2 Firefox Security Flaws Lead to Exploit Potential

Marthisdil points out a News.com story which reports that "Two vulnerabilities in the popular Firefox browser have been rated "extremely critical" because exploit code is now available to take advantage of them." Security firm Secunia reported the vulnerabilities (and the "extremely critical" rating is theirs), but the News.com story points out that thus far, "no known cases have yet emerged where an attacker took advantage of the public exploit code." Update: 05/09 20:20 GMT by T : Rebron of the Mozilla Foundation sends a correction; this is really the same flaw reported yesterday. He suggests that you glance at the Mozilla security alert on this hole (as well other alerts at the Mozilla Security Center), and says "The Mozilla Foundation has made changes to our update servers that will protect users from this arbitrary code execution exploit."

Comments

Don't downplay it

[Anonymous Coward]

Come on, timothy. This is hardly the time to be downplaying the severity, even though we all like Firefox. There are undoubtedly people using the posted code, and they wouldn't be likely to tell News.com about it. Everyone should upgrade immediately.

Re:sorry..

[ViperG]

Well, I would agree, but then why does slashdot post every IE bug that comes up?

Mozilla's Security?

[sterno]

Mozilla and Firefox have been recommended as alternatives to IE for security reasons. Yet, lately, it seems that there's quite a lot of security problems being uncovered in Firefox. So I'm trying to figure out how to read this.

I suspect that Firefox is somewhat more secure on the simple basis that it is not as tightly integrated with the rest of the operating system as IE is. What makes IE exploits so nasty is that they tend to become email and other exploits too.

My concern is that if Firefox gains some more ground and does become a more active target for exploits, that it may become a poster child Microsoft can use to point out that open source software's "many eyes" theory is hogwash. Maybe it is hogwash.

Re:Mozilla's Security?

[Uruk]

A few points to consider when you're evaluating the security of software:

• Security issue visibility is not the same thing as security. Just because IE has more exploits publicized (or Firefox has more) doesn't actually mean they're more or less secure, it means they're getting more public attention about their security. Important difference. If someone has an objective, quantitative, and verifiable way of measuring a piece of software's security so that we can actually make these comparisons, I'd love to see it
• The more users use a piece of software, the more it will be targeted. But again, that's not the same thing as saying "the more it will be exploited"
• Most users ultimately decide based on personal experience, which typically trumps abstract reporting. Have you ever had a problem with Firefox? Have you ever had a problem with IE? I'd suspect most people who switched to Firefox did it because they actually experienced a problem with IE, not because it was more ideologically pure.

Re:Mozilla's Security?

[buhatkj]

I dunno, I just use firefox because I like it better. The tabbed browsing is awesome and it feels a little faster on my PC than IE. A little experience in network administration has showed me that the best security is physical security, and even that sucks. The web is not safe...nothing is really. "safe" is kind of a subjective and largely meaningless term anyway, without a qualifier of "more" or "less". eg. "Wearing a seatbelt is more safe than not wearing one." Either way, there's a good chance that if you crash bad enough you're toast ;-)

SO, not to get too wierd on anyone...really, it's all probably hogwash, the whole bloody pursuit of "safety and security". Take the obvious precautions yes(update your software, use a firewall...), but don't get all surprised and indignant when somebody figures out how to break them!

Re:Mozilla's Security?

[Blkdeath]

I don't run Firefox because I find it inferior to IE in rendering pages as they were intended (yes, we live in an IE world, deal with it).

I used to think the same thing, but I stuck it out and just dealt with the incorrectly rendered pages. Of course there have always been / will always be people who think like you, but the fact is many (most) pages now render correctly in FireFox.

As alternate browsers are again being recognized as statistically significant companies and even hobbyist webmasters are starting to realize their value. If you see a site that isn't rendering correctly, contact the site owner and inform them. Your message might not turn the tide, but perhaps combined with the 5-6 they received last week yours will be enough to convince them of the advantage of compliance.

Please, though, don't send a nasty-gram espousing the virtues of open source, criticizing Microsoft (no need to even mention MS/IE) as it destroys all of our credibility.

What Firefox needs is...

[turbofisk]

What Firefox (and the rest of the suite) is a good way to upgrade the software, without installing everything as a new user would... This is something they really should fix...

It was expected

[mpontes]

With the spotlight on Firefox, it's obvious a lot more crackers and hackers are going to start looking at Mozilla Foundation's code. While previously there was little incentive for crackers to exploit vulnerabilities in MoFo's code, you can't say that now, with all the attention Firefox caught.

It's up to MoFo to fix their software as soon as vulnerabilities are reported now. The play time is over, from now on it's going to be Browser Wars II: The Security Menace.

Balanced?

[PDHoss]

"no known cases have yet emerged where an attacker took advantage of the public exploit code."

I appreciate this clarification. And I'm sure such a clarification will be included in the next IE bug report posted on Slashdot... Right?

PDHoss

Re:Bug Details - Poison DNS

[Chairboy]

So combine this with a poisoned DNS attack. update.mozilla.org resolves as your malware server, then you use this exploit.

Sure, it makes it a little harder to execute then, say, something like Nimda that could run free across the internet, but it's still a valid security issue.

Re:asdasd

[Dionysus]

Hmmm... this bug affects Firefox 1.0.3. Going to mozilla.org, there are no update to 1.0.3. The browser hasn't notified me that there is an update available. So where is the update? Or do you expect people to download the nightly?

Re:And to think...

[mattstorer]

There is nothing in FireFox's architecture which makes it a more secure alternative to IE

except that IE is tied very tightly (I was going to say "securely," but really, it's not that secure) into Windows, whereas Firefox is not. The more levels of separation you can have between the app and the OS, the better.

the benefit of using Firefox also has to do with response times - the Moz. Foundation has been extremely quick to patch holes once detected, while critical holes in IE, if history is our guide, stay open way longer than they should.

IMHO, much of this has to do with Mozilla being far more invested in the well-being of Firefox than Microsoft is in the well-being of IE. Think about it - how many products does Microsoft have to maintain, versus the Mozilla Foundation? To Mozilla, the well-being of Firefox is not just a minor detail to contend with; it's much much bigger, so gets all the swifter attention.

-matt

Re:sorry..

[Anonymous Coward]

Because this is Slashdot, an extremely biased site that often reports opinions as news, and where the editors do all they can to promote flaming and bashing by adding inaccurate titles to the articles they post.

The articles here _aren't_ supposed to be impartial and the user comments _aren't_ supposed to be insightful. Slashdot is all about preaching to the choir - if you want something else, I suggest you find a legimate news site.

Re:And to think...

[AviLazar]

Think about it - how many products does Microsoft have to maintain, versus the Mozilla Foundation?

Don't you think this is a bit of a skewed statement? MS has departments, many of them. There is probably an IE department and it's sole purpose is IE. It may not have any conversations with any other departments with the exception of "Will IE still work with the rest of Windows? It does? Great, going back to my cave."

Re:See! See!

[CaymanIslandCarpedie]

Hey, I'm not saying this hole will be expoited by anyone. I'm just saying its not fixed. With your "one down" comment you seemed to imply this issue was fixed. It is not at all!

Mozilla has done a server-side workaround to mitigate this issue but the Firefox (client-side app) has had nothing done to it. The issue is still 100% there. Again not saying this will effect anyone, but to say the bug has been fixed is just WRONG. The bug is in client-side code and that client-side code will need to be fixed, not just a server-side workaround.

Again, most likely nothing will come of this, but I just thought viewers who saw your original comment would be misled into thinking the client-side bug was been fixed (which is not the case).

Hey!

[antoy]

I'm surprised (or maybe I missed something). Why is noone asking the real questions here?

Sure, Firefox had two security flaws. Okay. HOW were those vulnerabilites found? Were they found because Firefox is an open-source program, and has the 'many eyes' advantage? Were the people who found them going through the code, evaluating and auditing it function-by-function is search of flaws?

Or were they testing against it in the traditional way, the way IE vulnerabilities were found? Or maybe a combination of the two?

The article doesn't say, but I believe this is more important to know than the current count on a Firefox/IE vulnerability pissing match. It's the best example (or counter-example) of open-source security in action that we have. If anyone can supply this information, I (and others, perhaps) will be most grateful.

Uh huh

[Myopic]

Can you imagine what would happen if bugs in proprietary software (I'm thinking of Windows or IE) were considered "extremely critical" as soon as an exploit was solidified in code? I mean, if "extremely critical" corresponds to "it is *possible* to exploit this bug" then what is the term to describe a bug which in fact is wreaking havoc on worldwide information infrastructure (as many Windows bugs)?