Slashdot Mirror

← Back to Stories (view on slashdot.org)

Unpatched Firefox Flaw May Expose Users

Posted by Zonk on from the again dept.

Corrado writes "CNET is reporting on a new Firefox flaw." From the article: "The problem lies in the way Firefox handles Web links that are overly long and contain dashes, security researcher Tom Ferris said in an interview via instant messaging late Thursday. He posted an advisory and a proof of concept to the Full Disclosure security mailing list and to his Security Protocols Web site...The public bug disclosure comes just as Mozilla released the first beta of Firefox 1.5. The final release of the next Firefox update, which includes security enhancements, is due by year's end, according to the Firefox road map."

4 of 390 comments (clear)

  1. Re:Well, just another bug by DaHat · · Score: 4, Informative

    No need to bring up just this bug, why not compare history for the last year on both IE6 and Firefox 1.x?

    According to Secunia, during 2005 IE6 has had 11 advisories while Firefox 1.x has had 18.

    Unfortunately I can't get the links to work properly (graphs come up blank), so take a look at the URL's yourself:

    IE6: http://secunia.com/graph/?type=adv&period=2005&pro d=11
    Firefox 1.x: http://secunia.com/graph/?type=adv&period=2005&pro d=4227

    (you will have to copy and paste these URL's to make them work it seems)

    --
    Help Brendan pay off his student loans
  2. For all those that can't reproduce by revelation0 · · Score: 5, Informative

    Take 2 seconds to check out his proof of concept:

    http://www.security-protocols.com/firefox-death.ht ml

    WARNING: Clicking the above link will crash firefox. It will do nothing else. The hyphens are not normal minus hyphen (the - symbol on your american keyboard will translate to 0x2d) but a soft hyphen (0xad).

    1. Re:For all those that can't reproduce by MrMr · · Score: 4, Informative

      Yep, lethal if network.enableIDN is true,
      no problem if set to false in about:config

  3. Re:Proof of concept by sprag · · Score: 4, Informative
    Its not dashes that do it, but soft hyphens (0xad). There's a link in another thread which has the apropriate HTML, and it does hang Firefox 1.06 on Fedora 4.

    Here's an xxd dump of the offending HTML:

    0000000: 3c41 2048 5245 463d 6874 7470 733a adad <A HREF=https:..
    0000010: adad adad adad adad adad adad adad adad ................
    0000020: adad adad adad adad adad adad adad adad ................
    0000030: adad adad adad adad adad 203e 0a .......... >.