Slashdot Mirror
Mozilla / Firefox Memory Exposure Vulnerability
JimmyM writes "Secunia has a story regarding a new severe vulnerability in the Mozilla Suite and Firefox browser, which can be exploited by any web site to read all memory, which the browser process has access to. No patch is available from Mozilla. A demonstration is available here."
Did the Mozilla/Firefox guys ignore a warning about this, or did this site publish the vulnerability without giving them a chance to patch?
All it does is crash Firefox.
Can a remote site actually get access to this information, or is it only displayable on the screen?
I seem to recall that every time an IE bug appeared people would say that Mozilla was much more secure, and that it wasn't just that IE was targetted by hackers because of the popularity, but that the software was inherently more secure.
But now it seems there are patches for Mozilla every few weeks for _exactly_ the same kind of problems that IE used to get slated for.
Is Mozilla actually more secure? Or is it just as bad as any other piece of software?
My Journal
all those l33t hackers will be able to see all my pr0n!
Crashed firefox when I tried it.
Best Windows Freeware
...is faster at fixing serious security flaws than closed source. Now this here is a fairly nasty vulnerability; not as bad as remote code execution, certainly, but still something I'd want fixed on my mum's PC as quickly as possible. So I'm wondering, just how long will the Mozilla foundation take to distribute a fix for this vulnerability - not just patch it in the nightlies, as that is trivial - but include it in an automatic update, like Microsoft would? I'm betting on weeks or months (not flame-baiting here, but so far most Firefox fixes have trickled down very slowly.) It will be interesting to watch and see.
It looks like, in order to make use of this flaw, the attacker must get the victim to run Javascript.
/.). Javascript is fine for sites that need to do some client side processing (e.g. order entry sites which use JS to compute the order amounts to avoid a round-trip to the server). Flash is fine for some applications.
Once again demonstrating the danger in the current mindset of "I will use Javascript to do everything, even things that can be done with plain HTML like opening a new window".
I have my Mozilla configured to ask me if I want it to fetch Javascript from remote sites (alas, you cannot protect yourself from Javascript embedded in the HTML of the site you are visiting), to ask me if I want to run any requested plugins, and to ask be before allowing any cookies to be set on my browser.
If you can, try this yourself - you will be AMAZED at the number of sites that insist upon setting a cooking on you the first thing when you visit them, or that insist upon trying to load Javascript, or Flash plugins.
Cookies are fine for sites which require log-in (e.g.
But please don't over use them.
www.eFax.com are spammers
https://bugzilla.mozilla.org/show_bug.cgi?id=28868 8
Apparently this was a bug reported on previously and patched 4/1/05. Not sure it was a really very generous of Secunia to release an exploit so soon.
Wouldn't it have been better to give mozilla/firefox a chance to release a new version?
This is a *huge* hole. In three clicks, it disclosed previous URLs that I had visited, POSTDATA (including my Slashdot password) and a bunch of other stuff.
If this could be automated (and it easily could be with something like XML-RPC), imagine the possibilities for phishing. Visit a page, have your credit card number disclosed.
Time for Firefox 1.03.
Just for grins, I tried it wi IE and Opera. Just threw up a bunch of XXXXX in the text box.
Clearly a Mozilla-specific problem.
Ignorance is curable, stupid is forever.
It works if you don't click quickly and repeatedly in Firefox.
It's almost scary... the JavaScript for this looks to just abuse a buffer overflow in an almost scary-easy way.
function genGluck(str){
var x = str;
var rx=/end/i;
x = x.replace(rx,function($1){
$1.match(rx);
return "";
});
x = x.replace(/^end/,"");
return x;
}
function readMemory()
{
var mem = genGluck("{10,246 "X's" here}end");
mem = mem.replace(/[^\.\\\:\/\'\(\)\"\_\?\=\%\&\;\#\@\- a-zA-Z0-9]+/g, " ");
document.getElementById('result').value = mem;
}
A community-oriented lyrics site
Javascript anywhere on the page executes as it is parsed.
just displays all "XXXXXXXXXXX" for me.
using OSX with nightly builds auto-downloaded with FireFix (which is a really neat app)
who the hell moded this flamebait. ,?
Please explain to me why this is flamebait could you...
All he is doing is expanding on the problem and asking for more details
-mike
In addition to a bunch of Xs, Safari threw a little piece of Javascript code not originating on the source page into the end of the text box. Looks light it might be a little vulnerable too.
Download the latest patched version right here: http://ftp.mozilla.org/pub/mozilla.org/firefox/nig htly/latest-trunk/firefox-1.0+.en-US.win32.install er.exe
I just used it and I am not vulnerable: all I see are lot's of X's just like in IE.
This data is available to the javascript engine then, so it is possible for the javascript to submit it a number of ways to an internet server. It could call a web service with the data or post it to a web page. The server could then organize this data and examine it for anything interesting.
This will not allow someone to read your personal files or hijack your computer. The real problem would be if stored passwords or sensitive data from web mail or banking sites were on the heap and were found this way and transmitted to a web site. A large amount of 'Junk' would have to be sifted through in order to get any juicy data though.
The only way to be save right now is (in FireFox) to go to Tools->Options, go to "Web Features", and uncheck "Enable Javascript". Seeing as many sites (including /.) require javascript to use, this really isn't a good option. I hope the team gets a fixed version out soon.
I don't normally complain about the grammar and punctuation of submitters and editors, but in this case it is too significant. The difference between
and
Is profound. The first form says that the browser has access to all memory. The second form says that the web site has access to all the memory to which the browser also has access. Catching and fixing stuff like this is what an editor does. If Slashdot's people can't do that, then don't call them editors. Call them "Dudes Who Click Approve," or something like that.
maybe my ubuntu hoary system is patched? or this doesn't affect linux?
What comes first, finding a teacher or becoming a student?
"This "gator" is trolling like a cumsnake trolls for cum."
Good job proving his point, jack ass.
Firefox Version 1.02: Clicking the link repeatedly and quickly causes a crash. Any others have the same thing happen? If so, this could be a bigger problem than just a security hole.
I'm running Firefox 1.0.1. I'm STILL waiting for the updater to report that 1.0.2 is available. Even if I manually tell it to check for updates, it says none are available.
If they haven't even put 1.0.2 onto the autoupdater, how long will it be before patches like this make it out? It's pretty stupid.
K-Meleon has the same problem, only it probably won't be patched for months, forcing me back to Firefox. Bah.
would it be a sufficient workaround?
I'm pretty sure they have put 1.0.2 on the autoupdater...
Whether it's open source or not doesn't mean much with respect to security.
;) ) means there are a fair number of not that obscure security bugs left to be found.
;) ).
;).
;).
If you can't or don't want to do an audit of the source, it's usually safe to assume it's probably just as bad as whatever software the Mozilla programmers used to write.
A good tree produces good fruit. A bad tree produces bad fruit. Sure you can get a tree to change, but it often takes years (see BIND, Sendmail).
The fact that Mozilla crashes regularly (but not so predictably) on normal use (well at least my normal use
If it crashed predictably in only a few scenarios, then there are significantly fewer obvious bugs left to fix.
I've already said something similar about Mozilla before. (it's modded -1 for some reason
Anyway it looks like I've been vindicated. Within 2 weeks too
I used to work in the IT security line. I think I've learnt at least a thing or two...
Here's a free tip: Run your browser as a different user. You can do that in Linux/*BSD and Windows XP/2000. Use google and figure out the implementation details.
Your browser data will still be vulnerable to attackers, but if you set up the permissions correctly, the data and documents owned by your normal user account will be safe.
If you are paranoid you can also use a different browser user for different security levels/realms (e.g. mozbank for banking, mozprivate for other important stuff, moznormal for normal sites, mozother for unknown sites ).
If you do that try to have different browser schemes/colours too. That way it's easier to know when you're using the wrong browser for the wrong site
Also may wish to do stuff like: have the bank browser's homepage as the bank site, and have it only allow javascript etc to be on for the bank URLs - other urls just don't get javascript and other stuff active.
Sure it's a bit of work to set it up, but once you've got it setup it's not so hard - think of the different browsers as separate apps.
Also make your GUI preferences a slightly different colour from the default. So if a attacker plants a trick window, hopefully it won't match and you'll notice.
This won't protect you from GUI overflow bugs or "shatter" attacks in the case of Windows. But I believe hackers will find attacking the other users easier.
I personally use a virtual machine to browse unknown sites, or untrusted sites that require javascript/flash. Just a click of a button and the virtual machine is back to a known state.
That said I've managed to crash vmware. Just a DoS - (the vmware people that I emailed said they didn't think it's exploitable). When I've more time maybe I'll go check it out.
I'm still not seeing it. If it has already been released, then there is a bug at work. Either way, something has to be fixed.