the same problem need to be fixed independently. This has now happened.

Not if Firefox is still passing *any* URLs to IE it isn't.

At the very least they should put this in "Preferences -. Advanced -> Stupid -> Accept all IE security holes [ ] Yes [ ] My god no, what are you thinking?"

It's a Windows bug that they use the same protocol handlers for trusted and untrusted components.

It's a Mozilla bug that they trust Windows to get it right.

Re:Mozilla VS IE

[maximilln]

It's not up to the Mozilla team to bugfix all of your external applications for you.

Mozilla is not responsible for vulnerabilities in your ftp client. (for handling ftp://)

Mozilla is not responsible for vulnerabilities in your media player. (for handling media streams)

Mozilla is not responsible for vulnerabilities in your libjpg. (for looking at pretty pictures)

The shell: protocol is (just plain dumb) the simplest case scenario but the fact remains that Mozilla isn't doing anything that it shouldn't be doing.

Re:Mozilla VS IE

[maximilln]

Because it does it for any registered protocol or MIME type. Mozilla isn't supposed to be your security monitor. Web browsers have evolved to be told by the OS which protocols are supported and handled.

Don't blame Moz because some other app registered the shell: handler.

Do you blame Moz when some virus registers the MIME type for x-application-trojan or the handler for the trojan:// protocol?

Re:Mozilla VS IE

[argent]

It's the Mozilla team's job to ensure that the untrusted documents its handling remain contained within its sandbox. If that means bugfixing external applications, verifying the security of external applications before using them, or simply not using any applications that aren't shipped with Mozilla itself, that's their decision, but it's also their responsibility.

I don't expect them to do a military grade security review of every helper application or protocol handler, but I do expect them to be aware that the Windows *and* Macintosh defaults are not suited for use by a browser and to only enable those helper applications and protocol handlers that can be reasonably expected to work with untrusted documents.

The shell: protocol is the simplest case scenario, but the fact remains that these halders are inherently untrustable by default and should only be used after review.

Re:Mozilla VS IE

[argent]

Web browsers have evolved to be told by the OS which protocols are supported and handled.

Almost a decade of regular vulnerabilities and exploits found in the OS provided protocol and file type handlers demonstrates that this is one of those cases where evolution has produced a result that endangers the survival of the species outside the hothouse.

Yes, I would blame Mozilla for obeying an OS-provided mime-type for a-application-trojan or a handler for the trojan:// protocol. I blame Mozilla for obeying the help: protocol on mac OS X, and the shell: protocol on Windows. By obeying these protocols, you're making every registered application on the system a component of the firewall that any application MUST erect around any untrusted document.

This is a well known and well understood design flaw in Internet Explorer that I am utterly astounded to discover in what I have been assuming to be a better design.

Re:Mozilla VS IE

[maximilln]

By obeying these protocols, you're making every registered application on the system a component of the firewall that any application MUST erect around any untrusted document

Using your logic allows you to blame anything you choose. Why not blame your firewall? Why not blame your A/V software? They're actually advertised to protect your system. Mozilla's purpose is not to prevent you from doing something which isn't smart. Mozilla's purpose is to enable content transfer.

I'll believe you're not a troll when you file a bug report with McAfee or Norton about this severe vulnerability in their software allowing the arbitrary execution of files on your system.

Re:Mozilla VS IE

[maximilln]

Why is it Mozilla's responsibility to bugfix someone else's problem?

If you catch a virus out of e-mail because you clicked the .exe, do you blame your e-mail client or do you blame your antivirus software? YOU CLICKED THE .EXE! If that virus starts spewing out network packets do you blame your firewall for not stopping them? YOU CLICKED THE .EXE!

Whitelists suck, blacklists suck. Not just for e-mail spam but for protocol handlers as well.

Re:Mozilla VS IE

[argent]

Using your logic allows you to blame anything you choose.

Don't be absurd.

Any web browser's purpose is to display documents provided by third parties. That's what it's there for, to take a document created by someone you don't know and showing you a reasonably good approximation of what they intended, without letting them do anything but displaying that document and handling your responses.

If you, as the user, want to enable the use of other programs by the browser, if you as the user want to so something which isn't smart, then that's your lookout. You tell the browser to turn that on. But until the USER actually specifies that protocol be turned on then the USER has not done something, that third party software developer has.

If it wasn't the browser's job to limit what the content and references in a web page could do, why wouldn't it allow ""? Don't strain your brain... it's because a web page is in a controlled and sandboxed environment. It's an untrusted object that is only allowed a very carefully limited set of operations on your computer. Maintaining that sandbox such that it can only use those operations IS the browser's responsibility.

Running any random protocol handler that Microsoft happens to include, given the history of the past decade, is just negligent.

Re:Mozilla VS IE

[argent]

Bah. I shouldn't let people rush me into skipping that preview step.

why wouldn't it allow ""?

That read: ... why wouldn't it allow "<run cmd='format c:\'>" ...

Re:Mozilla VS IE

[argent]

Why is it Mozilla's responsibility to bugfix someone else's problem?

It isn't. It is, however, Mozilla's responsibility to refuse to use someone else's program when it's been the biggest source of security holes in the entire computer industry over the past ten years.

You might as well ask "why is it Hilton Hotel's problem not to pump their drinking water out of Boston Harbor".

Using Microsoft's protocol handler mechanism for anything but known trusted local content is the equivalent of drinking polluted water. It's been known to be polluted for years. People are using Mozilla instead of IE because they're trying to avoid drinking that polluted water. For Mozilla to turn around and attach their pumps to it is just horrifying... it's like finding out that your drinking water is coming from the sewage treatment plant, and they haven't bothered treating the sewage.

If you catch a virus out of e-mail because you clicked the .exe, do you blame your e-mail client or do you blame your antivirus software?

If you catch a virus out of your email because you looked at the first few lines of the message in the preview pane, do you blame your e-mail client? I blame my email client, personally. And that's the kind of thing we're talking about here... viewing web pages, not downloading and clicking on executables.

Re:Mozilla VS IE

[maximilln]

It is, however, Mozilla's responsibility to refuse to use someone else's program when it's been the biggest source of security holes in the entire computer industry over the past ten years

If Moz would leave out the hook to the OS handler they would get spanked by featureware.

You might as well ask "why is it Hilton Hotel's problem not to pump their drinking water out of Boston Harbor".

But it was _NOT_ within Mozilla.org's ability to change the insecure design of the OS URI handler unless they start patching your OS for you. If they don't include the OS URI handler functionality they will always be behind the curve in end-user functionality.

Using Microsoft's protocol handler mechanism for anything but known trusted local content is the equivalent of drinking polluted water

The moment that they would hard code the protocol handler list is the moment that Real, WMP, and everyone else registers new protocols. There is no choice but polluted water. Mozilla is competing to be _THE_ standard desktop browser of choice, not some niche yuppie bottled water.

If you catch a virus out of your email because you looked at the first few lines of the message in the preview pane, do you blame your e-mail client? I blame my email client, personally. And that's the kind of thing we're talking about here... viewing web pages, not downloading and clicking on executables.

The exploit in Outlook was a bona fide exploit. There is no reason for attachments to be executed while viewing the preview pane. Mozilla does _NOT_ do anything it shouldn't be doing. Mozilla is simply following protocol when it follows img src.

Re:Mozilla VS IE

[argent]

If Moz would leave out the hook to the OS handler they would get spanked by featureware.

Did I say "leave it out"? Did I? No, I didn't. I said "Only use known safe protocols by default." If you know that a protocol that you go through Microsoft's handler to access it is designed for the net, then you can use it. If the USER specifies that they want to use it, then you can use it. If you do your own sewage treatment (use only protocols that are known to be designed for the net), or let the user request a sewage tap (allow the user to override the protocol list) then it's the user's problem. That's cool.

But what you're arguing is that they should just let the user suck on whatever toxic waste Microsoft shoves in their protocol list while AT THE SAME TIME they tell people they're more secure than Internet Explorer.

The exploit in Outlook was a bona fide exploit.

Which one? There have been dozens, and more than one that hit the preview pane because they hit *any* page presented by the MS HTML control... and most of those are due to "cross zone exploits"... which translate to "the bad guy tricked Outlook into using a protocol or file type handler that wasn't safe for the net".

Re:Mozilla VS IE

[GISGEOLOGYGEEK]

hilarious.

I bet there's 100 'useful behaviours' that the open source lovers have cheered about loosing to make microsoft products more secure.

But somehow its wrong to do the same on mozilla.

Re:Mozilla VS IE

[GISGEOLOGYGEEK]

and your point is about the windows overflow is?

if something gets passed a firewall, is it still windows at fault when it receives the attack that slipped through?

NOOOOOO.

Now, you can either stop blaming the results of a mozilla fault on windows, or never complain again about the similar faults that are found in IE from time to time.

You can't have it both ways.

facts?

[sheldon]

Last weekend, I converted three people from IE6 to Moz FF 0.9.1, based on the facts that it's more secure than IE.

I'm pretty sure you mean 'based on the claims' rather than facts.

This exploit and patch pretty much proves that Firefox is not more secure than IE, something I was trying to tell slashbots last week and got flamed for.

Re:facts?

[dcam]

This is just one bug. IE has a long history of bugs.

Secondly it could be argued that this is a bug in windows. Sure it should have been anticipated by the mozilla developers, but this is not of the scale of the bugs that we see in IE.

Re:facts?

[EugeneK]

I wonder what this proves..

actions speak louder than words, Sheldon. What browser do you use?

Re:Propaganda continues

[NeoChaosX]

Those points are all inflammatory, that -1 moderation is deserved.

Re:Target the obvious vulnerablities

[Anonymous Coward]

Could it be that IE and Windows itself are not simply just shoddy products, but are actually under more scrutiny than their nearest competitors despite the fanboy rantings to the contrary

No, IE and windows ARE just simply shoddy products AND they are under scrutiny. I thought that was painfully obvious to everyone by now.

For the current shell users

[programgeek]

What happens to the people who use the shell: feature? shell.com?

Fire on the Mac

[SolidCore]

I just read (on the Mozilla marketing list) that Firefox 0.9 improperly imports old profile data if you are using the Mac OS X version. This causes a loss of your old profile data.

So if you are using Firefox on Mac OS X, I would not upgrade to the 0.9 version until a new incremental version with a fix for this bug is released.

Update: This loss of profile data only appears to occur if you are migrating from a nightly build that was created between the 0.8 and 0.9 releases to the final 0.9 version. If you are upgrading directly from the 0.8 version to the 0.9 version (on Mac OS X), you should not have this problem.

When writing about errors ...

[jc42]

Well, I have a policy that, when writing about mispellings, I always misspel the word "mispel".

(And it's fun when people attempt to correct me. ;-)

Catch Up?

[Jim_Hawkins]

Well, everybody always says the Open Source movement is always trying to play catch up with proprietary software. This is obviously a case of Mozilla/Firefox feeling left behind by IE's apparent hold on the security flaws market.

[growls]We're coming Microsoft.[growls]

Accent Nazi!!

[wirelessbuzzers]

Yeah. But where is the auto-update feature for Firefox á la Windows XP, OS X, YAST or Up2date?

The French word à is spelled with a grave accent, rather than an acute one. If you're going to spell things like a smartass, at least get them right.

Re:Accent Nazi!!

[plj]

Whoops. Somehow I like to use the "à la" thing, but I actually don't speak or write French, so I've always been able to miss that. Thanks for correction... I'm still going to use that, but hopefully I'll get them right in the future.

OTOH, it seems that there actually is an SW update notifier in FF - but unlike the others claimed here, it can be set to auto-download and install extensions only, for FF itself it is just that - a notifier.

Good solution would be a warning box that would by default appear every time when FF is started without latest security patches installed, and which would tell people that it will go away, when the system is patched.

Where's the patch for 2000?

[Fryth]

So the bug affects Windows 2000? How come the fix on the site is only for XP? I can't seem to run the .xpi file on this 2000 machine.

Re:Where's the patch for 2000?

[Lanzaa]

for FireFox:
1. type "about:config" in your url bar
2. Find "network.protocol-handler.external.shell"
3. Change value to false

Thats all that you need to do to fix it.

Re:Where's the patch for 2000?

[pe1chl]

Maybe you need to login as an administrator.
That would be requiired when your machine has been reasonably secured.

Re:Where's the patch for 2000?

[protoshoggoth]

Except there is no such line by default. So, in about_config, right click to get a context menu, select 'new', select 'boolean' as the value type, name it as specified above, and give it a value of false. Restart Moz. Type about:config again and verify that the shell line is in there with vbs and the rest of them.

Or just run the xpi, although it's nice to know how to check it even if you run the xpi.

Re:Where's the patch for 2000?

[Fryth]

Nah, .xpi wasn't associated with firefox for some reason, but it did work. Thanks.

Re:Where's the patch for 2000?

[pe1chl]

I think this is the normal situation.
Installing a .xpi is done by clicking on a link to the .xpi file on Internet, or by choosing "Open file" inside Mozilla and selecting the .xpi

Re:Firefox pass unknown protocol handlers to the O

[archen]

Here's a fun example of how IE gets it right

That depends. While what you say is true, and it does not execute it also shows a lot about the thinking at MS. Mozilla hands off protocols to windows in a simplistic way because it is not a part of the OS - just as any other program does. IE by contrast has the concept of zones, and each zone has certain things which may be allowed or disallowed depending upon various security levels. This makes the IE security model much more complicated than it should be, and for most people hard to understand. And there has been more than enough problems with IE being confused as to which zone it's in, and enough exploits taking advantage of it.

Mozilla's fix is simple because what it does is simple. I'm not apologizing for the mozilla team here, and in fact I think it's sort of pathetc they just let this problem lay around for 2 years instead of just disabling the shell protocol to begin with. But if IE does anything right, it certainly is NOT the concept of security zones.

Re:Firefox pass unknown protocol handlers to the O

[spitzak]

Damn right. This is a major screwup, and proof that in fact IE does it better than Mozilla should make them act a little more humble next time.

The fact is there are os calls that can write over any user-owned file. And Mozilla can call them (if it couldn't it would have some trouble downloading things or saving the bookmarks!) This does not mean that a hypothetical bug by which Mozilla can be told by a web page to overwrite a file is a bug in the OS because somehow those files should have been protected by the OS. The bug is in Mozilla, which knows exactly where the request came from and is the only program in a position to figure out if it is safe.

ha

[Anonymous Coward]

Still, I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites.

I love how you're making excuses in the post before the non anti MS people can even get to you. Nobody is perfect

you mean after all these

[Anonymous Coward]

years of windows people bragging on the sheer numbers of applications out there, that you lack for absolutely nothing, that there doesn't exist a way to automatically check all your installed applications and update them?

I don't know, don't use windows, I just find it strange that an obvious functional application-checker-updater like that hasn't been written and been released.

How can I disable all external protocols

[MichaelCrawford]

Having looked over the relevant bug reports, I'm extremely uncomfortable allowing mozilla to use ANY external protocols.

Is there some way I can disable them all?

Re:How can I disable all external protocols

[Frank T. Lofaro Jr.]

Unplug the network connection.

Doesn't work...

[mbaudis]

Safari can't open "shell:windows" because Mac OS X doesn't recognize Internet addresses starting with "shell:". Oh, wait...

Re:WTF is an XPI? Super secret instructions requir

[Anonymous Coward]

Thanks!

Unfortunately, I don't see the "Software Installation Window" mentioned (which would have provided the obvious answer in the first place).

Looks like I'll need to do a little poking around to figure out how I get that window to appear. At least now I know what I'm looking for! Many thanks.

Re:WTF is an XPI? Super secret instructions requir

[Anonymous Coward]

Ah! Quickly discovered: I had "Allow web sites to install software" disabled.

XPI files now work smoothly and patch without a problem.

ie vs firefox holes

[smash]

The difference is, this firefox hole was patched immediately - and the public was notified - where's the exploit?

MS try to keep security updates very hush-hush until the latest worm has spread enough for them to be unable to deny it any longer...

Think i'm being harsh? Try reading some security mailing lists... ms policy is to deny the existance of the problem claiming its not exploitable so they won't fix it, until there's a proof of concept or actual exploit in the wild...

smash.

Re:A clear advantage - read the C/C++ specs

[ipfwadm]

int main(void) is valid in C and C++.

No one said

int main(void)

was invalid. main(void) is ENTIRELY different from main(), however. The grandparent is correct; it should be int main(void). (Whether it is mandated by the spec that it can't be main() I don't know, but it's certainly less correct than either main(void) or main(int, char **) ).

MOD PARENT UP

[Anonymous Coward]

This is the best and most extensive summary so far

Re:MOD PARENT UP

[Anonymous Coward]

Mozilla had a remote code execution bug for ***2 years*** and no one fixed it!

They. Didn't. Know. About. It.

For fuck's sake will you guys stop claiming they knew about it for two years? They didn't fucking know about the shell: handler. The two-year old bug relates to the vbscript: handler, which has been disabled for... ooh, here's a coincidence, it's been disabled for about two years!

Re:MOD PARENT UP

[swv3752]

MS said they had already fixed this problem.

Re:MOD PARENT UP

[maximilln]

But they haven't. This is a fully patched, up-to-date WinXP and IE happily follows all shell: links.

Re:Congratulations

[Anonymous Coward]

Ahem, Michael Moore is the Sen. Joe McCarthy of the left, thank you very much!

Good old rush doesn't attack without having at least one solid, inarguable fact.

Re:Shellblock XPI... Works for older FF versions.

[Anonymous Coward]

This also works on v0.8 on Firefox. I went back to 8 after trying out .9.1... but there are just too many graphic related bugs (download box, extensions boxes are often blank, themes screw up and give me a blank bar even though they're "compatible")... and yes, I did install FF into a new directory after uninstalling the old. I think I'll wait for 0.9.5 or whatever.

But yes, older FireFox users should have no problem using the ShellBlock patch... regardless of what some people have said in the forums about compatibility. It simply disables the shell: call as described above.

Oh great,

[chrispycreeme]

now I have to write exploits for TWO different browsers. Damnit!

Hypocritical?

[shplorb]

To all the people talking about how it's hypocritical to say a security flaw like this is no biggie for Mozilla and rant and rave on about a similar flaw in IE, think about this:

* Internet Explorer 6
* Firefox 0.9

Note the difference? Well, if you can't - basically Firefox is still not a 1.0 product - one that's ready to ship, whereas Internet Explorer is up to 6.whatever... one is a product that has been released, the other is still undergoing development.

Plus, the flaw only affects Windows systems, not Mac or Linux or whatever systems so the blame also partly lays with Microsoft.

I rest my case.

Re:Hypocritical?

[timmyf2371]

Presumably it also affects the Netscape browser assuming Netscape is based on Mozilla, and Mozilla is a version 7 browser, IIRC?

Style Nazi/Punctuation Nazi

[Anonymous Coward]

Choice of words is not "grammar".

I think you meant to say "Grammar does not have anything to do with words." Grammar is structure, not presentation, and therefore this statment is true. However, your original statement might suggest that one's particular choice of a word, which involves selecting an adjective or an adverb, has nothing to do with grammar - this is far from true.

If you are going to be pedantic, please put your periods INSIDE the quote! :P

Not Mozilla's Bug? My ass!

[DavidD_CA]

I'm sorry, but all the posting suggesting that this is a Windows bug that was simply inherited by Mozilla is complete crap.

For whatever reason, Windows has a protocol handler called shell. Big deal. Not the issue.

The issue is that the developers of Mozilla who discovered this hole -- way back in 2002 -- decided not to do anything useful about it.

This is no more a "bug" in Windows than is the format command, fdisk, or command prompt. The fact that a browser opened the shell up to a whole world is certainly not Microsoft's fault.

What's next? Someone writes a game that accidentially deletes your My Documents folder, and we blame Mirosoft for allowing that to happen too?

How about blaming Microsoft for allowing senior citizens to be duped by fradulent eBay scams? Let's blame them for Nigerian 419 scams too. Outlook Express should be more secure!

Thanks

[RoboProg]

the mozilla download seemed to be, well, slashdotted.

of course, I'm assuming the patch works, if you remove the space between "...extern" and "al.shell".

Mozilla end user base is smarter

[Evets]

The funny thing is that I'm sure most mozilla users clicked on the link and updated their machines. Whereas if this was an IE report, at least half the users would have just accepted the security hole and waited for windows update to fix it (if they even run windows update).

Simple Solution

[Evets]

I see arguing about black and white lists and whether or not Mozilla should pass of requests for URI's it does not know about...

Why not implement a preferences option that says:
Pass off URI handling to the OS for protocols unknown to Mozilla ?

Then you can implement a black list AND a white list and let the user decide.

Black List = Allow Everything BUT these to pass to the OS
White List = Only allow these to pass to the OS

Spend a week and a half amongst developers what the Default option would be, and release the code. Maybe even set up a site with an FAQ and a listing of URI protocols.

Moreover I would stipulate the following...

[Ayanami Rei]

I don't really see how the shell URL handler is useful anyway. You can probably remove it (or rename it, if you don't want to permanently change the system in a way you can't back out of).

As always, go into HKEY_CLASSES_ROOT, find the lone entry called "Shell" and just rename it. Maybe to shell_something.

Mozilla won't hand it off anymore, because it won't find the shell: handler as provided by XP.

Is there anything that breaks after this permanent fix?

Re:Moreover I would stipulate the following...

[Anonymous Coward]

But then won't shell_something: do the same thing? Sounds like security through obscurity.

opera solution

[Anonymous Coward]

Opera allows one to pass various schemes onto the system however one needs to decide explicitly to do so. I personally don't want all explicit schemes to be disabled unless there is an easy enabling mechanism, given that I have written my own protocols that I want to interact with from the browser, and which I don't want to have to put in the time and effort to learn how to extend each browser to work with a custom protocol.

Why this is more Microsoft's fault than Mozilla's

[dolphinling]

There are two programs: one is the OS, the other is a user program, connected to the internet. There are four possibilities for (this part of) how they interact:

Neither of them checks to see if the input is coming from a trusted source Obviously bad, as was the case here Just the user program checks to see if the data is trusted Provides the security, but means this has to be implemented in every single user program Just the OS checks to see if the input is trusted Provides security, and only needs to be implemented once Both the OS and the user program check to see if the input is trusted Redundant, though arguably more secure

If you're paranoid, you should have both of them check to see if the data is trusted, otherwise just the OS should check.

My diagnosis is that this is a severe bug in Windows and is Microsoft's fault, however, since it was there, Mozilla should have blocked it from showing up.

The fact that once they realized it could be a problem they did block it is only a good thing.

Hypocritical? Yes!

[Anonymous Coward]

Everyone here touts all the Moz products are drop-in replacements to all the MS stuff and demands that we all use it. To suggest that it is now not ready for prime-time is not only a complete reversal of what everyone is saying, it is indeed hypocritical.

To suggest it is Microsoft's fault shows not only a uninformed bigoted opinion, it also shows ignorance. If you actually read the report, it was based on how Firefox uses shell in Windows. Name one other Windows platform software that is affected by the same issue. NONE! Why can't you just admit that the Mozilla developers goofed on this one and get over it? At least it doesn't get a weekly vulnerability each week like MSIE does.

Case closed, idiot.

Re:Firefox pass unknown protocol handlers to the O

[TheLink]

"Take the URI file:///c:/windows/system32/mspaint.exe Type it into the Address bar of IE - it works. Toss it into a webpage on the local machine and click on it - it works"

Doesn't work on mine. I see VERY few good reasons to need to be able to launch/download applications (or download fonts and run active script etc) from a local html page and thus I have disabled those options in the My Computer zone. I've also set things up so that copying and pasting gives me a prompt too.

Change the Flags to 1 in
HKEY_CURRENT_USER\Software\Microsoft\Windows\C urre ntVersion\Internet Settings\Zones\0

And the My Computer zone becomes configurable.

However do note that windows explorer seems to rely on activex or active scripting IF you are not using the classic view.

mozilla still wins

[Anonymous Coward]

yada yada yada. Just install the patch and mozilla's still great. The more people who use mozilla-especially developers-the more people who can fix bugs. That's the best reason why mozilla is more secure-it gets better as more work on it. Imagine thousands of people not just reporting bugs but also with the ability to fix them? That's something even Microsoft with its billions of $ simply can't compete with. And the modularity and extension features of Firefox means it can evolve and benefit from such parallelism even faster than before. Small design team, thousands of maintainers:that's the key to success.

arielb

plugins vs. ActiveX ?

[Anonymous Coward]

This really isn't any different than plugins, which are in a sense, external protocol handlers. i.e. they know how to handle certain content...just like a protocol handler. What if there is an exploit in a plugin? Mozilla just starts the plugin with the listed parameters and lets it go. Are you going to blame Mozilla for allowing the plugin to run, or are you going to require that Mozilla not allow "known, dangerous plugins" to run?

Umm. How does this differ from IE running malicious ActiveX-components, which is considered to be one of the major security flaws in IE?

So, MS is bashed for having a bad security model since IE can run all sorts of bad code without user knowing it. If Mozilla does the same thing, it's again MS's fault? Come on... this smells like double standards to me. One standard for the mean, mean Microsoft, and another one for the good guys of open source.

This particular flaw may be in the Windows, but based on your explanation the security model of Mozilla doesn't seem any better to me than the one implemented in IE.

j. tap-dancing christ, no more arbitrary handlers!

[Anonymous Coward]

Why is there this fucking irritating obsession among browser developers with by default handling, delegating, or randomly processing xyz:// URLs that neither I nor the majority of the browsing public have ever cared about.

When I download a WEB browser, I expect by default to be able to browse the web. That means, to me at least, http: and https:. If I want to enable anything else (and I'm going to go a long way here by possibly permitting ftp: by default...) I want it to be because I have enabled it. Hell, I don't even want possible exploits through the browser being able to examine (by default) the local file system via file:.

Fuck Windows with its happy "universal-everything-handler" URLs. My kitchen sink doesn't start freezing its water when it's decided that actually, I put the meat in there to keep cool, not to defrost. Please give me a prize for stupidest analogy of the day, but you know what I mean. Right, 9am, time work.

Alerts before launching external apps

[Anonymous Coward]

You speak about this bug
http://bugzilla.mozilla.org/show_bug.cgi?id=1 67473
Vote it, fix it!

Re:Alerts before launching external apps

[TRACK-YOUR-POSITION]

Man, bugzilla is so confusing! They shouldn't even let us see it from Slashdot! Oh, wait...

Re:Propaganda continues

[Anonymous Coward]

Then the points should be argued, not censored. Thanks for playing.

is nonsense.

[Anonymous Coward]

I think, #2 is right approach. Invoking external handlers in is nonsense and should be denied.

See also:
http://bugzilla.mozilla.org/show_bug.cgi?id =229168

IMG SRC="externalprotocol:URL" is nonsense.

[Anonymous Coward]

Of course, I mean this.

Re:IMG SRC="externalprotocol:URL" is nonsense.

[julesh]

I'm afraid I disagree. There are plenty of places where you might want to use this, for instance in order to display content generated by an application that is installed on the user's machine in a web interface. Most such applications currently use IE as their browser, but the ability for them to use Mozilla based browsers is quite important, I think.

Re:IMG SRC="externalprotocol:URL" is nonsense.

[Anonymous Coward]

If you want use generated content from another application, you should use Web services and/or SOAP over HTTP, FTP or another internal protocol. External protocols is for launching applications, not for retrieving data.

See this:
IMG SRC="irc:..."
IMG SRC="mailto:..."
IMG SRC="realaudio:..."
Full nonsense, isn't that so?

Printing, KPrinter

[Anonymous Coward]

GRR. I don't want to know what XPrint is. When do I get print command support back?

The problem is in both

[brainnolo]

While surely this is a Windows bug, as is a normal procedure to pass to the OS the unknown protocols, Mozilla shouldn't really care of rtsp://, mirc://, and what not protocols. There are apps designed to handle that, and they register as helper apps for those protocols, so why Mozilla shouldn't trust them? How would Mozilla ever imagine there was a shell:// protocol? On the other hand it should probably do a white list of common protocols and issue a warning when clicking on an unknown one. If the user is just going to click OK on whatever he see, it becomes user's fault. The white list shouldn't be required, but it is in the moment you interact with components you don't know about. Think if they make a silent work registering for the URIs imaworm:// allowing attackers to do almost anything and the user wouldn't know if he doesn't see any significant slow-down, data loss, until they go on a malicious page. A browser shouldn't really whitelist anything more than http://, ftp://, rtsp:// and mailto. All the others should be user choices

wishful thinking

[rozz]

most of the answers modereated up around here are only wishful thinking .. people just love to fool themselves into "firefox is safer", no matter what ...lets see some samples

-- Still, I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites.
i wont bet a single cent on that ... plus this is like saying : i know i eat approximately the same shit as the other party, but im way better because mine gets no attention.

-- This incident underscores why many use or have switched to Firefox: vulnerabilities discovered and promptly fixed. Not weeks and months from their publication--and not by another vendor--this exploit was addressed by those who have made available Mozilla's code for public scrutiny.
as Microsoft demonstrated in maaaaaaany occasions, IT DOES NOT MATTER how fast you release the patch.

-- This isn't really a fix for a security problem in Mozilla, it's a workaround for a security problem in windows.
it may be so .. but it sounds like : i live in an appartment building and its administrator's fault that any burglar can break into my appartment bare handed... so easy to blame "the other guy"

and so on.. and so on.
going mainstream was not exactly benefic to firefox ... i use it since the first version and this week i got the first pop-up and pop-under windows that somehow managed to slip through firefox' block mechanism ... and now this embarrasing flaw .. sadly, it seems that going mainstream its enough to evaporate the "security" of ANY application.

Re:wishful thinking

[nevets]

I would never say that firefox is secure. Any tool that browses the net with the functionality of a browser will most likely have flaws. But I would say that firefox is more secure than IE for other reasons than just not being as mainstream.

I find that OS fixes are usually safer to add than MS, but I must admit it's been a while since I've used windows and this might have changed. But there was a time that I would add a service patch to NT (that long ago :-) and that patch would add much more than I wanted and actually break things. I gave up on every patch unless I really needed it. Usually with an OS project, you can get a patch or update that only fixes the problems. But, yes they too can cause more problems perhaps, but it is less likely.

I also believe in the more eyes to code the more secure. This number may not be as big as some OS enthusiast say but it still is quite large. I usually browse the code of stuff that I use, either as to see how it works, or to add some new features. And every so often I find a bug and notify the maintainer. This can not happen to priority software so it loses out.

Also, isn't IE not supported as much anymore, since the end of the original browser wars? So the review of code has faded.

But I agree partly with you. Security of any product usually requires the user of the product to keep up to date and aware of problems.

Re:wishful thinking

[rozz]

Security of any product usually requires the user of the product to keep up to date and aware of problems.

i also fully agree with the good old "no user, no cry" .. and i hope bob marley's producer does not have a copyright on that

Re:wishful thinking

[rozz]

btw, my quote is ~english, not jamaican like the original .. "with no users there's no cryin"...
"no woman no cry" seems to have a different meaning for marley.

Why isn't it signed?

[Mark Hood]

They advise you to install an extension to prevent untrusted sites hijacking your browser, and in the window that says 'we do not advise that you install unsigned extensions' it shows you that the extension is unsigned!

Come on Mozilla, get with the program!

Mark

I wish Microsoft would do this...

[prandal]

A one line patch to a default option and the Mozilla Foundation releases complete new builds of its products. That's the right way to go.

I'm still waiting for MDAC 2.8 SP1 incorporating the MS04-003 security patch.

And a Directx 9.0c incorporating MS04-016.

MOD PARENT UP

[pbranes]

Whoever modded parent as a troll was dead wrong. The person is making a valid point about possible hypocrisy on slashdot!! When IE had a remote code execution hole, people said to switch to mozilla. When mozilla had a remote code execution hole, people are now saying, oh its ok, they fixed a 2 year old bug as soon as someone else on the internet found out about it.

Are you guys crazy???!!! Mozilla had a remote code execution bug for ***2 years*** and no one fixed it! And, don't give me that junk about the OS shouldn't take the request so its really MS's fault - what do you think the OS is for?? It's there to execute programs, so of course it will have functionality built into it to execute code. Simply, a web browser should never, ever, ever pass a code execution event off to the OS just because a web site tells it to - that is really dumb! If the browser doesn't know what to do with an event, it should ignore it or give an error, don't just trust it and pass it on to the OS.

playing catch-up with MS

[Anonymous Coward]

that is the tale of open source developers...

Re:playing catch-up with MS

[nevets]

Ah, do you mean by adding more security flaws to the browser? :-)

OT: mozilla support for exchange servers!

[mt-biker]

This is off-topic, but nonetheless should be of interest to mozilla users who are forced to use Outlook at work. Even more so for people who use linux at work and are forced to access email via Outlook Web Access (sob!).

Mozilla support for exchange servers (without IMAP) looks like it should now be implementable.

Bug 128284

Please vote for this bug if you desperately _desperately_ (like me!) need support for exchange!

Re:Firefox pass unknown protocol handlers to the O

[Anonymous Coward]

it did not sit for 2 years. the correct bug is 250180, which is 2 days old.

What about older versions?

[Anonymous Brave Guy]

I'm still using Moz 1.5 on Windows[1]. I can't find any information about which versions of Moz contain this vulnerability, nor any information about whether the patch provided applies. Given that 1.5 isn't exactly an old version by any real-world standards, it's disappointing that it (and other recent releases apart from the latest) appear to be so poorly supported. Can anyone provide more information for these apps?

[1] This is mostly because I tried to install 1.6 when it was first released, and it irretrievably toasted my e-mail database and profile. FWIW, I'd successfully installed every .x version since 1.1, so I had some clue what I was doing. It was just broken, seriously enough that I will no longer trust updates to the Mozilla tree. I'm now waiting for Firebird/Thunderbird to reach official release, in the hope that tools for migrating Mozilla profiles to those apps will be independent and thoroughly tested.

Re:What about older versions?

[maroberts]

I'd take the time to stay up to date. Moz 1.5 is old enough to be vulnerable.

I've gone from 1.0 to 1.7 without data loss, but my emails are stored on a separate IMAP servers at home and online.

Export your data before upgrading! :-)

Re:What about older versions?

[Anonymous Brave Guy]

Export your data before upgrading! :-)

I did back everything up, which was fortunate since I needed to restore from that backup immediately.

However, my faith in the system is now shaken beyond repair. Upgrade instructions for Mozilla versions have always been pretty useless, and a screw up that spectacular in a straightforward upgrade betrays underlying weaknesses that are scary in any application that I'm going to depend on.

The more scary thing, however, is that the attitude appears to be that "old" versions are not supported. That's a very "open source, update from the CVS tree every night" attitude, but has no place in the real world. Given that this is software with an age best measured in months, that's a fairly serious flaw as far as making it into the mainstream -- most people aren't going to upgrade their Mozilla versions regularly, if at all.

No, I'll wait for Thunderbird/Firefox to hit 1.0 and then move, but I won't upgrade Mozilla again. In the meantime, I'll have to try and work out how to patch this up in 1.5, and if anything serious happens, I'll go back to IE.

Not MS-style at ALL

[gosand]

The speed with which a fix was issued after the general public was made aware of the problem was good ... but the previous activity over the bug (imagine setting the status to WONTFIX for this!!??) smacks of Microsoft-style negligence/lack-of-concern.

Microsoft-style? WTF? I am no fan of MS, but have you ever worked in the software industry? Sweeping bugs under the rug is the way things are done, period. I have been doing QA/Testing for 10 years, and it is like that all over the place.

And I am not necessarily passing judgement on it either, because software development is about mitigating risk. You have to balance all the aspects of software development, you can't fix everything. Here is how sofware projects work: (think of it as a grid)

Optimize Contstrain Accept
Cost
Schedule
Scope
Quality

From the items on the left, you can optimize one, constrain one, and accept the other two. Usually, it is optimize scope, constrain schedule, and accept the cost and quality. But for places like NASA, I am sure it is not like that at all.

This is reality.

Re:Not MS-style at ALL

[shellbeach]

Microsoft-style? WTF? ... Sweeping bugs under the rug is the way things are done, period.

So does that make this practise in an open-source project acceptable?? I don't think so! I'd like to think that mozilla.org had better morals and priorities than a closed-source profit-based software company ...

And the reason I singled out MS is that it makes quite a popular rival browser, for which it has a certain reputation of ignoring reported bugs until they are exploited. And of course it is the designated Evil Empire, so excellent for unsavory comparisons :)

Blocking shell: with squid

[woozlewuzzle]

Anyone know if it is easy enough to block this exploit with squid? (Without blocking articles that mention shell:) We just finished rolling out 0.9.1 and would really like to avoid another rollout so quickly.

Then delete it.

[Ayanami Rei]

What do you want me to tell you? And if you rename it to something obscure, how is an exploit writer going to guess what it is? It has to be put on a website, he'd better make a guess that affects more than one individual...

Let me explain....

[Himring]

No, there is too much. Let me sum up....

From what I'm seeing, two schools are puddling on this: one that claims Moz isn't responsible for handing off a protocol to the OS that it doesn't know what to do with (i.e., MS's fault) and the other claiming Moz should know better to do exactly that -- that if it doesn't know what a protocol is doing it has no business passing it on to the OS (i.e., Moz's fault). From the sound of the upcoming fix, it appears Moz feels the latter to be true, since in the future fix it's going to do exactly that: not just hand off something to the OS unless it meets a specific "white list" instead of what it was doing which was handing off anything to the OS unless it met a specific "black list."

Please forgive my lack of gray matter. They said only the weak cells would die....

No, the problem is Windows.

[Kjella]

Users expect to be able to launch other protocols from a browser. Examples: mailto: , irc: , news: , rtsp: etc etc. The interface provided for this is to pass them to Windows. However, at the same time, there are protocols registered that are not secure - vbscript: , shell: etc. which should never be launched by the browser. The problem is, the interface is exactly the same.

This implies that a browser would have to constantly keep a whitelist/blacklist and would still run into new and unknown protocols. The entire concept is flawed. Give the Mozilla people some way to determine which protocols they should launch and not, and they will follow it. Something like zoning, because it is not Mozillas job to be aware of every protocol on windows, past, present and future.

Kjella

Super advantage

[Anonymous Coward]

After reading the comments on the front page of the update page, I've decided to pull Firefox from our corporate network.

After release, I'll review the decision.

Feel free to read the comments and determine for yourself if this is a sign of enterprise ready software.

Re:Next!

[julesh]

NCSA Mosaic?

I'd avoid it.

I believe it launches downloaded documents without asking for confirmation from the user.

Also, Internet Explorer was based on it. That ain't a good recommendation.

Actually, you ARE your browser. . .

[Fantastic Lad]

See, it's like this. . .

Tools are not just tools. Yes, people are getting rather worked up; in looking over the posts here, I've seen those who are laughing maniacally and pointing and name calling. I've seen others throwing up walls of denial, etc. I mean. . , Wow!

The natural response is to say, "You are not your tools. You are not your clothes. Get over it!"

That's wrong, though. We all know this on an instinctive level!

Everything you do is an expression of who you are. You are what you eat. You are the truths or lies that you take into yourselves and embody, and give power to.

For my part, I like to use the tools which break down least often, and get the job done with the fewest hassles and hangups. But I also want my tools to work in the same spirit that I strive to.

I'm very glad that Mozilla exists. It's not perfect, but the rise from Netscape's original and highly unstable browser has been continual and very positive in many, many respects. It has been a fun and friendly ride! Support is community based and highly effective, rather than a hierarchical and lumbering (and largely ineffectual) system like Microsoft's.

--The best part about Mozilla is how it seems to manage to be almost entirely free of corporate greed and the desire to manipulate people and the welfare of the information universe for selfish purposes. This might change at some point, but at the moment, Mozilla seems to be pretty darned clean. Whereas, the life blood of Microsoft is that of Greed, based on the fear of losing power and control; this taints all they do. Mozilla, and similar projects provide an alternative way, not just a way of programming and making software, but of how to exist. Open-source, community-based software feels nice to use and it does so for a reason. Those are feelings you can trust. Open-source creates and concentrates vast human powers and it does so using a system of collaboration and sharing, and thus no need for Greed as a motivating force. Greed sucks. (Literally!) The opposite is very uplifting, in many ways. Constantly-improving software which is given freely to anybody as it is required. . ? Why do some people hate this so much?

Well, there is an answer to that of course, but none of those who hate Open-Source are able to stand the answer. It's an ugly answer, after all. It's an old division, and it delineates people in very obvious ways. The world is at war right now, on many levels because of those very same forces.

Interestingly, the world in many, many ways is moving unstoppably towards a paradigm based on non-greed, non-selfish shared resources. This will spell the end of centralized power and men like George Bush and all that they represent. The only problem is that there is going to be a massive melt-down as the old, dark structures which make up most of the world collapse under their own morbid weight. We are seeing the beginning of this, and our current masters, sensing that this is coming, are cranking up the controls to increasingly high levels, knowing that if they lose control, they will be ended. They are working from fear, and the conflict is going to kill many of us. It has already started and it is going to get a lot worse. But is a natural process, not one to be feared.

The lesson we all can learn through such simple means as community produced software are far, far more powerful and far-reaching than most people are capable of realizing.

We are literally learning the tools necessary to survive in the coming age.

In my case, I'll continue using my rusty old copy of Win98 until I finally decide to tackle the Linux learning curve and re-acquire all the software I need. (That is, change my library of tools into 'open-source' as opposed to 'pirated'.)

I figure the whole process will probably take about two weeks of screwing around, and another series of hiccups as I settle into the new 'reality'. --After which I'm sure I'd

Not to be a baby but...

[vgaphil]

is there a better/quicker way to install the patch?

Telling my users to go folder X and then double click on file Y would be a lot nicer than having to go to all their machines.

Yes, I know, it's not at 1.0 yet. It's just constructive criticism.

A disappointing performance by the community

[vls]

The Mozilla team and some of the posters, should be embarrased by the attitudes displayed here and in the bugzilla threads when this was repoted back in **September**. I recently recommended Firefox to my parents, but now I think that was premature. The team doesn't have protecting my parents in mind.

Several things were missing from the response:

* The charge to protect regular, unsophisticated users. Regular users do not care whose fault a wide open security hole is. They only care whether they are safe when they are acting reasonably. In this case they weren't, but the team was ok with that for months.

* Security without usability is like a parachute you are not wearing. The Register article was the easiest way of finding the advisory and fix, imho. 1) Back in September, how did the team think I was supposed to know to disable shell: scripting? ESP? Reading all of bugzilla? 2) Where in fact would I have done this? Certainly nothing easy to find. 3) Even today, where is the super prominent link on the home page? Why does the home page (http://www.mozilla.org/products/firefox/)link to the 1.9.1 page, not the 1.9.2 page?

* Put products before the blame game. Why should mozilla not be embarrassed? There's a known hole in windows, that is only a problem when an untrusted source has a channel to access it. Mozilla provides that channel. Again, from a user perspective, who cares?

The community has lost a lot of trust with me today. Looks like a team that is no longer ready for prime-time.

Re:A disappointing performance by the community

[maximilln]

The community has lost a lot of trust with me today. Looks like a team that is no longer ready for prime-time

Who do you blame when someone finds a remote code vuln in the default application for ftp://? There was a media stream protocol, I forget what it is... who do you blame when there's a remote code exploit in your favorite media player? How is this different from clicking on an .mp3 which has been specifically crafted to make use of an exploit in your favorite media player?

Mozilla isn't doing anything that it's not supposed to do. Incidentally, I haven't heard anything from MS about this and IE happily submits to all "shell:" links without even a hiccup.

MISLEADING TITLE (IS WINDOWS ONLY)

[Anonymous Coward]

the bug is on windows only versions of mozilla/firefox/thunderbird.
other operating systems aren't affected

The theory that: No App. is secure......

[MagicBox]

.....is yet again stregthened.
Replace for a second all IE installations with Mozilla in your mind. Can anyone see the impact of this *small* glitch?
Which is why the old age theory that if you are highly visible, you'll also be a primary target still stands strong. You'll have to fend off relentlesly those who want to break you.....and like Troy, someone with Achilles smarts will find a way to breach your walls. Does that make you dumb? Incompetent? Uncaring? Recless coder? Not at all. It's just that the more you get attacked...the better you build your walls.....or else, you'd just stick with a fence to keep the sheep away from shitting in your yard. I think holes like this can and should be expected as other versions of browsers start to become significant in their relevant markets. Welcome, and please take a moment to analyze the pain MS has been going through for a long time now. Popularity does come with a price. I am a Mozilla and Opera user. I like both browsers. But I never slept on the fact that they are *100% secure* and I had nothing to worry about. The question running thorugh my mind was: When? When will someone find a hole. And how well prepared is the Mozilla team to handle it? Fix it. Let me update it. And get me on my way. I want them to be the Ferrari pit stop team....and I am their Schumacer. In retrospcet...a fix will do however. I also stand by the fact that we do not know software deeply enough to built it bullet proof. The art of 1 and 0 is far more complicated to understand, work with and perfect than it might seem. Only when we've perfected the way to test what we build will we be able to perfect writing good software. Buildings and railway tracks for example are checked inch by inch by live human engineers, which is why they (almost never) fail. In the software world we don't have the ability to send a human at a port entrance and examine each 1 and 0 that comes in a goes out. We have (already buggy) software that does that. So we go back to step 1. In time it'll all get better.....but now is definitely not that time.

Take a minute: educate a reporter!

[roj3]

I'm not sure how many of you read the story on CNET, but we need your help to get that story and any others, updated.
We can not allow reporters to simply throw Mozilla in the heap with IE -- any mention of similarities must fairly address the significant differences.

For example (my CNET feedback)
Hi John, Rob;
Since you are drawing similarities between the security exploits of Mozilla and IE ("Like recent Internet Explorer vulnerabilities...") you need to fairly and specifically address the differences between the way the Mozilla Foundation and Microsoft have issued security patches.

• Microsoft's was incomplete and days after widespread reporting of the flaw.
• Mozilla's was complete and nearly instantaneous.

Please don't lead your readers to think that Mozilla and IE are more similar than different.
Thanks for your consideration.

Name City, State

Re:Congratulations

[rd_syringe]

Tell me you're kidding. Do you even read Slashdot? If you believe what the majority here says, all OSS is infallible. Hell, that whole "many eyes" factor should have come into play here and the hole should have never existed. Right?

Simpler fix

[dreadyco]

Instead of installing the extension, you could instead do this:

1. Open the Javscript Console
2. Copy the following line-by-line into the textbox (hitting enter after each line):
   
   var prefs = Components.classes[ "@mozilla.org/preferences-service;1" ] .getService() .QueryInterface( Components.interfaces.nsIPrefBranch );
   prefs.setBoolPref( "network.protocol-handler.external.shell", false );
   prefs.getBoolPref( "network.protocol-handler.external.shell" );
   

Note:

1. You shouldn't need to restart, it will be saved the next time you do, but the effect is immediate.
2. There are only 3 lines above, slashdot breaks the first line apart.
3. You should see a false after evaluating the 3rd line.
4. If you run into any trouble, start again from above.
5. If you have trouble with the slashdot-munged code above, go to my blog and copy it from the textarea.

Re:No problem for that other alternative browser..

[Anonymous Coward]

Not that this example was especially worrying imho: you'd still have to be tricked to visit a specific website that plans to harm you. Not that likely unless you to tend to visit the bowels of the web...

You mean like [img src="shell:...] in a spam e-mail?

Security model

[phorm]

Yes, but when you know that the security model for windows isn't by definition as secure as linux... you should code around that concept.

Coding an application for windows Vs coding an app for linux is different. Privilege seperation is one issue, and there are many others. Just because you are coding an application that works similarly on both doesn't mean that they have to be exactly the same, because the operating environment isn't.

Re:Security model

[FireFury03]

I really don't see what the Mozilla team could have done differently - the OS provides a mechanism for finding a program that knows how to handle a given URI (i.e. if I go to rtsp://foo it'll fire up RealPlayer). By it's very nature that mechanism needs to be secure. The only thing they can do is filter the URIs to reject known bad ones before handing it to the OS... except that involves knowing which are bad, which they didn't do until this bug was reported. And after the bug was reported they fixed the problem *immediately*.

I'm sorry, but if you cannot trust the OS you're running on to do things securely then you're screwed anyway since you would have to replace *ALL* the OS functions with your own. If you don't trust the OS then similarly you can't trust fundamental functions like malloc() - how do you know it's not going to allocate you some memory that has already been allocated to a more privalidged process?

Working around broken software is one thing, but working around a broken OS isn't possible - it's like putting a very expensive and un-pickable lock on the front door of a ground floor flat when all the windows are missing anyway.

No prominent notice on Mozilla/Firefox home page

[theshowmecanuck]

Mozilla should make their security bulletins more prominent on their web site. Near the top. It is not even there on their firefox page, which I use as my home page. I only found out about it today.

It is nice that the patch is available already.

Re:Congratulations

[Anonymous Coward]

RTFP. The parent didn't claim that the minority of OSS people and fanboys accept that OSS isn't infallible. They said that the OSS COMMUNITY doesn't follow that way of thinking. They work on their projects and try to improve on them, not sit back and claim the bugs are features.

Re:A clear advantage - read the C/C++ specs

[Old Wolf]

I was replying to an AC, maybe it's below your threshold. He said "int main() is invalid, it should be int main(int argc, char **argv)". Obviously implying that it should not be int main(void) either.

I was pointing out that int main(void) is valid and equally preferable to the longer version, in the eyes of the standard (in the eyes of me, the short version is preferable if you do not intend to use commandline arguments).

Secure by default!

[DragonHawk]

"the only thing I see at this point is that they need to start maintaining a black list of protocol schemes"

Arggh! No! They (the Mozilla developers) should assume everything external is dangerous, because they have no control over it. Mozilla should prompt the user with a variation on the same "Save/Open/Cancel" dialog they use for other external handlers. That way, the user has to take a very specific action to invoke an external handler.

This doesn't solve the problem of stupid users (who will open anything), of course, but that is not a Mozilla problem.

Where does Windoze ask this?

[DragonHawk]

"this is the way the OS asks applications to behave"

Where does Windoze ask that applications should run anything they find, from any source, any way they can figure out how, without asking the user first?

It must be the same place that Linux asks applications to run anything they can find in the /etc/mailcap without asking first. (BTW, Mozilla does not do that, because it would be dangerous. What a concept.)

And a URL should be blindly trusted?

[DragonHawk]

"This is not an executable, it's an URL (or at least it looks like one), and Windows is supposed to handle it as an URL."

I don't see anything anywhere that says "URLs are always safe". Please point me to the section of some document where that is claimed.

"An URL firefox doesn't understand could be news: - and calling Windows' URL-handler is supposed to open the news reader."

Right. And I don't want Mozilla opening any external program without asking first, unless I've explictly told it to do so. Period. It doesn't do that on *nix; why does it do that on *doze?

Alas, fixing took way too long

[DragonHawk]

"The fact that once they realized it could be a problem they did block it is only a good thing."

Unfortunately, it appears it took Mozilla at least two years to fix this problem.

See my comment here for details.

Care to back up your claims?

[DragonHawk]

"you're not differentiating between a protocol handler and /bin/sh... this is just silly."

You are required to do more then just say "this is just silly" before one can reasonably say you have submitted sufficient evidence to justify an argument.

What is the difference between a "protocol handler" and a "script interpreter" in this discussion? Both are programs which handle data Mozilla could not otherwise handle. Both are external to Mozilla. Both are provided by the host OS. Both can be matched to data using facilities provided by the host OS. Neither should be blindly trusted with untrusted input.

What is the difference between the "URI scheme registry" and "/etc/mailcap" in this discussion? Both are a central location where external mechanisms can be looked up. Both are provided by the host OS. Neither should be blindly used with untrusted input.

If your only proof-point is to say "this is just silly", I can only conclude you are arguing from emotion rather then logic. I'd like to blame this on Microsoft incompetence, too. But the fact of the matter is, there is/was a security exposure in Mozilla.

Re:Care to back up your claims?

[scenic]

sigh... OK, you're right, I'm just arguing from emotion.

Sujal

If you have point, make it

[DragonHawk]

"sigh... OK, you're right, I'm just arguing from emotion."

Look, do you have a point to make, or not? You keep asserting there is some fundamental difference between the *doze and *nix features I am describing, but don't detail what those differences are. I list what I think are critical similarities, and you tell my I'm silly. Maybe I am, but that's not the subject under discussion. If you honestly believe what you say, I expect you to back it up. Maybe you've got some angle or data-point I haven't considered. Something that might change my mind. However, I am unlikely to change my mind based solely on the fact that you think I'm silly.

Re:If you have point, make it

[scenic]

You're missing the point. In either case, I don't think there is a problem.... /etc/mailcap or the registry system. GNOME uses this same type of feature, KDE does, Windows, OS X, etc. The point you're missing is that no other OS installs a "run any program the remote host specifies" protocol handler. That is the problem, not the integration. This problem doesn't exist on other platforms because they don't register a shell: protocol that can execute anything.

Unless you're arguing that no OS should have this kind of integration (associating a program/helper for a URL scheme)... All you've said is that the user should be prompted... except no user wants to be prompted. Furthermore, it doesn't actually change any of the underlying code. If you want a user validation in between with a "always remember my choice" checkbox, great.

Still don't understand why we need a shell: handler.

the silly part is, btw, that your entire security flaw is that there isn't a prompt. You don't see anything wrong or different in the fact that a URL doesn't tell the OS what code to run... In other words, a remote site doesn't really know what's going to happen on the client computer. Except with the shell: handler.

But whatever, you clearly think it's a bug in Moz, and I honestly don't care anymore. I'm not on Windows, and I think the integration is fine. I don't understand why shell: is actually runs a program (shouldn't you have to do something like run(file://path/to/executable) ? ) I'm waiting for an exploitable bug in Flash... then you'll argue that plugins should prompt the user before they run...

Re:Firefox pass unknown protocol handlers to the O

[rjstanford]

Mozilla hands off protocols to windows in a simplistic way because it is not a part of the OS - just as any other program does.

Ah, but the difference is that Mozilla isn't taking protocols that, say, the user has entered when looking up a file, or URIs that were generated at compile-time - but rather, URIs that were pulled randomly from the 'net. Very few other programs do that, and that's the key difference here.

i'll say it again

[Dr.Knackerator]

Excellent, an exploit fix in double quick time. But as Windows proves over and over again, the dumb users just don't install the patches. the bad dooods aren't targetting these open source products yet because they are in the minority (and potentially owned by 'power users'). when/if they get market saturation like windows/ie they *will* target these OS products and becuase (l)users will still be dumb I don't think we will be in any better situation. I mean come on the average joe is still moronic enough to give out their bank details as a security check over the phone if the 'bank' phones them up (instead of asking which department they are calling from then calling the bank on a number you know and asking for the department). so what chance has software updated got?

Re:What moron put in "shell:"? M$ did.

[twitter]

And it Nailed Word too. Ha Ha Ha. Why don't people run Word in a jail? They do, the best way to run Windoze is in a virtual machine, better still not at all.

Re:Congratulations

[Anonymous Coward]

He knew what it meant. He was just making a point.

Congratulations

[maroberts]

In backing everything up.

I wouldn't really regard it as the case that old versions are not supported; its a simple statement that you should use the latest stable milestone, which fixes all major issues known at that stage.

Take, in comparison MS IE. It also does not support patches to every single version, but encourages upgrade to at least major milestones rather than intermediate ones.

Moz introduces new features in new releases, but its also a bugfix release at the same time, and it is a reflection of the fact the software has not got to the same version level as IE. However, I'm sure you've noticed Windows Update still gives you an IE related patch as often, if not more, than Moz gives you a formal update...

Should emphasise at this point I'm not truly anti IE, but I can't live without tabbed browsing, popup blocking, a less vulnerable email client...... :-)

Re:Congratulations

[Anonymous Brave Guy]

I wouldn't really regard it as the case that old versions are not supported; its a simple statement that you should use the latest stable milestone, which fixes all major issues known at that stage. [...] However, I'm sure you've noticed Windows Update still gives you an IE related patch as often, if not more, than Moz gives you a formal update...

That's true, of course, but the point here is that Windows Update does give them to me for IE. Even if I'm not using the most up-to-date version, I still get patches for critical vulnerabilities, and they still get sent to my notifications tray automatically if Windows Update is on.

My objection here is that, as a Mozilla 1.5 user, I couldn't find any information on whether this vulnerability affected me (aside from a one-liner I eventually found deep within Mozilla's site that said "versions up to 1.7") or any information at all on what I needed to do to fix it in 1.5. As a programmer, I can extrapolate from the descriptions I have seen, but none of this would help Joe Family-Member who I'd convinced to switch to Moz when 1.5 was current.

Should emphasise at this point I'm not truly anti IE, but I can't live without tabbed browsing, popup blocking, a less vulnerable email client...... :-)

I like them too; that's why I use Mozilla. And for the avoidance of doubt, I think the dev team on the whole do a great job, and I'm grateful for their efforts. I've just seen them drop the ball in a Very Bad Way twice too often now -- once to stop me upgrading, and again in apparently not supporting the "old" version -- and I'm starting to get worried. As a geek, I can understand that, and tolerate it. It's just a shame for the mainstream, because it reduces what should be a superior solution to the level of IE/Outlook.

Opera

[exeel]

Well, opera use the whitelisting, i just tryed the exploit on my friends pc (thats right, i have one), and he is using opera on 2k (he wont install linux the fool), and it reported shell as unknown, thus the whitelisting claim i made earlier.

Not safe on Unix so they trust it on Windows??

[billstewart]

You wouldn't allow an uncontrolled remote arbitrary command execution on a Unix system just in case the executor wanted to trash the user's files or knew about a r00t hole. And that's on Unix, where there's some semblance of security, even though root-capable bugs do show up on occasion - "rm -rf $HOME" is almost as nasty for the average user as "rm -rf /", since most of the rest can be reconstructed from your favorite Linux distro disk.

So WHY the [expletive deleted in compliance with new FCC rules] would Mozilla's developers allow it on Windows? _Do_ they also allow it on Linux, or is it _only_ on Windows? Why didn't the Mozilla users community notice it earlier? When was it added?

That's why it's a Mozilla bug

[billstewart]

It's a design bug, not just an implementation bug. A feature that lets a web page specify an arbitrary command for the browser to tell the operating system to execute is rabidly dangerous on just about any operating system, except possibly for a few researchy capability-based OSs like EROS and KeyKOS. A feature that hands commands to the shell to execure on Linux would be obviously ravingly stupid, unless you _like_ "rm -rf $HOME" -- so the idea that anybody would even dream of doing it on Windows is far worse.

Do you know it only affects Windows? If Mozilla is handing unrecognized commands to an operating system's native command interpreter to do things with, then it's a dangerous Mozilla bug, unless the people who wrote it knew the OS couldn't do anything dangerous with it, and face it, nobody'd say that about Windows and keep a straight face. If it only affects Windows and not Unix-like OSs, that's because the syntax for handing commands to the operating system's command interpreter is different on the different OSs and they either were too lazy to write it for Unix once they'd done it for Windows, or else the Unix maintainers had more sense, but not quite enough sense to realize that it had been done for Windows.

Go away until you can spell "r00tkit" and "affect"...