Firefox 0.10.1 Released, Fixes Security Hole

_xeno_ writes "Firefox 0.10.1 was released today to fix a security flaw that could potentially allow a malicious site to erase files from the user's Download directory. If you already have Firefox 0.10 installed, you can go to Tools, Options, and choose Advanced, go to Software Updates and choose Check Now to grab the patch."

Comments

done already!

[tuggy]

upgrade done in 3 seconds!
this is what i call being secured :D

Re:done already!

[tuggy]

it sure means something!
its very different to have an exploit in the wild and be able to prevent it in 3 seconds, or waiting 1,2..10 weeks for a fix

Re:done already!

[Epistax]

I must admit I/it fumbled. I went to the mozilla website as posted in the subject and hit the "click here". What happened? A funny bar appeared near the top saying that Firefox protected me from the website. Luckily there was an options button which allowed me to add www.mozilla .org as a trusted site and it was all very obvious to me, but it won't be obvious for my parents (who I switched to Firefox).

Re:done already!

[ZeroPost]

To be fair, Windows Update scans for updates to a lot more software than Firefox.

Firefox can scan a lot faster than Windows Update because it is only checking for updates to a single program.

Of course, Microsoft could make an option within IE to scan for IE-only updates, which would make updating IE much faster, but they don't.

Re:done already!

[AstroDrabb]

The update thingy also tells me that 1.0 PR is available and I should download it. The only problem is that I am already running 1.0 PR

Not the latest version. If you look at your User Agent (click Help -> About Mozilla Firefox), you will see Firefox/0.10 at the end of your UA. If you go and download the latest version that includes this fix, the new UA will be Firefox/0.10.1.

I ran into this same problem with the update under Linux. MS Windows users won't run into it since they are running as local Admin or have write permissions to the firefox directory. When I ran it as root, it worked fine so I take it the update needs to write to the root firefox directory it probably then updates your firefox profile. As a normal user you cannot run the update and it never writes to your profile. I think it was just a poor update design for this one update. Hopefully the firefox team will fix it or fix this issue for future updates.

You could grab the latest firefox tarball from here and just untar it into your current firefox installation folder and restart.

This may sound stupid...

[-kertrats-]

But what exactly is the worry here? It deletes files in your download directory? Does that really matter? Could someone enlighten me on why its worth the bother to uninstall and reinstall for this?

Re:This may sound stupid...

[neodude88]

Maybe because you don't need to reinstall to upgrade to this patch? Just update.

Re:This may sound stupid...

[dwhitman]

But what exactly is the worry here? It deletes files in your download directory? Does that really matter? Could someone enlighten me on why its worth the bother to uninstall and reinstall for this?

1. Suppose your download directory isn't dedicated to just downloads. Any files in that directory are vulnerable.

2. You don't need to uninstall and reinstall. As the article says, just go to tools: options: advanced: software updates and hit the Check Now button

Re:This may sound stupid...

[LurkerXXX]

Does it matter? My pr0n! All my precious pr0n!!!

Re:This may sound stupid...

[compwizrd]

because firefox on windows uses the Desktop as the default download location.

Re:This may sound stupid...

[igrp]

Others have pointed out that some users may use ~ or their desktop as their download directory. That may not be a smart thing to do but that's really beside the point.

Any vulnerability that allows remote users to alter content is by definition critical. It doesn't matter if you think it's a big deal. There should be no unauthorized access to files, period.

Your non-critical files aren't 777, are they? Now why is that? Well, despite the fact that data is non-critical, recoverable or maybe even pure gargabe you still wouldn't want people to mess with it, would you?

Think about it: you probably have a lots of old stuff, bank statements and what not somewhere. That data is useless to me (value == 0). By your logic, I could just throw it all out since it doesn't matter to me. It may still be valueable to you though. And even if it weren't, you still probably wouldn't appreciate me going through your stuff and tossing whatever I don't deem important.

See, all attacks that allow any access control circumvention at all are critical. Just because it's not critical to you, doesn't mean every feels the same way.

That's why disclosing the vulnerability and making an update available ASAP was a very good move on part of the fine folks at Mozilla. I just wish there was a mechanism to do manual network-wide mass roll-outs of critical updates (ie. rolling out critical updates immediately without having to wait for Firefox's periodical checks).

Am I the only one . . . .

[theparanoidcynic]

Who finds this version numbering scheme damn confusing? The actual program calls itself 1.0PR but the directory structure on the Mozilla server and CowboyNeal call it 0.10.1. Anyone care to explain what's going on here?

Re:Am I the only one . . . .

[wongn]

It is quite confusing. I believe that 1.0PR was called 0.10 in order to distinguish it better from 1.0RCs and above. THe program actually calls itself "Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20040913 Firefox/0.10.1", as in 0.10.1, but the "laymans" name is 1.0PR... you could say ;)

Re:WTF??

[MikeBabcock]

For all the people who didn't bother reading the last article ...

Firefox 1.0 has *not* been released yet.

The current (Firefox 0.10.x) is a preview of what will become 1.0 when it is released (thus PR).

Helpful bug

[Ford Prefect]

...could potentially allow a malicious site to erase files from the user's Download directory

My download directory in Windows is my desktop. Have you seen my desktop? It's a fairly old screenshot, too - it's only got worse since then. My iBook's equally bad, except everything's just randomly strewn around the place...

A bit of remote tidying-up would be greatly appreciated. :-)

Re:Helpful bug

[Uerige]

You should try the following: 1. Click on your Desktop. 2. Take a deep breath. 3. Press Ctrl-A, followed by Enter Voila -- Your computer just exploded. No more cluttered desktop.

When...

[Moby Cock]

I'm just curious if anybody knows how long this patch took to be released. That is, what was the turnaround time from the discovery of the bug to the release of this patch? In the past it has been a fast as a few hours. The longest I think was only a day or too.

Re:When...

[aliebrah]

In a few days, you'll be able to see the full bug report here:

http://bugzilla.mozilla.org/show_bug.cgi?id=2597 08

Currently, it's not scheduled to be marked as public before 4th October. It's still marked as private so that people have an opportunity to upgrade before the details are made public.

Cool. Upgrade Path

[darkmeridian]

This is what open-source needs: a quick and convenient upgrade/patch system. I went to the system settings and ten seconds later, my Firefox was patched.

Now if only Gaim does this.

Will

Re:Cool. Upgrade Path

[jrcamp]

No, this is the job of package management systems under Linux, be it apt-get, emerge, urpmi, yum, etc. Individual programs don't need to start implementing their own update schemes. For third party packages there will be autopackage.org one day I hope, and updates could be done through that.

Re:These hurt...

[kryptkpr]

You must not be aware that the mozilla foundation has put out a bounty where they reward security researchers $500 for finding critical remotely-exploitable vulnerabilities and reporting them.

What you're seeing are the results of this program.. people are finding bugs, submitting them, and the bugs are being fixed before blackhats can exploit them.

This is a very wise decision on the part of Mozilla considering how close they are to a v1.0 release.

On Linux the advanced items are ...

[3seas]

... under the main menu edit, then preferences ... then advanced... to Software updates

Probable bug . . . .

[theparanoidcynic]

I ran this thing last night forgetting that Firefox was installed to a location that user accounts can't write to.

Seeing the error mesage and remembering this fact I lit Firefox as root and ran the update. This left Firefox mangled and incapiable of downloading things from the user accounts.

The moral of the story: do be careful using the update thingy. Now, off to fill out a bug report.

Re:Probable bug . . . .

[aonifer]

I just installed the fix as root, closed Firefox, reopened Firefox as root to verify that the fix was applied, then closed it and reran as a regular user. The regular user account doesn't know that the fix was applied (the red button is there and when I click on it, it says it needs to download the fix). Either there's some kind of permissions problem, or the update information goes into root's profile, and not system-wide.

Re:Don't have that menu option

[tuggy]

yes.
i guess thats because of the gnome integration..

Re:it's nice to see ms finally losing the browserw

[timmyf2371]

What type of sites is it you operate? Here are some logs from a 100% non-technology related site which still shows Internet Explorer as by far the most-used browser.

Note that the Opera browser shown in Rank 3 should not be taken as accurate as this merely runs a "ticker" on auto-refresh setting every 10 minutes.

# Hits User Agent
1 31005 15.75% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
2 20925 10.63% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1
3 11074 5.63% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0) Opera 7.50
4 10596 5.38% Opera/7.50 (Windows NT 5.0; U) [en]
5 9893 5.03% Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7) Gecko
6 8281 4.21% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0)
7 7856 3.99% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; FunWebProd
8 6113 3.11% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1)
9 5286 2.69% Mozilla/4.0 (compatible; MSIE 6.0; Windows 98)
10 4868 2.47% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET
11 4795 2.44% Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.6) Gecko
12 2915 1.48% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2) Opera 7.50
13 2885 1.47% Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.4) Gecko
14 2783 1.41% Mozilla/4.0 (compatible; MSIE 5.5; Windows 98; Win 9x 4.90)
15 2645 1.34% Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.54

Linux users, take note

[dacarr]

Another user has pointed out that the Advanced option is under Edit|Preferences. Note, you must be root to do this - not merely 'su', but 'su -' at the bare minimum.

If this doesn't work, of course, you'll have to download and install, which is almost as painless as the upgrade frob. The red 'upgrade' icon may still be present, so you'll have to click that so that Firefox will find that all is well with the world.

As always, YMMV.

Re:Linux users, take note

[tuggy]

sudo firefox and then automatic upgrade did the trick for me :)

Don't upgrade

[pestario]

"...a security flaw that could potentially allow a malicious site to erase files from the user's Download directory."

I would consider this a feature more than a bug. It's like someone breaking into your house and taking out the garbage for you...

Explaining 0.10.1

[XoloX]

The reason (for as far as I know) that Firefox uses this versioning scheme:

If 1.0PR would have a version-tag with 1.0 in it, it would be more complicated for (for example) extensions to differentiate 1.0PR and the real 1.0. And home-users would probably not even get to see these version-numbers. They would just notice there is a new update.

And about the bugs, I know I'm stating the obvious, and that it's been said before in this thread, but I'll try again:

First of all, because Firefox performs so well people tend to forget this is still beta-software! Second, these bugs are discovered partially because of the bughunting program with rewards. So these bugs could well have existed for months before being discovered. It's good news they have already been squashed! And third, some of these bugs actually appeared because of the way Windows fucks up! (Remember the shell:// protocol?)

Hope this helps,

XoloX

Automatic stuff == bad security

[ngunton]

The thing that strikes me here is that the ability for browsers to have convenient, automatic features (and, in the case of Firefox, UI customization capability up the wazoo) is simply another form of the same mentality that made IE into such a security nightmare. The ability for a browser to download and execute things on the client automatically is just a huge security risk, regardless of the measures that the designers think they have put in place. The Mozilla press release even has a "click here" link to automatically install the patch! Who doesn't think that this kind of thing will have endless potential for hackers to exploit in the years ahead. The bloated XUL interface engine that makes Mozilla (and Firefox) next to unusable on my old workstation (450 MHz, RH 7.3) also means that the UI can be totally changed - this, to me, is very scary. Because if something can be totally changed, then I can guarantee that eventually someone will figure out a way to totally change it without my consent.

Why not just design a browser that works on multiple platforms, using an established cross-platform GUI such as wxWidgets, rather than going away to create a browser and coming back with another new, slow, bloated, universal uber-platform swiss-army-knife UI language... yeah, I know, "Do it yourself dude", and plenty of geeks out there just love the customizability of XUL, but truthfully all I want is a fast, small browser. It just seems like everything is getting larger, slower and more bloated these days. Even Firefox, which is supposed to be sleek and fast, runs like a dog on my workstation. I don't see why I should have to upgrade my computer just for a fricking browser, when every other piece of software that I use runs just fine thanks very much.

I don't hate Mozilla, these are just my honest reactions to the whole affair over the last couple of years.

Re:Automatic stuff == bad security

[groomed]

It's not that simple. To fully support CSS, for example, Gecko (the page rendering engine that's used by Mozilla, Firefox, and Thunderbird) has to be able to change the way buttons and other elements are drawn. And it has to be able to control z-ordering, i.e. it has to be in control of what happens when you draw two buttons on top of eachother. The same goes for things like charset support, printing, accessibility, etc.

To provide full support for the W3C standards, you need widgets that provide very specific capabilities. Toolkits like wxWidgets have the opposite goal: they work by hiding specifics from the application programmer. There is a fundamental mismatch between the two.

If you want to fully support all the standards that make up the web across different operating systems, you end up with something like Firefox. It's not primarily some geek pride thing (although that always plays a role); it is primarily a consequence of the complexity and scope of the standards involved.

Re:These hurt...

[lachlan76]

13 security advisories in the last 6 or so months isn't a good look.

And how many are there in IE that we haven't found yet? The dangerous exploits are the ones we don't know about.
And besides, do you expect Secunia to have all the security flaws from when IE was in beta? Or do you find it strange that a beta product has had more security flaws found in the last 6 months than the one that's been around and insecure for years.

Not to mention that none of the advisories were ranked "extremely critical", and only 2 were critical.

Not to bad for a beta product. Also (from Secunia):

1. Microsoft Internet Explorer 6 with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Extremely critical
   Currently, 19 out of 60 Secunia advisories, is marked as "Unpatched" in the Secunia database.
2. Mozilla Firefox 0.x with all vendor patches installed and all vendor workarounds applied, is currently affected by one or more Secunia advisories rated Less critical
   Currently, 2 out of 13 Secunia advisories, is marked as "Unpatched" in the Secunia database.

Which would you trust?

Too Complicated?

[jeremyds]

Why does a user have to go to Tools -> Options -> Advanced to check for updates to Firefox? For the average non-technical user, this should be much more accessible.

Re:Too Complicated?

[Roguelazer]

You mean something more accessible like a flashing red light that says "A critical security update is available", and appears in an easily visible place? Darnit, why didn't they think of that?

Though a much more serious bug remains unfixed...

[tippergore]

They still have yet to fix a much more serious bug.

Just because most of us don't live in South America doesn't mean it isn't huge problem.

Another flawless Install, but...

[fr8_liner]

I just installed and patched the PR edition on my system and added AdBlock and Firesomething. My friend who is a Microsoft developer was watching this process which took 2 minutes. He was taken aback and had to admit that things have improved for installing applications for Linux. He also said that most Windows users would be lost following the instructions to install from a terminal window or doing any installation requiring "./configure, make, make install." He has a point. We need more "Windows-like" app installation to get more Windoze users to migrate to Linux.

Re:defending this post worth loosing karma

[FearUncertaintyDoubt]

Again, kertrats was ASKING A QUESTION, NOT INSULTING THE GECKO GOD OF MOZILLA AND OPEN SOURCE.

The Gecko God of Mozilla and Open Source is a jerk. A complete kneebiter. Thanks for your time. Now I'm off to see Gentoo. Later.