Firefox 0.10.1 Released, Fixes Security Hole

done already! by tuggy · 2004-10-02 01:42 · Score: 5, Informative

upgrade done in 3 seconds!
this is what i call being secured :D

Re:done already! by tuggy · 2004-10-02 01:49 · Score: 5, Insightful

it sure means something!
its very different to have an exploit in the wild and be able to prevent it in 3 seconds, or waiting 1,2..10 weeks for a fix
Re:done already! by distributed · 2004-10-02 01:51 · Score: 2, Insightful

wow.. no shit ! it actually took just 3 seconds..

I wonder what IE can do about this...
The windows update site takes a hell of a time to load and then scan @ a snails pace.

And live feeds are simply amazing... thats how i check slashdot now, and cot this post.

great work guys.

--
[all generalizations are untrue except this one]
Re:done already! by panamahank · 2004-10-02 02:06 · Score: 2, Funny

It seems to me an upgrade all the way to V1.0 would be the right way to go. Isn't V0.10.0 pretty damned old?
BTW, I tried to follow the upgrade instructions, but apparently the exploit doesn't affect the Linux version, so you folks might want to consider an OS upgrade while you're at it.

--
Serial Meta Moderator
Re:done already! by Epistax · 2004-10-02 02:06 · Score: 5, Funny

I must admit I/it fumbled. I went to the mozilla website as posted in the subject and hit the "click here". What happened? A funny bar appeared near the top saying that Firefox protected me from the website. Luckily there was an options button which allowed me to add www.mozilla .org as a trusted site and it was all very obvious to me, but it won't be obvious for my parents (who I switched to Firefox).
Re:done already! by scat-cat · 2004-10-02 02:21 · Score: 3, Informative

It stopped a popup. The bar alerts you so that you can allow popups from the sites you want.
Re:done already! by Epistax · 2004-10-02 02:24 · Score: 3, Interesting

I don't believe it was that message. This appeared as a bar at the top which stated (loosely) that it prevented the website from running... something or other. I don't have it inform me in any way when it blocks a popup. Anyway it had an options button which had a list of trusted sites. update.mozilla .org was already on the list, however the link originated from www.mozilla .org so it wasn't picked up. I would say they should add that site to the list.
Re:done already! by XMyth · 2004-10-02 02:56 · Score: 2, Funny

Hey! What the hell is wrong with you? Don't listen to Mozilla! Listen to the Slashdot poster, dumbass.

Seriously though, I didn't have the problem you stated...I wonder what caused it and why it affected you and not me? It happened as soon as you clicked the link or when you tried to update? If it was when you tried to update, did you ever alter the list of sites that Firefox can install software from?
Re:done already! by jd142 · 2004-10-02 03:00 · Score: 3, Informative

Apparently software version numbers don't work like "real" numbers. ;) In other words, those aren't decimal places, their merely dividers. .1 is not equal to .10. The order goes .1, .2, .3, .4, .5, .6, .7, .8, .9, .10, .11. 0.10.0 came out about 2 weeks ago.
Re:done already! by Epistax · 2004-10-02 03:06 · Score: 2, Informative

If you go to Tools, Options, Web Features and 'Allowed Sites' next to "Allow websites to install software" you will get a list. By default this list only contained update.mozilla .org, and not www.mozilla .org, so when I hit the link in the subject of this topic I followed the "click here" on the next page to install the patch. That page was on www.mozilla .org, not update.mozilla .org. Incidentally that link took me to http://ftp.mozilla .org/pub/mozilla.org/firefox/releases/0.10.1/patch es/259708.xpi which I have not added to my accepted software install list, yet it didn't have a problem with doing it. It seems only to care about where the originating link is, and not to where it points.
Re:done already! by ricotest · 2004-10-02 03:08 · Score: 2, Informative

I must be the only one who realises Windows Update has the exact same system. It shows up an icon, downloads the updates, asks you to install them, and they get installed.

Maybe slightly more than three seconds but just as painless...

Same goes with Gentoo and Debian package systems, if you add a cronjob to do it.
Re:done already! by rainman_bc · 2004-10-02 04:03 · Score: 2, Interesting

Bit OT but...

I was just over at a friend's place and made the pitch for FF... The response I got? "But I LIKE Internet Explorer". Touch pitch. She liked clicking on the blue "e" to surf the web instead of that strange FF logo.

I've switched a tonne of people already though. Many more comverts on the way. The campaign for FF is on!

--
09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0
Re:done already! by the_quark · 2004-10-02 04:04 · Score: 2, Insightful

Well, and except with Firefox update, I got this update late last night when it notified me of it - and this was the first anyone had heard of the problem. When was the last time we found out about a flaw in IE because Windows released a patch to fix it (as opposed to finally releasing a patch after six months of badgering)? Kudos to the Mozilla team for working proactively to fix this instead of hoping no one would notice or care.
Re:done already! by ZeroPost · 2004-10-02 04:22 · Score: 4, Informative

To be fair, Windows Update scans for updates to a lot more software than Firefox.

Firefox can scan a lot faster than Windows Update because it is only checking for updates to a single program.

Of course, Microsoft could make an option within IE to scan for IE-only updates, which would make updating IE much faster, but they don't.
Re:done already! by boredMDer · 2004-10-02 05:03 · Score: 2, Informative

http://boredmder.com.nyud.net:8090/~pmohr/images/s mart%20firefox.png
Re:done already! by Feztaa · 2004-10-02 05:30 · Score: 2, Informative

1.0PR is definitely a high quality release, I would suggest you try it. Many bugs that bothered me in 0.9.3 have been fixed.

But, the name "1.0PR" is purely a marketing thing. The actual version number is 0.10, as you can see in the "Help -> About Firefox" screen where it says this:

"Firefox version 1.0 preview release"

followed by:

"Mozilla/5.0 (X11; U; Linux i686; rv:1.7.3) Gecko/20040914 Firefox/0.10.1"

That about sealed the deal there. The HTTP_USERAGENT string says 0.10.1, but the fancy-schmancy title says 1.0PR. That tells me, basically, 0.10 is the actual technical version number, "1.0PR" is marketing fluff.
Re:done already! by badmonkey · 2004-10-02 05:31 · Score: 2

Dude, Firefox has been kicking IE's ass all over the internet since like 0.7- take the leap already.
Re:done already! by LnxAddct · 2004-10-02 05:50 · Score: 2

The devil is in the details... to quote myself, "some of the updates aren't applied until you reboot your machine", keyword some. This guy claimed to regularly run windows update, apply all the patches and never had to reboot in 2 months. It's complete bullshit and thats all I was really pointing out. I admin a medium sized network of windows machines and I *know* that some of the updates in the past 2 months have required a reboot. I do prefer linux, and use it whenever I'm not at work, but I'm certainly not clueless about Windows and this guy's claim was just absurd.
Regards,
Steve
Re:done already! by The+Snowman · 2004-10-02 06:34 · Score: 3, Funny

Of course, Microsoft could make an option within IE to scan for IE-only updates, which would make updating IE much faster, but they don't.

What is the point? Since IE is integrated into the operating system, updates require reboots even under Windows XP which is a lot better with regards to rebooting than previous versions. Anyway, even if the actual update is faster, you would still have to wait for the reboot.

I just updated Firefox in less than ten seconds, and I did not have to restart the browser, certainly not the entire operating system (Windows XP in this case).

--
24 beers in a case, 24 hours in a day. Coincidence? I think not!
Re:done already! by Feztaa · 2004-10-02 07:03 · Score: 2, Funny

Well, she never uses bookmarks or favorites. Only what I give to her on the link toolbar (both IE and mozilla have it in the same place, so she didn't really notice the change).

As for the icons, well, it says "Mozilla" in the titlebar and she hasn't noticed that, either. I could probably give her firefox with a mozilla theme and she wouldn't notice. If she asks I'll just say there was an important system update or something.
Re:done already! by AstroDrabb · 2004-10-02 14:00 · Score: 4, Informative

The update thingy also tells me that 1.0 PR is available and I should download it. The only problem is that I am already running 1.0 PR
Not the latest version. If you look at your User Agent (click Help -> About Mozilla Firefox), you will see Firefox/0.10 at the end of your UA. If you go and download the latest version that includes this fix, the new UA will be Firefox/0.10.1.
I ran into this same problem with the update under Linux. MS Windows users won't run into it since they are running as local Admin or have write permissions to the firefox directory. When I ran it as root, it worked fine so I take it the update needs to write to the root firefox directory it probably then updates your firefox profile. As a normal user you cannot run the update and it never writes to your profile. I think it was just a poor update design for this one update. Hopefully the firefox team will fix it or fix this issue for future updates.
You could grab the latest firefox tarball from here and just untar it into your current firefox installation folder and restart.

--
If Tyranny and Oppression come to this land,
it will be in the guise of fighting a foreign enemy. -James Madison

This may sound stupid... by -kertrats- · 2004-10-02 01:43 · Score: 5, Interesting

But what exactly is the worry here? It deletes files in your download directory? Does that really matter? Could someone enlighten me on why its worth the bother to uninstall and reinstall for this?

--
The Braying and Neighing of Barnyard Animals Follows.

Re:This may sound stupid... by neodude88 · 2004-10-02 01:45 · Score: 5, Insightful

Maybe because you don't need to reinstall to upgrade to this patch? Just update.
Re:This may sound stupid... by rixdaffy · 2004-10-02 01:46 · Score: 3, Funny

well, it would be quite frustrating if your download directory is your Desktop, homedirectory or any other place where you keep other files too.
not to mention all the pron you have to download again :-) j/k

Ricardo.
Re:This may sound stupid... by dwhitman · 2004-10-02 01:51 · Score: 4, Informative

But what exactly is the worry here? It deletes files in your download directory? Does that really matter? Could someone enlighten me on why its worth the bother to uninstall and reinstall for this?
1. Suppose your download directory isn't dedicated to just downloads. Any files in that directory are vulnerable.
2. You don't need to uninstall and reinstall. As the article says, just go to tools: options: advanced: software updates and hit the Check Now button
Re:This may sound stupid... by LurkerXXX · 2004-10-02 01:57 · Score: 5, Funny

Does it matter? My pr0n! All my precious pr0n!!!
Re:This may sound stupid... by compwizrd · 2004-10-02 01:59 · Score: 4, Informative

because firefox on windows uses the Desktop as the default download location.
Re:This may sound stupid... by Transcendent · 2004-10-02 02:48 · Score: 2, Funny

But what exactly is the worry here? It deletes files in your download directory? Does that really matter?

...you don't download to C:\, do you?
Re:This may sound stupid... by igrp · 2004-10-02 03:01 · Score: 4, Insightful

Others have pointed out that some users may use ~ or their desktop as their download directory. That may not be a smart thing to do but that's really beside the point.
Any vulnerability that allows remote users to alter content is by definition critical. It doesn't matter if you think it's a big deal. There should be no unauthorized access to files, period.
Your non-critical files aren't 777, are they? Now why is that? Well, despite the fact that data is non-critical, recoverable or maybe even pure gargabe you still wouldn't want people to mess with it, would you?
Think about it: you probably have a lots of old stuff, bank statements and what not somewhere. That data is useless to me (value == 0). By your logic, I could just throw it all out since it doesn't matter to me. It may still be valueable to you though. And even if it weren't, you still probably wouldn't appreciate me going through your stuff and tossing whatever I don't deem important.
See, all attacks that allow any access control circumvention at all are critical. Just because it's not critical to you, doesn't mean every feels the same way.
That's why disclosing the vulnerability and making an update available ASAP was a very good move on part of the fine folks at Mozilla. I just wish there was a mechanism to do manual network-wide mass roll-outs of critical updates (ie. rolling out critical updates immediately without having to wait for Firefox's periodical checks).
Re:This may sound stupid... by cyfer2000 · 2004-10-02 05:47 · Score: 2, Funny

Would the hacker help me remove the big blue E from my desktop?

--
There is a spark in every single flame bait point.

Am I the only one . . . . by theparanoidcynic · 2004-10-02 01:45 · Score: 5, Insightful

Who finds this version numbering scheme damn confusing? The actual program calls itself 1.0PR but the directory structure on the Mozilla server and CowboyNeal call it 0.10.1. Anyone care to explain what's going on here?

--
Only in a Slashdot fantasy can a Slackware install turn into several hours of sex . . . . .

Re:Am I the only one . . . . by wongn · 2004-10-02 01:50 · Score: 5, Informative

It is quite confusing. I believe that 1.0PR was called 0.10 in order to distinguish it better from 1.0RCs and above. THe program actually calls itself "Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10.1", as in 0.10.1, but the "laymans" name is 1.0PR... you could say ;)
Re:Am I the only one . . . . by Anonymous Coward · 2004-10-02 02:42 · Score: 2, Informative

The numbering scheme is XX.YY.ZZ

XX is the major version.

YY is the minor version.

ZZ is for small patch updates.

0.10.1 is the tenth minor version and has had one patch.
Re:Am I the only one . . . . by jack_csk · 2004-10-02 03:32 · Score: 3, Funny

Ya know, those dudes at Mozilla might be using hex instead of decimal, i.e. Firefox 1.0 == Firefox 0.16
Re:Am I the only one . . . . by Spoing · 2004-10-02 12:49 · Score: 2, Informative
1. Who finds this version numbering scheme damn confusing?
It's a traditional numbering scheme. I've used similar ones for about 15 years!
To eliminate some confusion, I tend to use numbers like this ...
5.02.003.0456

... instead of ...
1.3

... since the leading zeros sort more easily!
The numbers breaks down like this;
major.minor.beta.build

Where
major = public number people can identify minor = public revision number beta = showing that this is not a formal release build = the build number or date of release

So, you see "Version 5" on the box or at the web site while the software might have an internal stamp of "5.02.003.0456"
This is a general guide, though. Some folks use only the first two...some use three (with or without build #), and some use five.
The value of this is that it allows you to sort defect reports, quickly identify if something was formally made public (and tested), or if it came before/after another release.
--
A firewall can not protect you from yourself. Turn off what you do not need. Do not use the firewall to do your work.

Re:WTF?? by MikeBabcock · 2004-10-02 01:46 · Score: 4, Informative

For all the people who didn't bother reading the last article ...

Firefox 1.0 has *not* been released yet.

The current (Firefox 0.10.x) is a preview of what will become 1.0 when it is released (thus PR).

--
- Michael T. Babcock (Yes, I blog)

Depends on your download directory by anno1602 · 2004-10-02 01:46 · Score: 3, Insightful

Some people have a dedicated download directory they only use for temp storage until moving the file into a permanent place (or deleting it).

There are, however, a lot of users who pack all their stuff onto the desktop or into "My Documents" with no or little subfolders. For such use cases, the patch is indeed worth installing.

Version numbers seem odd? by Mustang+Matt · 2004-10-02 01:47 · Score: 2, Interesting

So after doing the update through the advanced options should my browser report 0.10.1 under help about? Because I still have 1.0PR

--
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin

Re:Version numbers seem odd? by LnxAddct · 2004-10-02 01:55 · Score: 2, Informative

While your logic is good, your reasoning is wrong. This is just version 0.10.0 also known as 1.0PR with a security update which bumped it up to 0.10.1. Doesn't have anything to do with dates, just a coincidence.
Regards,
Steve
Re:Version numbers seem odd? by Anonymous Coward · 2004-10-02 02:05 · Score: 2, Funny

This isn't really that confusing if you understand the new Firefox naming algorithm, which was implemented with one line of Python:
version = ''.join([random.choice('10.') for x in range(random.randrange(10))])

At each release point, this algorithm will be run and the version will be numbered accordingly.

Helpful bug by Ford+Prefect · 2004-10-02 01:48 · Score: 5, Funny

...could potentially allow a malicious site to erase files from the user's Download directory

My download directory in Windows is my desktop. Have you seen my desktop? It's a fairly old screenshot, too - it's only got worse since then. My iBook's equally bad, except everything's just randomly strewn around the place...

A bit of remote tidying-up would be greatly appreciated. :-)

--
Tedious Bloggy Stuff - hooray?

Re:Helpful bug by ChairmanMeow · 2004-10-02 02:18 · Score: 2, Funny

must... delete... desktop icons....

--
Re:Helpful bug by Uerige · 2004-10-02 02:39 · Score: 5, Funny

You should try the following: 1. Click on your Desktop. 2. Take a deep breath. 3. Press Ctrl-A, followed by Enter Voila -- Your computer just exploded. No more cluttered desktop.
Re:Helpful bug by value_added · 2004-10-02 03:40 · Score: 2, Insightful

Gezus, man! I think People Like You provide an invaluable service to users everywhere by providing an example of What Not to Do. ;-) Consider yourself blessed.

Seriously, I hear there's a thing called folders you can use to store stuff. Might be worth a try?
Re:Helpful bug by cmodcmodcmod · 2004-10-02 04:16 · Score: 2, Insightful

I think that deep breath should be between cntrl-a and enter.

When... by Moby+Cock · 2004-10-02 01:48 · Score: 5, Interesting

I'm just curious if anybody knows how long this patch took to be released. That is, what was the turnaround time from the discovery of the bug to the release of this patch? In the past it has been a fast as a few hours. The longest I think was only a day or too.

Re:When... by aliebrah · 2004-10-02 02:32 · Score: 4, Informative

In a few days, you'll be able to see the full bug report here:

http://bugzilla.mozilla.org/show_bug.cgi?id=2597 08

Currently, it's not scheduled to be marked as public before 4th October. It's still marked as private so that people have an opportunity to upgrade before the details are made public.
Re:When... by Stuwee · 2004-10-02 02:44 · Score: 3, Informative

I'm just curious if anybody knows how long this patch took to be released.
Looking through Mozilla's Bugzilla, it would seem as if the bug was first realised on the 23rd of September in a comment to bug 240068, and then had a seperate security-sensitive -- and hence restricted access -- bug report opened yesterday. I'll leave others to comment on the acceptability.

Bugzilla links referring from Slashdot are blocked, so the above links will have to be manually opened unless your referrer header is obfuscated.

Ah nevermind by Mustang+Matt · 2004-10-02 01:49 · Score: 2, Insightful

I see the 0.10.1 at the bottom in the user agent string.

--
The man who trades freedom for security does not deserve nor will he ever receive either. - Benjamin Franklin

No go by Anonymous Coward · 2004-10-02 01:51 · Score: 3, Interesting

"Firefox was not able to find any available updates" - this on a vanilla install of the 1.0 PR.

Re:No go by ricotest · 2004-10-02 03:04 · Score: 2, Informative

No matter, just visit the press page linked by CowboyNeal and click the link to install the XPI patch directly.

Firefox will probably block it, but two more button-presses to whitelist www.mozilla.org for patch installations and you'll be able to apply it.

If this sort of thing continues they should definitely add www.mozilla.org to the default whitelist.

Cool. Upgrade Path by darkmeridian · 2004-10-02 01:52 · Score: 4, Insightful

This is what open-source needs: a quick and convenient upgrade/patch system. I went to the system settings and ten seconds later, my Firefox was patched.

Now if only Gaim does this.

Will

--
A NYC lawyer blogs. http://www.chuangblog.com/

Re:Cool. Upgrade Path by jrcamp · 2004-10-02 02:17 · Score: 4, Insightful

No, this is the job of package management systems under Linux, be it apt-get, emerge, urpmi, yum, etc. Individual programs don't need to start implementing their own update schemes. For third party packages there will be autopackage.org one day I hope, and updates could be done through that.

These hurt... by deminisma · 2004-10-02 01:52 · Score: 3, Insightful

Considering Firefox is supposed to be the secure alternative, 13 security advisories in the last 6 or so months isn't a good look.

Sure it isn't that bad, but nonetheless, it doesn't help the Firefox's image at all and looking at Secunia, Firefox has had more advisories than any other browser, (yes, that includes Internet Explorer and the Mozilla Suite) since May this year.

Re:These hurt... by kryptkpr · 2004-10-02 01:55 · Score: 5, Informative

You must not be aware that the mozilla foundation has put out a bounty where they reward security researchers $500 for finding critical remotely-exploitable vulnerabilities and reporting them.

What you're seeing are the results of this program.. people are finding bugs, submitting them, and the bugs are being fixed before blackhats can exploit them.

This is a very wise decision on the part of Mozilla considering how close they are to a v1.0 release.

--
DJ kRYPT's Free MP3s!
Re:These hurt... by lachlan76 · 2004-10-02 02:30 · Score: 4, Informative
13 security advisories in the last 6 or so months isn't a good look.

And how many are there in IE that we haven't found yet? The dangerous exploits are the ones we don't know about.
And besides, do you expect Secunia to have all the security flaws from when IE was in beta? Or do you find it strange that a beta product has had more security flaws found in the last 6 months than the one that's been around and insecure for years.

Not to mention that none of the advisories were ranked "extremely critical", and only 2 were critical.

Not to bad for a beta product. Also (from Secunia):
1. Microsoft Internet Explorer 6 with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Extremely critical
  Currently, 19 out of 60 Secunia advisories, is marked as "Unpatched" in the Secunia database.
2. Mozilla Firefox 0.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical
  Currently, 2 out of 13 Secunia advisories, is marked as "Unpatched" in the Secunia database.
Which would you trust?
Re:These hurt... by William+Baric · 2004-10-02 05:04 · Score: 2, Informative

Saying it's a beta product is an excuse, nothing more. 20 years ago, alpha, beta and release had clear significations. Now, it doesn't mean anything.

On Linux the advanced items are ... by 3seas · 2004-10-02 01:55 · Score: 4, Informative

... under the main menu edit, then preferences ... then advanced... to Software updates

Probable bug . . . . by theparanoidcynic · 2004-10-02 01:55 · Score: 5, Informative

I ran this thing last night forgetting that Firefox was installed to a location that user accounts can't write to.

Seeing the error mesage and remembering this fact I lit Firefox as root and ran the update. This left Firefox mangled and incapiable of downloading things from the user accounts.

The moral of the story: do be careful using the update thingy. Now, off to fill out a bug report.

--
Only in a Slashdot fantasy can a Slackware install turn into several hours of sex . . . . .

Re:Probable bug . . . . by aonifer · 2004-10-02 02:32 · Score: 4, Informative

I just installed the fix as root, closed Firefox, reopened Firefox as root to verify that the fix was applied, then closed it and reran as a regular user. The regular user account doesn't know that the fix was applied (the red button is there and when I click on it, it says it needs to download the fix). Either there's some kind of permissions problem, or the update information goes into root's profile, and not system-wide.
Re:Probable bug . . . . by aonifer · 2004-10-02 06:29 · Score: 2, Informative

It turns out it's a permissions problem. If you check ${FIREFOX_HOME}/install.log, you see it replaces components/nsHelperAppDlg.js and installs defaults/pref/bug259708.js. In my case, they both were readable only by root. I just did a "chmod +r" on those files and now it works fine.
Re:Probable bug . . . . by Myen · 2004-10-02 06:42 · Score: 2, Informative

Don't change app.extensions.version as that might render some extensions obsolete (when you try installing them later).
For reference, the XPI only makes these changes:

pref("app.version", "0.10.1");
pref("general.useragent.vendorSub", "0.10.1");

Re:luckily for me... by hattig · 2004-10-02 01:58 · Score: 3, Funny

I'd hope that the update mechanism was a little more secure than "Hi! I'm the firefox update server, honest!" ...

Re:Don't have that menu option by tuggy · 2004-10-02 01:58 · Score: 4, Informative

yes.
i guess thats because of the gnome integration..

Re:it's nice to see ms finally losing the browserw by timmyf2371 · 2004-10-02 02:00 · Score: 4, Interesting

What type of sites is it you operate? Here are some logs from a 100% non-technology related site which still shows Internet Explorer as by far the most-used browser.

Note that the Opera browser shown in Rank 3 should not be taken as accurate as this merely runs a "ticker" on auto-refresh setting every 10 minutes.

# Hits User Agent
1 31005 15.75% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
2 20925 10.63% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1
3 11074 5.63% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) Opera 7.50
4 10596 5.38% Opera/7.50 (Windows NT 5.0; U) [en]
5 9893 5.03% Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko
6 8281 4.21% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
7 7856 3.99% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; FunWebProd
8 6113 3.11% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
9 5286 2.69% Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)
10 4868 2.47% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
11 4795 2.44% Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko
12 2915 1.48% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2) Opera 7.50
13 2885 1.47% Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko
14 2783 1.41% Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)
15 2645 1.34% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.54

--

Backup not found: (A)bort (R)etry (P)anic

Re:it's nice to see ms finally losing the browserw by aardvarkjoe · 2004-10-02 02:01 · Score: 3, Insightful

it's nice to see ms finally losing the browserwars

Yeah, now not only do we get a browser as good as IE, it's got similar security "features" too...

--

How can we continue to believe in a just universe and freedom to eat crackers if we have no ale?

Linux users, take note by dacarr · 2004-10-02 02:06 · Score: 4, Informative

Another user has pointed out that the Advanced option is under Edit|Preferences. Note, you must be root to do this - not merely 'su', but 'su -' at the bare minimum.

If this doesn't work, of course, you'll have to download and install, which is almost as painless as the upgrade frob. The red 'upgrade' icon may still be present, so you'll have to click that so that Firefox will find that all is well with the world.

As always, YMMV.

--
This sig no verb.

Re:Linux users, take note by tuggy · 2004-10-02 02:09 · Score: 4, Informative

sudo firefox and then automatic upgrade did the trick for me :)

Upgrade was even easier then described... by kikensei · 2004-10-02 02:07 · Score: 3, Interesting

Last night I noticed a nifty pulsing red bubble in the upper right-hand corner of my Firefox toolbar. Clicking it revealed a message from the software-updater stating that an urgent fix was availeble. I clicked allow install, and it was done in ten seconds. Very nice that the browser alerted me to a fix and patched itself in no time at all.

defending this post worth loosing karma by scupper · 2004-10-02 02:10 · Score: 2, Insightful

Right now, the parent post :

This may sound stupid...by -kertrats

has just been modded, within seconds of being posted, as "Flamebait".

How on earth is that post flamebait?

The article discusses a vulnerablility.

kertrats asks:

But what exactly is the worry here? It deletes files in your download directory? Does that really matter?

How is asking others on /. for their insight into this vulnerability "flamebait"? Isn't that what /. is all about, discussion? He/she didn't bash on Mozilla, or the whole open source effort, they just asked questions about the vulnerability after reading the summary from mozilla.

As to the last question asked by kertrats:

Could someone enlighten me on why its worth the bother to uninstall and reinstall for this?

Again, kertrats was ASKING A QUESTION, NOT INSULTING THE GECKO GOD OF MOZILLA AND OPEN SOURCE.

It's mods like this one that make you wonder if the person modding is either waging a mod war against another /. member, can't comprehend english as their native language is not English, or simply uses the moderation points like a video game weapon on hapless victims, then messaging their karma cabals to attack the same /. member.

People ask questions like this all the time. How is kertras being confrontational and "flamebaiting" by asking questions that did not contain words like "junk" or "piece of shit", or whatever.

Obviously, kertras is a firefox user, and wants to continue to use firefox, otherwise he/she wouldn't give a rats ass about it either way.

Man, get with it with the damn mods.

Re:defending this post worth loosing karma by FearUncertaintyDoubt · 2004-10-02 04:58 · Score: 4, Funny

Again, kertrats was ASKING A QUESTION, NOT INSULTING THE GECKO GOD OF MOZILLA AND OPEN SOURCE.
The Gecko God of Mozilla and Open Source is a jerk. A complete kneebiter. Thanks for your time. Now I'm off to see Gentoo. Later.

Re:Nope by kryptkpr · 2004-10-02 02:16 · Score: 3, Informative

Thunderbird cannot execute .VBS (Microsoft VB Script) files.

--
DJ kRYPT's Free MP3s!

Best way to find out ... by fine09 · 2004-10-02 02:17 · Score: 3, Insightful

The issue isn't that there is a new expliot. The good thing is that we found out about the exploit by having to apply the patch to fix it.

No software is perfect, any software that has any contact with the internet can have a exploit. It all depends on how fast the developers are able to discover and fix the problems.

Don't upgrade by pestario · 2004-10-02 02:19 · Score: 5, Funny

"...a security flaw that could potentially allow a malicious site to erase files from the user's Download directory."

I would consider this a feature more than a bug. It's like someone breaking into your house and taking out the garbage for you...

--
:n

Re:Don't upgrade by whiteranger99x · 2004-10-02 02:29 · Score: 2, Insightful

I would consider this a feature more than a bug. It's like someone breaking into your house and taking out the garbage for you...

Or for most of us, it would mean someone breaking into your house, shreding your porno mags, demagnetizing the VHS porn, and scratching and shredding the DVD porn...bastards! :P

--
Join the TWIT army now!

Explaining 0.10.1 by XoloX · 2004-10-02 02:20 · Score: 5, Insightful

The reason (for as far as I know) that Firefox uses this versioning scheme:

If 1.0PR would have a version-tag with 1.0 in it, it would be more complicated for (for example) extensions to differentiate 1.0PR and the real 1.0. And home-users would probably not even get to see these version-numbers. They would just notice there is a new update.

And about the bugs, I know I'm stating the obvious, and that it's been said before in this thread, but I'll try again:

First of all, because Firefox performs so well people tend to forget this is still beta-software! Second, these bugs are discovered partially because of the bughunting program with rewards. So these bugs could well have existed for months before being discovered. It's good news they have already been squashed! And third, some of these bugs actually appeared because of the way Windows fucks up! (Remember the shell:// protocol?)

Hope this helps,

XoloX

Re:Explaining 0.10.1 by Clueless+Moron · 2004-10-02 05:17 · Score: 2, Funny

First of all, because Firefox performs so well people tend to forget this is still beta-software!

Hmm. Can I report it as a bug that Firefox is not behaving like beta software should?

Helping people emigrate from MSIE etc. by Anonymous+Bullard · 2004-10-02 02:20 · Score: 2, Interesting

The other day I met a friend of mine who looked unusually exasperated and distressed and knowing that I fiddle with 'puters he asked for my help (or anyone's to that matter, he was ready to dig deep to get his problems sorted) in solving issues with his brand new 2-week old system.

I haven't done (ms-)windows since the beginning of time and since he doesn't know *anything* about computers it was hard trying to figure out what might've been the problem, but it sounded like the typical standard unprotected ms-windows setup that was probably also loaded with spam and ad-ware, bogging down even his simple efforts at browsing the web.

Knowing that quite a few people here have experience with cleaning up the standard MS-install mess, I would like to ask what needs to be done to plug the major holes and deficiencies in a new MS setup?

Firefox is an obvious rescue tool to replace MSIE so are there any issues when installing it or does it automatically and painlessly migrate all necessary MSIE data?

And what about utilities to remove the spyware his machine may already be infested with? Any suggestions?

I'm hoping to be able to burn all these goodies on a CD to give him so I also wonder whether they're easy enough to operate by a total non-techie?

Since his "computing needs" appear to be very simple I'm also giving him a Linux liveCD (perhaps Ubuntu-based Gnoppix would be a good starter with its simplified GUI and it also comes with Firefox) to try out and play with but before completing his conversion I'd need to evaluate how well e.g. OpenOffice.org fulfills his needs at this point.

--

Should invading one's peaceful neighbours be opposed, or rewarded with trade deals?

Re:Helping people emigrate from MSIE etc. by geeber · 2004-10-02 03:05 · Score: 2, Interesting

If they are going to stick with Windows, the three things I always install are Zonealarm - free firewall, Adaware spyware removal - free for personal use, and Spybot search and destroy - another free spyware removal that complements Adaware also inncoculates IE against common exploits. There are also good free virus checkers (don't know any off the top of my head) but people I have helped have all already had virus checking software installed at least.

I also usually try to get them to install a router with a built in firewall for extra protection.

I have had no problems migrating people from IE to Firefox 1.0PR. It has imported bookmarks and cookies flawlessly so far.

--
Download my free songs!

Automatic stuff == bad security by ngunton · 2004-10-02 02:27 · Score: 5, Insightful

The thing that strikes me here is that the ability for browsers to have convenient, automatic features (and, in the case of Firefox, UI customization capability up the wazoo) is simply another form of the same mentality that made IE into such a security nightmare. The ability for a browser to download and execute things on the client automatically is just a huge security risk, regardless of the measures that the designers think they have put in place. The Mozilla press release even has a "click here" link to automatically install the patch! Who doesn't think that this kind of thing will have endless potential for hackers to exploit in the years ahead. The bloated XUL interface engine that makes Mozilla (and Firefox) next to unusable on my old workstation (450 MHz, RH 7.3) also means that the UI can be totally changed - this, to me, is very scary. Because if something can be totally changed, then I can guarantee that eventually someone will figure out a way to totally change it without my consent.

Why not just design a browser that works on multiple platforms, using an established cross-platform GUI such as wxWidgets, rather than going away to create a browser and coming back with another new, slow, bloated, universal uber-platform swiss-army-knife UI language... yeah, I know, "Do it yourself dude", and plenty of geeks out there just love the customizability of XUL, but truthfully all I want is a fast, small browser. It just seems like everything is getting larger, slower and more bloated these days. Even Firefox, which is supposed to be sleek and fast, runs like a dog on my workstation. I don't see why I should have to upgrade my computer just for a fricking browser, when every other piece of software that I use runs just fine thanks very much.

I don't hate Mozilla, these are just my honest reactions to the whole affair over the last couple of years.

Re:Automatic stuff == bad security by KarmaMB84 · 2004-10-02 02:46 · Score: 2, Informative

The browser relies on a trusted sites white list for execution of the type of files in question.
Re:Automatic stuff == bad security by groomed · 2004-10-02 03:18 · Score: 4, Interesting

It's not that simple. To fully support CSS, for example, Gecko (the page rendering engine that's used by Mozilla, Firefox, and Thunderbird) has to be able to change the way buttons and other elements are drawn. And it has to be able to control z-ordering, i.e. it has to be in control of what happens when you draw two buttons on top of eachother. The same goes for things like charset support, printing, accessibility, etc.

To provide full support for the W3C standards, you need widgets that provide very specific capabilities. Toolkits like wxWidgets have the opposite goal: they work by hiding specifics from the application programmer. There is a fundamental mismatch between the two.

If you want to fully support all the standards that make up the web across different operating systems, you end up with something like Firefox. It's not primarily some geek pride thing (although that always plays a role); it is primarily a consequence of the complexity and scope of the standards involved.
Re:Automatic stuff == bad security by jsebrech · 2004-10-02 04:24 · Score: 2, Informative

The Mozilla press release even has a "click here" link to automatically install the patch! Who doesn't think that this kind of thing will have endless potential for hackers to exploit in the years ahead.

I don't think that. Because mozilla uses whitelisting to mark servers you're allowed to install from. If you try installing from another server, it throws up an error. A user would have to manually add a server to the allowed list before an exploit could be installed. Ofcourse, there might be a bug in the whitelisting system, but overall I think the approach is reasonably secure.

Why not just design a browser that works on multiple platforms, using an established cross-platform GUI such as wxWidgets, rather than going away to create a browser and coming back with another new, slow, bloated, universal uber-platform swiss-army-knife UI language...

Because you can't. I am not aware of any native toolkit that allows you to implement a browser fully compliant with the W3C standards, and wxwindows is even less capable than native toolkits. Mozilla optimizes by using native controls where it can, but if it didn't have the xul toolkit, compliance and compatibility would be a lot worse.

David Hyatt, who was/is a developer on both the mozilla and safari teams has written about the trouble with native widgets before. It's just not as simple as you would think it is.

I know, "Do it yourself dude", and plenty of geeks out there just love the customizability of XUL, but truthfully all I want is a fast, small browser. It just seems like everything is getting larger, slower and more bloated these days.

With modern standards being what they are, firefox is about as good as it gets. We're no longer in the days of html 3.2 (well, ok, slashdot still is, but that's beside the point). A browser nowadays has to do a lot more than just render html.

But if you think you can do better, please try.

Too Complicated? by jeremyds · 2004-10-02 02:31 · Score: 5, Insightful

Why does a user have to go to Tools -> Options -> Advanced to check for updates to Firefox? For the average non-technical user, this should be much more accessible.

Re:Too Complicated? by Roguelazer · 2004-10-02 02:49 · Score: 4, Funny

You mean something more accessible like a flashing red light that says "A critical security update is available", and appears in an easily visible place? Darnit, why didn't they think of that?

--
My Systems

More information, please by Arkaic · 2004-10-02 02:33 · Score: 2, Insightful

One thing I didn't like is that when I got the notification from Firefox for a "critical fix" there was no indication of exactly what it was supposed to fix. I like to know why I need to install an update before doing it. Or am I just blind?

Re:Nope by CrazyDuke · 2004-10-02 02:36 · Score: 2, Informative

...or you could have norton which stupidly and automatically deletes the file the vbs is in and pops up a window saying repair successful. AKA your inbox.

--
Any sufficiently advanced influence is indistinguishable from control.

Though a much more serious bug remains unfixed... by tippergore · 2004-10-02 02:43 · Score: 5, Funny

They still have yet to fix a much more serious bug.

Just because most of us don't live in South America doesn't mean it isn't huge problem.

Re:Though a much more serious bug remains unfixed. by tippergore · 2004-10-02 02:45 · Score: 3, Funny

Sorry, links to Bugzilla from Slashdot are disabled.

ooh, bugzilla you sassy wench

Update broken from last release candidate by Splinton · 2004-10-02 02:47 · Score: 2, Interesting

I'm running Firefox on Linux and I had the previous release candidate installed. The update facility failed with a meaningless error, and corrupted my current install.

So I downloaded and installed the new version, which overwrote my old version including my plugins directory, and on startup, failed with an obscure error until I deleted my user profile.

I'm a card carrying Firefox freak, but really, this was not smooth...

Re:but which idiot deciced... by Splinton · 2004-10-02 02:54 · Score: 3, Funny

Isn't it great using the words "idiot" and "deciced" in the same subject?

Update/Extension Install permissions control by scupper · 2004-10-02 02:55 · Score: 2, Interesting

It would be a useful addition to add an FF Profile Manager that included FF Update and Extension Install/Update permissions for multi-user workstations . I looked through MozillaZine, but didn't find much. I can prohibit other users from updating FF and installing/updating extensions using NTFS permissions, User group settings and GP settings, but it would handy to have it included in a FF Profile Manager.

Re:luckily for me... by asa · 2004-10-02 02:57 · Score: 3, Informative

On the downside, that means that anyone who can pose as the update server gets to insert arbitrary code into your Mozilla install without your knowledge - now that's trojanning!

Um, no. That is absolutely not the case. The information bar and the trusted sites list is simply a user convenience/inforamtion mechanism like the pop-up blocking bar. After adding a site to the whitelist, a user still has to agree to the software installation. A site cannot "insert arbitrary code into your Mozilla install without your knowledge" because the install doesn't happen until you agree to the install. There are no prompt-less installs.

--Asa

Another flawless Install, but... by fr8_liner · 2004-10-02 03:01 · Score: 5, Insightful

I just installed and patched the PR edition on my system and added AdBlock and Firesomething. My friend who is a Microsoft developer was watching this process which took 2 minutes. He was taken aback and had to admit that things have improved for installing applications for Linux. He also said that most Windows users would be lost following the instructions to install from a terminal window or doing any installation requiring "./configure, make, make install." He has a point. We need more "Windows-like" app installation to get more Windoze users to migrate to Linux.

Re:Nope by Anonymous Coward · 2004-10-02 03:08 · Score: 2, Insightful

Argument by assertion. Provide some sort of logical argument. Otherwise, please stop wasting everyone's time.

What if -- ask me where to save.. by castrox · 2004-10-02 03:12 · Score: 2, Insightful

What if the "Ask me where to save every file"-option is checked and there is apparently no defined download directory?

Uh. What then?

--
Fight for your digital freedom, join the EFF *now*: http://www.eff.org/support/

Re:Nope by kryptkpr · 2004-10-02 03:56 · Score: 2, Informative

No, it sounds like your virus scanner did it.

A proper virus scanner should be scanning incoming e-mail _before_ it hits your hard disk (through the use of a Winsock LSP), not after. Both Norton and NOD32 implement this type of scanning.

If it only picked up the virus after it's allowed Thunderbird to write it to disk, and then "cleaned it", then it has effictively nuked your inbox for you since Thunderbird keeps all your e-mail for a given folder in 1 file.

--
DJ kRYPT's Free MP3s!

It isn't completely automatic by bogie · 2004-10-02 04:07 · Score: 2, Informative

The user has to actually initiate the update themselves. You simply see a little red arrow, click it, and then are asked to update. Why is this bad if mozilla.org knows how to secure itself?

"Who doesn't think that this kind of thing will have endless potential for hackers to exploit in the years ahead."

Don't you think they've thought of that? Update installs are coded for mozilla.org only and I expect other layered security to come as well. Give them a little credit already. When mozilla/firefox becomes the plauge of the Internet like IE is currently then you can start throwing accusations around. Until then based on their track record I'm willing to give them the benefit of the doubt.

"The ability for a browser to download and execute things on the client automatically is just a huge security risk, regardless of the measures that the designers think they have put in place."

Just because Microsoft completely fucked up with IE doesn't mean all of IE's features are bad, just not properly secured. Your wrongly throwing away an entire workable concept for all the wrong reasons.

Also AFAIK there has never been a hack of either Windows Update or Red Hat Network where someone got trojaned for installing an update. Again, expect tighter controls on who can install what in the future.

" next to unusable on my old workstation (450 MHz, RH 7.3) "

Yes, and xp runs slow on 5 to 6 year old hardware as well. What your point? The zilla's won't ever be blazing fast on ancient hardware so you might as well move on now. Photoshop CS won't run very well on a P450 either. That's a fairly lame complaint since most users don't have your problem. The Mozilla developers also never claimed it would be a browser for old computing platforms in the first place. I don't know why you assumed that. I have btw used Firefox on that era hardware as well. It's no speed demon loading but useable once it launched. On my PIII 700 laptop with 256MB, a machine only a little newer than users, Firefox runs pretty well and its all I use.

--
If you wanna get rich, you know that payback is a bitch

You all got back stage passes... by robotoil · 2004-10-02 04:10 · Score: 2, Insightful

It's amazing how quick everyone is to bash MS IE, some legitimate, but not a peep on Firefox. Not a peep. I understand there is a bias here, but the silence is deafening.

OS difference` by billybob · 2004-10-02 04:19 · Score: 2, Informative

Depends if youre on linux or windows. On Windows its tools->options. They really should standardize it.

--
Joseph?

Upgrade process buggy by prairiedock · 2004-10-02 06:04 · Score: 2, Interesting

I went to Tools/Options/Advanced/Software Update and clicked "Check Now". It confirmed that there was a critical update available, which I let it install immediately. Firefox hung while downloading the update (1.0PR, Windows XP).

I had to terminate Firefox without completing the update, which seemed dangerous, but there was no alternative. When I restarted it, I discovered that I had previously blocked software installs in Tools/Options/Web Features, which might have caused the automatic upgrade to hang. (Of course there should have been a message instead of hanging.) So I checked Allow Web sites to install software. (My "allowed sites" list displayed as empty, incidentally. Is that correct?)

Then I downloaded the update manually (file 259708.xpi) to my harddrive and installed it by opening that file in Firefox. The update installed successfully (no message though). I verified this by checking the install.log in the firefox directory.

Now Firefox should have been at version 0.10.1, but Help/About showed 0.10.0 until I closed Firefox and reopened it. This is surely a bug, and it might allow a user to install the same update twice. Under some imaginable circumstances, that might trash the installation.

No, not Firefox too!! by SuperTrozTX · 2004-10-02 06:05 · Score: 2, Funny

I thought Bad Microsoft was the only one who let me unprotected from the bad people! Firefokz has security flaws too??? OHMYGOSH!!! I though Linuz was impenetrable and perfect!! I'm hit!!! ohhhh! I'm melting.... I'm melting!! What a world...

Firefox not to be exported to several contries?! by tranquillity · 2004-10-02 06:28 · Score: 2, Interesting

When surfing to the Mozilla 1.0 website, I saw the following notice:

This source code is subject to the U.S. Export Administration Regulations and other U.S. law, and may not be exported or re-exported to certain countries (currently Afghanistan (Taliban controlled areas), Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria) or to persons or entities prohibited from receiving U.S. exports (including Denied Parties, entities on the Bureau of Export Administration Entity List, and Specially Designated Nationals).

How realistic is it to keep this code away from these contries, and, more important, how fair is it to do so? Could the mozilla 1.0 code be significant for the international security? Or is it just paranoid? Why is a web browser dangerous?

And, what about IE?

Re:Minor Gripe by Myen · 2004-10-02 07:14 · Score: 2, Informative

Dynamic theme switching was considered too buggy for 1.0.

(And now, the part that is not a dupe)

Set extensions.dss.enabled to true in about:config to use what they have so far. Some things might not work completely, but people seem to believe that it works mostly well enough anyway.

Re:Firefox not to be exported to several contries? by Myen · 2004-10-02 07:28 · Score: 2, Interesting

It looks like that standard disclaimer to make sure the Mozilla Foundation doesn't get sued by the government - I believe that IE also had the disclaimer (havn't checked in a while though). MoFo does have their servers in the States.

I assume a version without NSS (the HTTPS &c stuff) would be legal, and it's probably possible to obtain the code from intermediary countries anyway.

2 issues by Chiisu · 2004-10-02 07:30 · Score: 2, Interesting

1. It can detect I need the update, but when I click next to download and install, it just sits there

2. I don't have the checkbox marked to look for Firefox updates, but it checked anyways.

Re:Moox 1.0.1PR Release Builds Out Yesterday by sevencarbon · 2004-10-03 04:05 · Score: 2, Informative

I am moox - the Firefox builder making the localized builds of Firefox. Sorry for the odd uer name of Sevencarbon, but moox was already taken. I just want to point out that there are several 3rd party developers making optimized and customized versions of Firefox and Thunderbird. The include people such as mmoy, JTw, BangBang23, BlueFrye, daihard, pigfoot, scragz, amano, djeter, matlhDam, and MMx. If you want to see the fruits of their efforts or learn about what they working on I strongly suggest you look at the mozillazine forums (http://forums.mozillazine.org/viewforum.php?f=42) or at pryan's forums (http://pryan.org/mozilla/forums/viewforum.php?f=3 ). As a group, we all work tirelessly to make a good product better and I do not think it is fair for the focus to be on one of us since we have all made significant and valuabe contributions to the development of Firefox and Thunderbird.

Slashdot Mirror

Firefox 0.10.1 Released, Fixes Security Hole

107 of 441 comments (clear)