Slashdot Mirror
Mozilla / Firefox Memory Exposure Vulnerability
JimmyM writes "Secunia has a story regarding a new severe vulnerability in the Mozilla Suite and Firefox browser, which can be exploited by any web site to read all memory, which the browser process has access to. No patch is available from Mozilla. A demonstration is available here."
Did the Mozilla/Firefox guys ignore a warning about this, or did this site publish the vulnerability without giving them a chance to patch?
Can a remote site actually get access to this information, or is it only displayable on the screen?
I seem to recall that every time an IE bug appeared people would say that Mozilla was much more secure, and that it wasn't just that IE was targetted by hackers because of the popularity, but that the software was inherently more secure.
But now it seems there are patches for Mozilla every few weeks for _exactly_ the same kind of problems that IE used to get slated for.
Is Mozilla actually more secure? Or is it just as bad as any other piece of software?
My Journal
all those l33t hackers will be able to see all my pr0n!
It looks like, in order to make use of this flaw, the attacker must get the victim to run Javascript.
/.). Javascript is fine for sites that need to do some client side processing (e.g. order entry sites which use JS to compute the order amounts to avoid a round-trip to the server). Flash is fine for some applications.
Once again demonstrating the danger in the current mindset of "I will use Javascript to do everything, even things that can be done with plain HTML like opening a new window".
I have my Mozilla configured to ask me if I want it to fetch Javascript from remote sites (alas, you cannot protect yourself from Javascript embedded in the HTML of the site you are visiting), to ask me if I want to run any requested plugins, and to ask be before allowing any cookies to be set on my browser.
If you can, try this yourself - you will be AMAZED at the number of sites that insist upon setting a cooking on you the first thing when you visit them, or that insist upon trying to load Javascript, or Flash plugins.
Cookies are fine for sites which require log-in (e.g.
But please don't over use them.
www.eFax.com are spammers
This is a *huge* hole. In three clicks, it disclosed previous URLs that I had visited, POSTDATA (including my Slashdot password) and a bunch of other stuff.
If this could be automated (and it easily could be with something like XML-RPC), imagine the possibilities for phishing. Visit a page, have your credit card number disclosed.
Time for Firefox 1.03.
Just for grins, I tried it wi IE and Opera. Just threw up a bunch of XXXXX in the text box.
Clearly a Mozilla-specific problem.
Ignorance is curable, stupid is forever.
It works if you don't click quickly and repeatedly in Firefox.
It's almost scary... the JavaScript for this looks to just abuse a buffer overflow in an almost scary-easy way.
function genGluck(str){
var x = str;
var rx=/end/i;
x = x.replace(rx,function($1){
$1.match(rx);
return "";
});
x = x.replace(/^end/,"");
return x;
}
function readMemory()
{
var mem = genGluck("{10,246 "X's" here}end");
mem = mem.replace(/[^\.\\\:\/\'\(\)\"\_\?\=\%\&\;\#\@\- a-zA-Z0-9]+/g, " ");
document.getElementById('result').value = mem;
}
A community-oriented lyrics site
just displays all "XXXXXXXXXXX" for me.
using OSX with nightly builds auto-downloaded with FireFix (which is a really neat app)
In addition to a bunch of Xs, Safari threw a little piece of Javascript code not originating on the source page into the end of the text box. Looks light it might be a little vulnerable too.
Download the latest patched version right here: http://ftp.mozilla.org/pub/mozilla.org/firefox/nig htly/latest-trunk/firefox-1.0+.en-US.win32.install er.exe
I just used it and I am not vulnerable: all I see are lot's of X's just like in IE.
This data is available to the javascript engine then, so it is possible for the javascript to submit it a number of ways to an internet server. It could call a web service with the data or post it to a web page. The server could then organize this data and examine it for anything interesting.
This will not allow someone to read your personal files or hijack your computer. The real problem would be if stored passwords or sensitive data from web mail or banking sites were on the heap and were found this way and transmitted to a web site. A large amount of 'Junk' would have to be sifted through in order to get any juicy data though.
The only way to be save right now is (in FireFox) to go to Tools->Options, go to "Web Features", and uncheck "Enable Javascript". Seeing as many sites (including /.) require javascript to use, this really isn't a good option. I hope the team gets a fixed version out soon.
I don't normally complain about the grammar and punctuation of submitters and editors, but in this case it is too significant. The difference between
and
Is profound. The first form says that the browser has access to all memory. The second form says that the web site has access to all the memory to which the browser also has access. Catching and fixing stuff like this is what an editor does. If Slashdot's people can't do that, then don't call them editors. Call them "Dudes Who Click Approve," or something like that.
The first time I tried it, it didn't merely crash Firefox. When I clicked the "test now" link my entire system immediately died, and began rebooting. After reboot, the test now works (and confirms my vulnerability).
Windows 98 SE, Firefox 1.0.2.
K-Meleon has the same problem, only it probably won't be patched for months, forcing me back to Firefox. Bah.