Unpatched Firefox Flaw May Expose Users

Corrado writes "CNET is reporting on a new Firefox flaw." From the article: "The problem lies in the way Firefox handles Web links that are overly long and contain dashes, security researcher Tom Ferris said in an interview via instant messaging late Thursday. He posted an advisory and a proof of concept to the Full Disclosure security mailing list and to his Security Protocols Web site...The public bug disclosure comes just as Mozilla released the first beta of Firefox 1.5. The final release of the next Firefox update, which includes security enhancements, is due by year's end, according to the Firefox road map."

Comments

Tell all your friends!

[CyricZ]

If you have gotten your non-techie friends to switch to Firefox, be sure to tell them about this problem and the possible fixes. Indeed, it is very important that Firefox be kept up to date on as many computers as possible, even if it means a short trip to install it for somebody. Nothing will hurt Firefox's reputation more than unpatched installations being exploited.

Re:Tell all your friends!

[killproc]

"If you have gotten your non-techie friends to switch to Firefox, be sure to tell them about this problem and the possible fixes. Indeed, it is very important that Firefox be kept up to date on as many computers as possible"

Not trying to troll here, but...

Couldn't the same be said for IE or any other browser? If you have non-techie friends that could be vulnerable on any platform, wouldn't letting them know how to check for security updates be the right thing to do?

Should you let them flounder and possibly become zombies for some nefarious spam network because they don't use your "preferred" browser?

Personally, I use Mozilla at home because I like it much better, and encourage all my friends to do the same, but I'm not above recommending security updates to those who choose not to use Mozilla/Firefox.

Re:Tell all your friends!

[AKAImBatman]

I was thinking the same thing. All browsers are vulnerable and all will need to be updated.

The ridiculous part, though, is that software doesn't *have* to be vulnerable to buffer overflows! We've had languages for more than 20 years that are completely invulnerable to such a simplistic attack. Even C/C++ have large numbers of libraries available to make such overflows a thing of the past. Yet here we are in 2005 and the number one exploit across systems is still...

(wait for it)

Buffer overflows.

Am I the only one who's getting just a smidge annoyed by this? No wonder we don't have any flying cars! We can't debug the darn things worth a damn! ;-)

He sounds like a self-promoting twit

[93 Escort Wagon]

I can see why some folks will publicize exploits if they feel the software maker isn't responding in a timely manner. But c'mon - he just reported this to the Mozilla folks on Sunday!

Re:He sounds like a self-promoting twit

[tdvaughan]

Responsible vulnerability reporting doesn't necessarily mean telling everyone possible (including proof-of-concept exploit code) as soon as you discover a vulnerability. Some people allow the vendor/maintainer 30 days to make an appropriate response (e.g. investigating the vulnerability and making a commitment to fixing it) and a further 30 days on top of that to provide a fix before going public. Regardless of how long you think a vendor should be given, though, going public immediately makes me wonder if his priorities are personal gain rather than trying to improve the software's security.

Re:Flaws

[Anonymous Coward]

Oh please, how is a heap overflow of 0x78787878787878... going to be exploitable. This looks like just a regular crash, if these turn you on just watch bugzilla for a few days, they turn up all the time.

A browser is a complex piece of software, of course there are going to be subtle bugs that turn up now and then. Nobody is perfect, and visualizing every possible execution path through a billion SLOC application is impossible. Please stop making a fuss about "OMG BROWSER DoS!!".

Re:Patent infringement

[SonicBurst]

The new patching system is awesome. Binary diffs, so no downloading huge files, it downloads in the background so it doesn't disturb you, and installs when you restart firefox. It's amazingly convienient.

Yes, but would you have said the same thing if you had replaced the word firefox with the word windows in that sentence? I say that only because that's what WAU does these days, though I forget for how long it has been doing the binary diffs. I think that came along with the latest BITS update sometime in early summer this year, but can't be sure. Just FYI.

possible bugzilla bugs

[molo]

Between 2005-09-03 and 2005-09-06, there were several bugs reported to Mozilla that are now marked hidden. Expect one of them to become visible now that this is announced. (note: bugzilla blocks slashdot referer, so cut&paste is needed, watch out for the extra space)

https://bugzilla.mozilla.org/show_bug.cgi?id=30693 9
https://bugzilla.mozilla.org/show_bug.cgi?id=30694 0
https://bugzilla.mozilla.org/show_bug.cgi?id=30703 1
https://bugzilla.mozilla.org/show_bug.cgi?id=30704 0
https://bugzilla.mozilla.org/show_bug.cgi?id=30708 4
https://bugzilla.mozilla.org/show_bug.cgi?id=30708 7

BTW, why is it necessary that so many bug reports be hidden? They can't all be valid security bugs, can they? Besides, full disclosure and an open development model go hand-in-hand.

-molo

Re:Well, just another bug

[footissimo]

What about how 'critical' the bugs are rated or how long it takes for each to be fixed? Are the problems with ActiveX included?

MS vs Firefox is irrelevant

[mccalli]

I'm reading a depressingly large number of predicatble off-pat responses - "So? IE is far worse. Microsoft sucks!".

Honestly, who cares? Why does this have to be compared to a Microsoft response? Why can't this just be viewed as an event in its own right and not constantly looked at as some insult which might be handing Microsoft an edge?

Objectively, if I use Firefox I have no interest in how Microsoft might have responded to a similar situation. I am purely interested in the Mozilla response (which I'm explicitly not passing judgement on in this post). Can people give it a rest with the constant defensiveness against Microsoft?

Cheers,
Ian

Aren't firefox users heading back to IE over this?

[Billly Gates]

Telling them its insecure only encourages them to stick with IE. All the studies are showing this with clueless uers since Microsoft does not like to boast about holes in IE.

Re:Firefox is the fix for Internet Explorer proble

[RzUpAnmsCwrds]

Well, after five security updates that patch numerous security holes (22 since 2004), I'm not sure that Firefox is the solution. It's certainly more secure than IE, but is it secure *enough*? No, it isn't.

I deployed Firefox on the corporate network to improve security. Five updates later, I'm explaining to my manager that Firefox, just like IE, is full of security holes that need to be patched.

Unlike IE, Firefox can't be updated through Windows Update and it doesn't have a patch release cycle. That makes it harder to plan for and harder to deploy Firefox patches.

Having "fewer" vulnerabilities than IE isn't good enough - particularly when your patching system sucks. Open source can do better.