Slashdot Mirror
New Mozilla Firefox 1.0.3 Exploit
An anonymous reader writes "News sources are reporting that a 'killer' new Firefox exploit has been revealed today by FrSIRT who warn that this 0day exploit/vulnerability (as yet unpatched) should be rated as critical. Summary of the exploit: If a user clicks anywhere on a specially crafted page, this code will automatically create and execute a malicious batch/exe file. Proof of concept code supplied by FrSIRT."
Maybe it's time to accept Firefox has it's fair share of exploits?
And the best part, is the patch management system in Firefox is so damn poor (ie. non-existant), getting these patches distributed to end-users is a real damn chore (assuming they are distributed at all).
It looks like a hacker alias, but it really stands for French Security Incident Response Team. Exploit description cached here.
---- Just another spud server.
Subj says it all. That html page after loading into firefox gives javascript error on some line according to JS console...
Does it work really?
...with Firefox 1.0.3 on Windows 2000, and it didn't execute anything. Anyone else try it on Windows?
Just curious, I downloaded the page and loaded it up on several systems:
Win XP, Firefox 1.0.3
Win 2k, Firefox 1.0.3
FreeBSD, Firefox 1.0.3
and none of them did anything. The javascript looks like it should save a file (c:\booom.bat) and run it which should echo "malicious commands here" and wait for a keypress.
Is this truly an issue with Firefox and not some other software? If so, any ideas why it doesn't work?
Copy and page parent link into new tab or Firefox/Mozilla users set "network.http.sendRefererHeader" in about:config to 0 and then click.
interesting - even when you go past the "cant view bugs from slashdot" stuff,
Speaking of which, is there a way to turn off referrer information in firefox? It seems to me to be a big privacy problem, and it adds almost no functionality. I really have no incentive to tell other people what sites i'm browsing, so I'd rather not.
Give me Classic Slashdot or give me death!
Excellent analysis. Wish I could mod you up, but hopefully others will take it upon themselves to do this. There is some light at the end of the tunnel, however; I gather that the installed version of Firefox spans several small-ish files, and that the next Firefox version (i.e. 1.1 onwards) will be geared towards swapping out just the files that cause the problem, alleviating the large downloads (and general inelegance) of performing a full download & re-install every time a patch is required.
I tried the proof-of-concept exploit provided, but it didn't seem to work. I loaded the page, and clicked it like a mad-man.. nothing.
My system is GNU/Linux running Firefox 1.
If you are running your web browser as root, and you get rooted, then it is your fault.
Don't run as root unless you have to.
I'll probably be modded down for this...
Hmmm... with all the strong support of Opera users from /. a few weeks ago about the launch of 8.0 there hasn't been a comment on Opera yet.
Well Opera doesn't seem to have this vunerability or IE's woes
Well that's the essential question. If it doesn't I'd rather flee to mozilla suite than IE.
"It's a severe security-related bug, so the bug report is restricted."
And yet, when Microsoft does this, somehow it's "reprehensible".
Isn't the Open-Source model supposed to be, you know, open? The exploit is already in the wild. Blocking access to the bug doesn't do any good.
Anyhow quoting the article:
Joe Llywelyn Griffith Blakesley
[This post is in the public domain (copyright-free) unless otherwise stated]
The design is flawed.
... activex LOL", when FF does in fact have a nearly identical feature as ActiveX. And when there's a mechanism for installing program files from webpages, people will tend to find holes in the sandbox. Hopefully this quiets the "better by design" crowd.
Agreed -- and even worse, the design was copied directly from Microsoft's ActiveX system!
It's a bit frustrating to see Firefox advocates continually prattle about "Security
Whenever I hear the word 'Innovation', I reach for my pistol.
>>Its too bad it has obnoxious ads, its javascript sucks, and it is proprietary though.
Proprietary, heaven forbid!
Javascript works just fine. When you don't see a site working properly, it's the script that's the problem. Opera 6 was very stringent about adhereing to Ecmascript standards. Opera 7 relaxed that a bit, and version 8 even more.
It's very easy to make the ads away (which are not at all obnoxious or intrusive to begin with).
Simply register the software.
Ryosen
One man's "Troll, +1" is another man's "Insightful, +1".
The devs were already working on it before some jerk full-disclosured w/working exploit.
Well double dumbass on the Mozilla developers for knowing about it and not taking steps to mitigate it even without an exploit in the wild. Calling the person who released it a "jerk" just shows that you have no understanding that a security risk is severe, whether or not anybody knows about its existence. It's said time and time again, but nobody ever listens: security through obscurity is not security. The person who posted it wasn't a jerk - that's just blaming somebody else for the Mozilla developers' failures. Stop pointing the finger, fix the damn problem, and release a patch before Monday morning.
[Disclaimer: I'm a Mozilla lover, not a Mozilla hater, but lovers can still have quarrels. I've used Phoenix/Firebird/Firefox exclusively since a week after Phoenix 0.1 was made public, and I've been a heavy advocate for it from day 1.]
Well double dumbass on the Mozilla developers for knowing about it and not taking steps to mitigate it even without an exploit in the wild.
There was nothing the Mozilla developers COULD do to mitigate it. Only when we (the Mozilla Update devs) realized exactly how the exploit depended on the Mozilla Update website could we do anything - and we spent a few hours last night working on the first level of mitigation. We've been working on a better solution most of today.
Calling the person who released it a "jerk" just shows that you have no understanding that a security risk is severe, whether or not anybody knows about its existence.
Yes, and it becomes a lot more severe once an exploit is posted for all the script kiddies to use. Do you really think we're better off now that any idiot can own a Firefox user's machine, rather than just the white hat who reported the hole (plus at most a few black hats)?
It's said time and time again, but nobody ever listens: security through obscurity is not security.
Obscurity is a valid layer of security, so long as it's not the only one. The fact that somebody felt it was wise to strip us of one layer of protection is what is annoying.
If one of the doors to your house had a broken lock, would you rather have that be a secret until you can get to the hardware store and fix it, or have someone inform the whole neighborhood? Of course you'd PREFER to not have a broken lock at all, but in the real world, things don't always go the way you want.
The person who posted it wasn't a jerk - that's just blaming somebody else for the Mozilla developers' failures. Stop pointing the finger, fix the damn problem, and release a patch before Monday morning.
Nobody blames the person who leaked it for the hole - I blame the person who leaked it for the people who get hacked as a result of the posted exploit.
My server