Slashdot Mirror
Security Issues in Mozilla
paulius_g writes "SecurityFocus has released a security warning with three problems that affect Mozilla on all platforms. The first issue allows the source of a download to be spoofed, generating a fake URL. This security issue is really easy to replicate: Create a long URL and the downloading box will only display its ending (Mozilla and Firefox). The second issue was created by the way that Mozilla's browsers handle news:// links to newsgroups, hackers can easily create false links and create a buffer overflow (Mozilla 1.7.5 and below, Firefox versions before 1.0). The third exploit affects machines with multiple users. The way that Firefox and Thunderbird store files allows every user to see them and to probably catch the other user's surfing habits (Firefox and Thunderbird). Let's hope that these will be fixed soon!"
==========
All Mozilla users should upgrade to the latest version:
Says the site, implying at least a partial fix is available.
Inspite of these security flaws, Firefox is still a lot better than the incumbent IE.. no?
Online backup with Mozy, sounds like Ozzie, but more!
I guess they are not drinking the water from Redmond!
Oh no! Time to switch back to IE.
bigger are the chances this will happen
quote me! :)
The tragedy, the inhumanity!!
Bet Gates is grinning today hoping everyone will forget his laptop crash.
Don't Tech all day and night, visit:
WillingtonKarateClub.org Training Tips and more
The way that Firefox and Thunderbird store files allows every user to see them and to probably catch the other user's surfing habits (Firefox and Thunderbird)
Can't the same be said of IE or any program that stores information in %SYSTEMROOM%\Documents and Settings\%USERNAME% ? I mean, it's possible for me to see anyone's "habits" that way, right?
Proudly supporting the Libertarian Party.
All of these security issues are fixed in the latest releases of Firefox/Thunderbird/Seamonkey. They have all been fixed for quite some time now.
It would have been helpful for this information to be included in the story. Thanks, Slashdot.
Weak. They should know better than that. It's not like it is hard to prevent a buffer overflow. They're using C++ for crying out loud.
that I can still wipe my Linux box, buy a copy of XP, install, activate, update, reboot, update, reboot, get SP1 & 2, reboot, update, reboot and I'll be able to use Internet Explorer, a safe alternative to....oh wait...
Most viruses are exploits of things MS has patched months earlier. If Firefox becomes mainstream can we count on the average user to update or will an out of date Firefox become nearly as bad as IE?
Gravity is not just a law, it's also a good idea.
"spotted before rollout"?
Dude, the article says that only versions before Firefox 1.0 are vulnerable, and 1.0 has been out for 2 months already. What are you talking about?
Note that it appears from what I read that these issues only affect the beta versions of FireFox. Who uses a beta once a released version is out???
Basically this is a non issue as everyone should have upgraded to v1.0 as soon as it came out.
Perhaps it will serve as a reality check for those who have the wrong (idealistic) conception about this browser... Average users are so quick to jump on a bandwagon. People tend to think entities like Google and Firefox are lights in the harbor or signs from God. They are just implementations which are better than what others are doing, and they are not as perfect as many like to imply. Firefox is no doubt an improvement over the many other options out there, but as it gains popularity, it will also gain more status as a target - much like IE has been for years now. The fact there there are still vulnerabilities should come as a surprise to no one.
Overclockers
As it becomes more and more popular, more and more bugs will be discovered. There is no inherently secure piece of software: it's only a matter of problems / volume.
A blog like any other.
Undoubtedly, proponents of MS will point to this and say "See...told you so..."
The difference between Mozilla/other OSS and MS software is that while a bug in IE will remain unfixed for months (unless it's such a glaring error that the media grills them for it,) a bug in Moz/Firefox won't last very long. So the real issue that we need to remember is not that three bugs were found, but that unlike MS three bugs will be fixed.
Cheers,
-maztuh
The real litigious bastards...
The first one should be easy to fix.
It's more important to see from where you're downloading (the source) that what you are downloading (the content).
Hackers can emulate the ending of a URL but not the begining!
According to the article, all firefoxes less than 1.0, and mozilla pre-1.7.5.
:)
They were spotted and corrected before rollout
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
the 75 outstanding Secunia security advisories for IE or the 33 security advisories for Opera? Don't they get equal billing?
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
This only applies to Windows platforms. Linux and Unix versions maintain all user information in the homedir, preventing access to ordinary users.
As the article clearly state, all three have been fixed. Simply use the latest versions of the software.
The Slashdot article, not security focus. In plain text, at the top, it says these were FIXED in the latest versions.
.9, and Mozilla BEFORE 1.7.5.
They affect Firefox versions BEFORE 1.0, Thunderbird BEFORE
This article was posted by some MS shill who is hoping the because Slashdot is spidered by Google news they will get some mainstream journalism about Firefoxes bugs!
This is TOTAL crap! Let the MS Smear campaign begin!
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Guys, wake up, old news. According to the article, all bugs were fixed in Mozilla 1.7.5 and Firefox 1.0.
Move on people,nothing to see here!
xpdf was so buggy years ago that I switched to Adobe Acrobat and never looked back.
> I haven't read TFA all the way through yet
And now you know why people always say RTFA...
-- Don't Tase me, bro!
two...
What, they're fixed already?
Never mind.
I love open source.
The cure for cancer is coming: Reovirus
The news:// link issue reported is for "Mozilla 1.7.5 and below, Firefox versions before 1.0".
Firefox 1.0 has been out for weeks already and most extensions have been updated to work with this new version.
The mozilla 1.7.5 is the current version, but if these are the 3 biggest security issues that can be found, then that only cements my position as a long-time firefox user.
I'd hate to see a post on slashdot everytime there are 3 issues of this severity found for IE.
Got a site/story worth sharing? Leave a mark
Is that Firefox, and most likely ANY product that attempts to compete with an established Microsoft product will have to face two issues that Microsoft constantly faces: 1) Features take precedence in the development lifecycle forcing security to become an after-thought. 2) As popularity increases, so does visibility which is currently one of the primary factors in determining scrutiny for such issues.
;)
I still prefer Firefox for it's usability features. It wasn't long ago that they got in place a "Software Update Available" mechanism for just these types of circumstances. In turn, people that think Firefox is immune from security issues should look at the past and come back down from their orbit
Problem One: A String Formatting Issue, URLs should be shown as "http://www.blah.com/.../www.spoof.com/register.ph p" rather than ".../www.spoof.com/register.php" and users should be shot if they can't recognise a valid URL.
Problem Two: Beta Firefox? That's not an issue then. Otherwise, who let a buffer overflow get into the codebase?
Problem Three: Surely this is more of a problem with Windows' Security model? if an OS is used essentially as a single user machine (e.g., 9x) then there is little that can be done between profiles.
I noticed that the news protocol hole is one part of the source that few developers are interested in. Because of this, bugs like this are less likely to get discovered.
The UI hole (right-aligning the URL) is also in an unexpected place.
I always hear talk about the problem with Open Source is people only do the fun stuff. Well, for different people, different things are fun. For some people a security review is very fun. Of course, not as fun as doing a security review on the otherwise most interesting part of the codebase, but fun nonetheless.
So if you enjoy doing security reviews, help Mozilla out. Discovering one of these hidden bugs could definitely help out the I'm sure they could use a couple of eyes in the parts of the code currently not subject to scrutiny. Also, it could help you to become a security expert.
Now that I think about it, that may be just what the people that discovered the hole were doing. It certainly will be good for their career.
Affected packages
=================
Package / Vulnerable / Unaffected
1 mozilla / < 1.7.5 / >= 1.7.5
2 mozilla-bin / < 1.7.5 / >= 1.7.5
3 mozilla-firefox / < 1.0 / >= 1.0
4 mozilla-firefox-bin / < 1.0 / >= 1.0
5 mozilla-thunderbird / < 0.9 / >= 0.9
6 mozilla-thunderbird-bin / < 0.9 / >= 0.9
So, lets try reading this data. If you are running version 1.0 of Firefox, version 1.0 of Thunderbird or version 1.7.5 of Mozilla (all the latest versions) you have NONE of these issues. Geez....
Unstable Apps: Our Android Apps Don't Suck
It's obvious that the more mainstream Firefox becomes, the more exploits are going to be found / used. It was inevitable that there would be exploits, but the test of Open Source vs Closed Source is how quickly the problems are fixed and rolled out. I think the next year is going to be an interesting one for Firefox developers.
Training monkeys for world domination since 1439
Eh? They ARE fixed....
These affected firefox beta, not release. Check the article..
By my calculations, fixed over 2 months ago.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
Than some string formatting issue!
I mean what you describe circumvents the whole issue of having a multi-user system and security model.
The really important thing as far as I'm concerned is the length of time needed to fix newly discovered bugs, not the number, and this is where the open source development model works so much better.
I'm also concerned about those nasty 0-Day vulnerabilites that are out there but we don't know about. The problem with open source is that the code is out there, so its easier to find the bugs. The saving grace is that the code is generally better, and there are usually more white hats looking for the problem than black hats.
I still think FF is safer than IE, but I also think its just as important to be wary of the bugs we don't know about as the ones we do. The same goes for any software product.
CitrusTV (http://www.citrustv.net): the Nation's Oldest & Largest Entirely Student-Run Television Station
Download Firefox!
Seriously, all of these are fixed in the current version. The poster even says it with regards to the buffer overflow problem!
I think my principles are reachin' an all time low
So, let's see...Mozilla is touted as the best browser to replace IE, yet we get the same thing all over again (buffer overflows, security issues, etc.)
Ok, sure, they claimed the issues will be fixed very quickly and here are my concerns:
1. Is there a patch or do I have to download the whole browser and reinstall?
2. How often does this happen? One patch/reinstall every few weeks? Do you guys seriously expect an Admin to roll out new installs/patches every few weeks? Are you even remotely aware of the full cycle testing/QA effort that's involved to make sure your corporate app still works properly with the new versions?
Face it. Mozilla will encounter the same issues as IE no matter what.
Oh, a side note. If I have Windows and I want to use Mozilla, why do I have to use IE first to download mozilla?? I already have IE installed, why do I need to download yet another browser and install it?
They're ALREADY fixed!
When will people read the damn articles and when will the slashdot editors check the content of the damn stories they post
That everyone has access to, it's in the All Users profile, as Shared Documents (instead of My/Username Documents).
Pretty trivial to direct your storage of photos/documents that everyone needs access to, to that folder.
Anyone good at writing up story submissions?
l e=5844 for the nntp flaw, and link to the same security focus article regarding the other two.
Time to troll Slashdot! Seriously...Given that all three bugs are ALREADY fixed, it shouldn't be too hard to sneak a 'troll' story by about how the Mozilla foundation responded instanteously to these bug reports.
Use this urlhttp://www.mozillazine.org/talkback.html?artic
Why? Because the security article tells you to update your mozilla based software to the latest version to avoid these no-longer-existing.
And excellent opportunity to troll the story submission queue, and given the cluelessness of slashdot editors, it should be pretty easy to sneak it by.
WhiteWolf666 an exBush supporter. All you new-school,compassionate,save the children Republicans can rot in hell
I'm switching to IE, a browser made by a company who cares about ME.
Say it isn't so! *rolles eyes*
[Fe]how can a program that is cobbled together by people with no eye to security and will give the source code to any passing stranger who wants it, be more secure than a bunch of paraniod security freaks who jealously gaurd their source code?[/Fe]
...here is absolute proof that Mozilla-based browsers are as full of holes as IE: "Three exploits in one day! Open source just doesn't work!"
I can't wait for this to be, ahem, exploited.
Sadly, then will begin a new round of "your analysis methods are crap" ad infinitum, ad nauseum.
quote me! :)
If this is the worse "exploits" they could find with mozilla...>I think we'll be JUUUST fine.
Momma told me that sigs are for the devil
I find this ironically humorous.
While the news:// bug seems to be preaty serious, please note that it has been fixed in the newest versions of the software. So this is mostly just a back-version issue which wont affect the new users, and those who updated their software.
It needs to be fixed, but it is not the "OMFG we are all screwed - let's switch to IE NOW!" situation". The remaining two vounerabilities don't seem that bad. The solution for the long url problem should be merly cosmetic - just put a scrollbar there and you're done (maybe add a function call which will parse url and escape funky characters to prevent spoofing - if one is not there already - but I think Moz always had that working as it should as opposed to IE team).
File storage thing seems to simply be a design problem which is not unique to Mozilla. Moz products store temp files in the default temp directory for the system. BFD! So does almost every piece of software out there which has to deal with lots of temp files. And we are not talking about browser cashe - that is stored in yur home. These are temp files for plugins and 3rd party viewers...
I'm actually not sure if that problem is actually a mozilla bug or unintended xpdf side effect...
So I would say 1 vounerability, one possible spoofing riskk and one possible mild privacy related concern. Not bad compared to all the unpatched IE issues
I'm teminally incoherent
i love u!
is this long enough?
I stole this
Announcements of security vulnerabilities in Netscape 4 or Mosiac?
Considering how much OSS freaks rake MicroSoft over the coals over how long it takes them to fix their security problems, I'd expect to see these fixed later today.
... Not to say that's what the good people at Mozilla are like, damn fine product Firefox for Windows is.
Chicken fried butter sticks? Do
I wasn't talking about these particular exploits, I was talking about possible future exploits. This story isn't news because there's the possibility of three minor issues, it's news because Firefox isn't the completely safe browser people have been trumpeting it as. My point is that we shouldn't be concentrating on how bomb proof the software is, we should be concentrating on the response given to threats, and how these are better (or worse) than the response given by Microsoft.
Training monkeys for world domination since 1439
and I am a fag. You know I use to hate the GNAA but I can see why such rampant trolls frequent /. I love watching self righteous open source zealots try to defend themselves.
Most people won't update unless you do it for them. Unfortunately, when MS first suggested this, the tinfoil-hat crowd made all kinds of noise about MS taking over their systems.
Hopefully, Firefox is set by default to update itself automatically. Joe Sixpack isn't even aware it needs to be done.
"Three security flaws ALREADY fixed in Mozilla"
I mean, come on, for Pete's sake. A FUD story about flaws that already have been fixed? Sheeeesh..
When will people read the damn articles
I don't know. When will people start reading the comments properly. I wasn't talking about the highlighted exploits, I was talking about exploits in GENERAL.
Training monkeys for world domination since 1439
Commies are doomed to failure!
My karma ran over my dogma
The title of your post says 'how quickly they get fixed' implying that you're talking about the three flaws the story is talking about
The news is pretty confusing. After reading carefully the articles, I think that in fact only the last problem hasn't be fixed....But the author comment "Let's hope that these will be fixed soon" let people think that the 3 of them are still present.... I was wrong saying before that everything is fixed, but shouldn't we at last add something explaining that only ONE issue is not fixed....? Do not know : does it deserve an update?
Only the buffer overflow issue has been fixed! This article on the Register should clear things up:
http://www.theregister.co.uk/2005/01/07/mozilla_fl aws/
I wasn't.
Training monkeys for world domination since 1439
So could this be the bug, is Firefox setting the permission on the files it creates wrong? Could be it, in which case shame on them, especially if they are doing something other than what Windows does by default.
Like other readers here, I am confused about what Firefox could possibly be doing that is different than other programs. This could be it.
Now your mom can't see which pr0n sites you visit.
Well, the latest stable version of Firefox distributed by Mandrake is 0.8 so, some of us have a bit more to worry about.
I guess its time to bite the bullet and visit the cooker....
----- If communism is a system where the government owns business, what do you call a system where business owns govern
Issue 2: Fixed (Affected Versions: Mozilla Browser
This bug is fixed in Mozilla 1.7.5. (Bug 264388)
Mozilla developer Dan Veditz claims that it cannot be exploitable:
"A '\' on the end will certainly trash memory, but at that point you're no
longer reading attacker-supplied data;".
So, at most it would be a DOS attack, not a true "hack into your computer". And from the Security focus link:
So Firefox 1.0 is indeed safe.
Issue #3:From the link:
In other words, 1 outdated, another unconfirmed, and the first one real, but it's moderately critical.
So the Mozilla guys have only to fix ONE bug, and CONFIRM another. Issue #2 is fixed already.
If you haven't read it yet, then why are you commenting with "unacceptable?" I think the fact that you'd say this is unacceptable without knowing the whole story is unacceptable. Read it - you'll find these are all very minor issues.
/tmp.
The first is tantamount to an opinion on how long-ass urls should be displayed, and is hardly a security issue.
The second issue is fixed in the latest stable releases. You update, right? If Mozilla had a time machine, I guess they could go back and fix it in other releases too.
The third issue sounds more like an xpdf isssue, and is not out of line with how many programs create files on Unix under
This story seems like a setup to me. Astroturfing, anyone?
You can see the difference between FireFox and IE:
These only affect Firefox nothing else in the operating system, and one is fixed in a prior release.
The stagnant development of Slashcode, the pile of Perl that spews invalid HTML for this site. Also, abused "bitchslap" script used by the editors to punish users that have unpopular opinions. Oh, then there's the "Slashvertisements" that get front page'd that have little value to anyone except for the submitter. Then there's the broken moderation system, the pointless 20 second post delay, and the general hivemind mentality of the moderators. Netcraft now confirms: Slashdot is dying.
Obviously the advisory is simply to inform people who haven't upgraded that it might be prudent to do so. Of course software will always have bugs, and for every one bug you kill, a few more will rise in its place until you get everything right. That is a long and arduous process, especially given the complexity involved in providing the functionality of today's software. Thankfully, the folks who wrote the Mozilla line of software seem to fix their problems rather quickly, so I'm sure that if they haven't already been fixed (as is rumored to have been done in Firefox 1.0 and the newest Mozilla) they will be sometime in the very near future. Patience, grasshopper.
Dude, read. At least one of the advisories states that 1.0 is still vulnerable.
For more information, click here.
Mozilla 1.7.5 and Firefox 1.0 are still vulnerable.
For more information, click here.
Don't be a victim of astroturfing- RTFAs.
Sheesh.
Notice how every bug report about IE starts by saying how bad IE is, then saying MS sucks, and Mozilla doesn't have this bug because it's so great.
Now read the post about a Mozilla bug. No mention that IE does not have the bug. No mention that the coders who left this bug are crappy, and no mention that you could switch to IE to avoid this bug.
I know, IE has its bugs too, but it seems like we could be a bit more fair around here and at least either treat both browsers as if they suck, or treat them both with respect.
Just my personal observations.
Only the buffer overflow issue has been fixed! This article on the Register should clear things up:
http://www.theregister.co.uk/2005/01/07/mozilla_fl aws/
while I agree with the others that you were wrong in your statement, I don't understand why you got marked as a troll.....
"No one is more miserable than the person who wills everything and can do nothing." -Emperor Claudius 10 BC - AD 54
Third problem (users can see other users profile info, history, etc.) should be easy enough to fix, or at least easy enough to leave it to the OS to determine user access. Just place the files in user-owned private folders, like the documents and settings folder in windows or the user/home folders in linux. Mozilla shouldn't be responsible for user-level file access info.
$8.95/mo web hosting
There is NOT a fix for these three issues.
Once again, Internet Explorer rules. As usual.
Or Opera for those of you that want a real browser.
Actually, a buffer overflow can result in the execution of arbitrary code. I'm confident in asserting that all IE6 vulnerabilities need IE to be executing in Administrator context to affect the OS, although it would be instructional to be proven wrong. Given this fact, a buffer overflow in Mozilla as Administrator threatens the OS just as much as an IE vulnerability.
Moral of the story: run Mozilla for the features, run as Limited user to be truly secure.
Like the german Tagesschau (http://www.tagesschau.de/aktuell/meldungen/0,1185 ,OID3948600,00.html) reports Gates 'imputes sticklers for a more relaxed copyright of reactionist aspirations'.
Those who wanted to reform the handling of intellectual properties were 'a new kind of communists' trying to 'disestablish the things which make the incentive for musicians, directors and software developers' told Gates ZDnet (where I wasn't able to find anything about this). They (the reformer) 'would not believe that these kind of incentive was allowed to exist'. There 'were some things to improve at copyright legislation, but the intellectual property would be the impulsion to develop the products of tomorrow'. That 'would also secure and create new [US-] American employment'.
Well Gates, we all knew that you are a fan of proprietary software and also keen of software patents - but being a political right winger is at least new to me.
You can think about communism in its different forms what you like - but it surely hasn't to do anything with the discussion about copyrights.
Mom: Biiill!
Bill: ~ Yes mom? ~
Mom: What are you talking again!
Bill: ~ But mom! ~
Mom: Shut up! You go to bed now.
I lag
That when Mozilla (or anything not by Microsoft) has a bug, people say "Let's hope that these will be fixed soon!", but when IE (or anything by Microsoft) has a bug, people say (")Hahahahaha!(")?
"Mozilla 1.7.5 and below, Firefox versions before 1.0"
Wait, I thought the reason to still use Mozilla instead of Firefox is that bugfixes make it to Mozilla releases first. Now it looks like the only reason is that Mozilla integrates Google/search into the same UI field as "Go to URL".
--
make install -not war
If I did not misunderstand your post, No. 3 is unconfirmed.
I think you are right. Although I don't know if it is unconfirmed or not, but it does not seem to affect Mozilla 1.7.5.
I just checked my personal mozilla configuration directories created fresh by a new Mozilla 1.7.5 [official mozilla.org binaries on Debian stable (3.0 'woody')], installation. They are created with permission rwx------ (i.e., groups and others do not have any privileges) and of course, the execute bit is only for directories.
Of course, if some crackpot spoofed my download dialog and made me download a compromised binary.... :-)
Well the first two issues are definitely cross platform but the last isn't.
Dammit, knew someone would! I've not long caught the Gentoo bug, and I'm "emerge --sync", etc pretty much every two days! Not yet got around to installing Gentoo on the "real" boxes yet, so your advice is pretty timely.
This is where the serious fun begins.
I'm not too worried about the third one. For one thing, it is easily worked around by setting your $TMP or $TEMP environment variable. Really the global visibility of the files isn't a "bug" in Firefox/Thunderbird or any other app that does this. They're just following the standard system practice of using whatever directory is specified by TMP/TEMP to open their temporarily files in. The issue is that common practice on that score is moderately insecure and may expose info to other users, but there's nothing application authors should do about that.
The permissions issue is the only real "security" problem, but I would bet they did it that way to allow viewers that may be running setuid nobody to still view the file for the user. Perhaps the answer is simply to have documentation about viewers running setuid nobody (or other restricted users) and a configurable list of such viewers that the user can add to. After that, files destined for ordinary viewers should be permissioned 500, and files destined for setuid restricted-user viewers could be permissioned 544 or something else appropriate.
-- Old Man Kensey
Click 'cancel' if you are not sure about what you are downloading; Addtionally, you should be able to hover the mouse over a link and see the actual URL in the display bar at the bottom of the window. I do this all the time because I want to be sure where my browser will be connecting when I click anything. Of course, if you go to sites that don't use standard HTML for their links, you could be scammed. Generally speaking, unless you are running IE, downloading a trojan isn't going to be that bad - as long as you don't then try to run it. If you were expecting a picture, or a zip file, and got an executable instead, that could also tip you off. This is probably the worse problem of the three - but nothing to lose sleep over.
The second issue was created by the way that Mozilla's browsers handle news:// links to newsgroups, hackers can easily create false links and create a buffer overflow (Mozilla 1.7.5 and below, Firefox versions before 1.0).
If you aren't using the latest version of the browser - you are wrong. Additionally, who reads news groups anymore? I gave up wading through all the spam and flame wars long ago...
The third exploit affects machines with multiple users. The way that Firefox and Thunderbird store files allows every user to see them and to probably catch the other user's surfing habits (Firefox and Thunderbird). Let's hope that these will be fixed soon! - should do the trick on most unix/linux systems. I can't see this breaking the browser, because presumably it is being run by you as you. This is irrelevant on a Windoze machine because it is not truely multi-user (and I can slap a knoppix disk into your windows machine, reboot linux, and read all your files provided I have physical access anyway - which is how most people 'share' a windows box).
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
> The first issue...
It isn't an "issue". It is a bug or a problem.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Ironically, at work it's rock-solid... on Windows XP.
-- Old Man Kensey
Of course the is bug free code for instance
:)
void main (void){}
does just what it is supposed to do, nothing. you mean no useful codes is bug free.
Seriously though what I think is the most telling is how worked up everyone is getting, really when was the last time someone got suprised because "IE has 493 unpached critical vulnerabilities that allow a malicious hacker full control of you machine"?
This intro is the best example I've seen of the abuse of the word "issue." In every instance it should be substituted with the word "problem."
:)
Sorry this is my pet peave. Go ahead and mod as off topic, that's why it's anonymous.
Have a nice day
Oh no, you forgot to install display driver, printer driver, scanner driver, photo camera driver, and lots of software...
And... don't forget to update EVERY software you have!
Synopsis: Heap overflow in Mozilla Browser = 1.7.3 NNTP code.
/. crowed doesn't read the articles.
Product: Mozilla Browser
Version: = 1.7.3
Well, I may not be a programmer but I know the less than, equal too symbol. So, mark this for 2 issues.
Who says the
This probably will get mod'd down for snottiness... Is there a mod factor for it? Nope, get coding and make a snot factor.
Well, my Firefox 1.0 doesn't seems to have no problems with exploit number three:
-rw------- 1 xxxxxx xxxxxx 71K Jan 7 19:16 /tmp/dmca.pdf
So I'd say that at least that problem was corrected before rollout.
Now, if you want to complain about a really stupid thing that should have been corrected before rollout, then complain about the fact that the stupid download window pops up when saving images - try it: right-click on the red dinosaur icon of this story, choose "Save Image As", and watch the download window pop up (with about a secondo of delay, at least in my machine).
Really fun when you're visiting a web gallery...
Forget magic. Any technology distinguishable from divine power is insufficiently advanced.
Dude, Read, at least one linked article says that they are all fixed in the latest version.
Now it is actually still a problem with the download spoofing, but it is more of an annoyance. With the way the download manger parses urls, it is possible to misrepresent where something is being downloaded. If you can't trust the site then don't download. There will be "..." in the middle of the url for the file you are downloading so it is not like the url spoofs in IE. So you have a warning something may be fishy.
Just a Tuna in the Sea of Life
Methinks you have never met an average person who uses a computer. Unless you think the average Slashdotter is an average person...
My beliefs do not require that you agree with them.
How hard is it to parse the URL and include the actual domain in the status bar/hover window? Then you'd know where the link went no matter how long they made it.
Nathan
The third one is not a bug, but a design flaw.
A few days ago I realized that the whole Mozilla family has some serious issues with applets and tabbed browsing.
An applet in a non-active tab can take control of a forground window, actually absorbing mouseactions, and also repainting the foreground.
After looking at a bunch of other older bug reports, I submitted my own (which was java applet related), and have had no response. The entire set of problems appears to date back more than a year.
It's dissapointing to see serious issues like that not being actively worked on.
I'm even thinking I might get involved to fix exactly that bug (feature?). I'd even think that eliminating tabbed browsing is a good idea until a fix is released.
Time to try Opera ;-)
Opera Watch - An Opera browser blog.
Given this fact, a buffer overflow in Mozilla as Administrator threatens the OS just as much as an IE vulnerability.
Problem with XP is that so much software just doesn't run unless you are an admin. This is no big deal if you run a non redmond os.
-- $G
You were looking for a fix
here it is
Note to self: I wonder whether this will be modded "-1, Troll" or "+5, Funny"
Security vulnerabilities for Internet Explorer 5.1 announced...
Ceci n'est pas une pipe.
I know you cant link to Bugzilla directly from Slashdot, but for those of you who are interested the relevant Bugzilla bug numbers to look at for these are:
Problem with XP or problem with the software?
/root, and faults on protection error, is your response "gosh linux sucks!!!".
If you run app in linux, the app attempts to write to
Apps that don't run do so because they are shoddily programmed. The user protection concept has been around since NT4, maybe it's time we ask developers to actually follow secure coding practices?
At the very least all the apps I run work as expected. Office, Mozilla, Visual Studio, Nero, Adobe products, Macromedia products, etc... Those that don't work should get their acts together, because Longhorn defaults to Limited User (finally!).
You linked to the second issue out of three.
The first issue out of three is not fixed in Firefox 1.0.
The third issue out of three might not be fixed in Firefox 1.0; the article does not mention this version with any certainty.
Firefox 0.9 has three vulnerabilities. Firefox 1.0 has one vulnerability. The only way to be secure is to use a different browser, no matter how crappy it may be.
For more information, click here.
Why is it that Slashbots jump at every chance to trash Microsoft for their (supposed) low security standards, yet apparently don't hold open source projects particularly high standards? And why do they silence (through moderation) those who DO hold OSS to high standards?
good thing i went through and read some comments and the article to see that all three issues have been fixed and only people with mozilla-firefox 1.0 are vunerable. otherwise i would have gone on thinking that my firefox version was vunerable and stop surfing the net and actually get some work done. but for people using the rss feed or who just read the post on the main page, some clarification to the post is necessary. Any ops around to add, all items are fixed.
And this is exactly why I stick with Opera. It's just incompatible and unpopular enough to go below the security exploit finders' radars.
You must be new here. Welcome to Slashdot!
Since Firefox went 1.0 about 5 months ago, it has received 5 security warnings from Secunia, and none of them have been fixed yet. http://secunia.com/product/4227/ I hope this rate of fixing security problems will improve soon.
I'll probably be modded down for this...
The "editors" are obviously NOT "Anti-dupe"
The thread parent is right on the basis that the story write-up was misleading. It IS misleading.
Apps that don't run do so because they are shoddily programmed. The user protection concept has been around since NT4, maybe it's time we ask developers to actually follow secure coding practices?
This has less to do with coding and more to do with your instal system. Regardless, I still don't have this problem with nn redmond Oses because user rights aren't a recent addition.
-- $G
Dont flip out people it is just a little problem that mozilla will have fixed in about a day if not less. so there will be a few people affected by it but who cares as long as there are computers there will be people affected by vires's trojens and all that other crap out there so just bite your lip and dont surf stupidly on the internet. they will fix the problem and look on the bright side of things atleast we are not using IE
I'm sure all 3 security problems have come up seperately when they were actually first found, I seem to remember checking when they were fixed and I think 1.0 shiped with all 3 fixed, or at least the nightly builds don't suffer from the bugs which arn't deadly serious in most situations.
this is newsworthy? the regular development cycle of an open source product is as such. bugs are found, made public, and FIXED ASAP.
the submitting party is either involved with microsoft, needs glasses, or a swift kick in the ass.
moron.. it says right ON THE PAGE that this has been fixed.
You are about to give someone a piece of your mind, something which you can ill afford...
Personally I don't like web browsing using tmp at all. Why is this not in my home's mozilla cache? Is there a techincal reason why it goes to /tmp?
The concerns pointed out are extremely minor ones which will be gone soon enough. --And from reading the posts here, it seems that a couple of them may already be history. (I've not checked this though, and probably won't since I never use Newsgroups, do not have multiple users on my system and don't download things unless I know what the heck they are. Frankly, I probably won't bother patching any of these problems, and will just wait around until the next version of Mozilla comes along.)
So wake me up when by connecting to the web or checking my email somebody can enslave my entire OS or download all my passwords or delete my hard drive or hit me with any one of a couple dozen nightmare scenarios IE users have had to face in the past.
The only reason I can think that people who know better still continue support their broken Microsoft products is that they happened to be using them when it was pointed out that those products were for chumps. --Jeez. Just change products. Don't play at denial crying, "NO! IE is a good product! I define myself through the products I use! So you MUST be wrong, otherwise I'll feel bad! I'm not a chump! I'm NOT! --And I'm going to keep on using my broken software just to prove it to you! Mozila sucks! I LIKE having zero control over the images displayed on my browser! If it weren't for pop-up ads, how would I know which things I'm supposed to buy?"
Low self-esteem makes people pick the dumbest and most un-worthy battles to fight.
-FL
This has less to do with coding and more to do with your instal system.
This makes no sense to me, please explain.
Just because you don't know who fixed it and they may not have pushed back their fixes doesn't mean it ain't fixed.
And, worse case, you could always fix it yourself if it's such a big deal to you.
paintball
I think Mozilla users (myself included!) have been enjoying a lot of "security through obscurity", since up to this point, no one really cared to find all the (likely numerous) exploits in our favourite browser. With all the recent media coverage, there are going to be a lot more people trying to find the "holes" (for variuos reasons, reporting, exploiting, etc.). I hope this leads us all to examine the security aspect a bit more closely, there is a long way to go before we can truly browse "safely".
That said, I wouldn't switch back to IE if you paid me...
If you buy a copy of XP, you'll get SP2 included now.
paintball
...perhaps they could fix the horrible bug that causes both firefox and mozilla proper to stall indefinitely when trying to connect to a random site.
It's embarrasing as much as anything else giving a windows-using friend Firefox to replace IE, only to find that 1 out of 10 page loads fail, and they go back to "good old" IE, oblivious to the security hole he's just let himself in for.
"Nine times out of ten, starting a fire is not the best way to solve the problem." - my wife
You didn't read *all* TFA correctly. From the Secundia site about the "less critical" download issue:
The vulnerability has been confirmed in Mozilla 1.7.3 for Linux, Mozilla 1.7.5 for Windows, and Mozilla Firefox 1.0. Other versions may also be affected.
Hopefully a mod will raise one of the posts correcting yours to the same "Score 5 Informative" soon. Or an editor will add the Register summary to the article and save quite a few people some anxious reading through these threads.
The problem with #3? I want to see other user's browsing habits and if they don't like it, tough.
Edit->Preferences
Web Features
Advanced
uncheck "Change status bar text"
Don't thank God, thank a doctor!
Unchecking "allow web sites to... change status bar text" only prevents one method of making a link take you to a different URL than what is shown in the status bar. The other method is to change the link's target as soon as you click on the link. You might have to disable JS to prevent web sites from doing that.
The shareholder is always right.
I think you'll find that's the case with Linux, not Mozilla.
I think you meant Linux not Mozilla.
Mozilla is actually quite a decent, well-managed, and guided project, unlike Linux.
One difference that jumps right to mind is licensing.
I know the with an update that firefox asks me to do it wont change the license in any meaning full way. I have zero reassurance of this from MS. If Joe Six-pack sees his computer tell him that he needs to update, he isnt going to read the license and even if he DOES may not understand that MS has bought his soul.
What do you say to the man that has nothing? Cast it away!!
I wrote:
roca replied:
I don't disagree with your comments about this specific vulnerability. My argument is more that if your development processes allow one buffer overflow, then you could allow any number of others, and potentially never notice.
The key point is that buffer over-runs really should never happen in C++, ever. The language provides a wide range of programming tools, and the kind of really low-level stuff that can achieve buffer over-runs -- pointer arithmetic or unchecked array indexing being the most likely culprits -- really should be confined to a small amount of very heavily tested library code.
That means if a buffer over-runs is ever detected, even once and even in beta code, then there is a serious flaw in the coding standards/code review processes/QA of the project. It implies that either unsafe tools are being used at too high a level, or that the reviews and standards for the low-level code are seriously deficient. In either case, if that's the project ethos, you can never trust that there aren't other over-runs that might be more exploitable elsewhere in the project. (It's also a bit of a killer for the "many eyes" theory of greater reliability for OSS projects, but perhaps that's best left for another discussion.)
Personally, I've always been quite impressed with the Mozilla browser/Firefox code quality. They seem to achieve a remarkably correct and reliable application. In this particular area, though, they clearly suck as much as many other projects (and even document that they do).
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
flamebait? how the hell is that flamebait? the guy asked why people tout open source software for its "quick response" to bugs, and i pointed out that in the case of the OT, the software in question was not open source.