Slashdot Mirror
Unpatched Firefox Flaw May Expose Users
Corrado writes "CNET is reporting on a new Firefox flaw." From the article: "The problem lies in the way Firefox handles Web links that are overly long and contain dashes, security researcher Tom Ferris said in an interview via instant messaging late Thursday. He posted an advisory and a proof of concept to the Full Disclosure security mailing list and to his Security Protocols Web site...The public bug disclosure comes just as Mozilla released the first beta of Firefox 1.5. The final release of the next Firefox update, which includes security enhancements, is due by year's end, according to the Firefox road map."
That the posted exploit only causes Firefox to crash to stop responded (that is what it did to 1.5b1 on my Linux box). The person that found the exploit claims he has tweaked the code to actually run arbitrary code on the system, but I would like to se e proof of this since as of right now we only have a hanging browser.
Unstable Apps: Our Android Apps Don't Suck
Sure. Yea. But it makes us open-source religinuts look a bit silly, touting our "secure browser" when CNET (which has a very questionably technical readerbase) and others run stories like this. Argh. I'm just going to hit the first IE-phile who uses this little bug in an argument.
The bug depended on the host name being all ---
It will be hard to craft some exploit code using only the - character.
It may DOS and cause instability; as for those "but, open source should be proof against this" nay-sayers, I'm pretty certain from the advisory that this could only be properly discovered because the source was available.
hmmmm, maybe if you can trick users to click on bad links a few times it might cause heap corruption and crashing; maybe if you get them to download the right page a few times to pre-load the heap, and then a few ----- might cause the browser to execute from the heap,
A look at the soucre will show the consequences of this and show what sort of pathway there is to arbitrary code execution. I guess it could be exploitable...
Sam
blog.sam.liddicott.com
The security vulnerability is a buffer overflow flaw that "allows for an attacker to remotely execute arbitrary code" on a vulnerable PC,
Just for curiosity, can be Firefox compiled with the compiler parameter which adds code to detect a wide variety of such bugs? It's what Microsoft did at IE in the XP SP2; does it have "sense" to do the same for firefox?
would you rather find about about a bug and fix it:
A. before you release a version (Firefox);
or
B. years after you release a version (IE).
Well? Which is better? If you choose option B, you can deny there's a problem for 1-2 years, start working on a fix in 2-3 years, nay-say press rumors about the bug in 3-4 years, and fix it and release the bug fix in 4-5 years.
I choose option A.
-- Tigger warning: This post may contain tiggers! --
Well, unlike Microsoft (and IE) which doesn't really care about the bad press its browser gets; I know for a fact that Mozilla and the people that work on Firefox, do.
Does CNET really think that Mozilla group is going to ignore it? I don't really see the point of the article. It seems like they were more interested in saying, "Oh, hey. Look, we're cool too because we found a flaw in Firefox."
I'm sure it'll be fixed in a couple day in the nightly builds. The new auto-update mechanism in 1.5 wasn't implemented for nothing. And it's the things like these that make Mozilla (Firefox) a good browser. No matter what kind of press (or lack of) that it gets, bugs still get fixed.
Personally, I think CNET is trying to jump on the Firefox-bug-reporting bandwagon like everyone else.
How about having the update checker stop working?
I've seen several computers now where the red arrow icon is always displayed and the update wizard never successfully downloads anything.
Reinstalling doesn't seem to help fix it.
I use elinks. :)
maybe it's secure, maybe not.
Due to the lack of graphics support and javascript there is a good chance it is more secure than most other browsers.
Also nobody is going to target it.
...and that is all I have to say about that.
http://jessta.id.au
From TFA:
"The security vulnerability is a buffer overflow"
Buffer overflows aren't very easy to catch, but I thank the guy who discovered it. This way we can make Firefox a more secure browser everytime.
But frankly, I don't know how to feel. Embarrassed because buffer overflows are the result of sloppy buffer programming, or proud because Firefox has much fewer buffer overflows than windows products?
Does it even crash you? So far I haven't found anyone this actually crashes.
Didn't crash my Opera session....
PENAROL: Seras eterno como el tiempo y floreceras en cada primavera.
I tried increasing the number of dashes in the link, all tested on the Aug 29 nightly build:
40,000 dashes: No crash, it does a Google search, but Google displays a Bad Request message.
130,000 dashes: No crash. Same results as above.
275,000 dashes: Same as above.
At this point Kate is very slow and gedit seems to hang. All these dashes are on a single line so as not to modify the POC too much and text editors don't like that. I wrote a script to add more dashes for the next test.
1.5 million dashes: No crash. Same as above.
Screw this. Can someone point me to a real POC for this alleged exploit?
The global economy is a great thing until you feel it locally.
Ah, interesting. Just loading the page containing the link causes it to crash. And yeah, those aren't - signs as was in the message linked on CNET, those are some other character (maybe on a certain font they are minuses?).
If I have been able to see further than others, it is because I bought a pair of binoculars.
Ferris found this "hidden feature" by inspecting the source code, not by trying to probe the browser from "the outside".
He just analysed possible outcomes of usage of this function:
nsStandardURL::BuildNormalizedSpec
That is another proof (of known fact) that it is much easier to hack the open sourced then the proprietary application.
I entered the html in hex editor as from:
= 13519728
a aaaaaaa/
m files/96083106_1_rvmshv
http://it.slashdot.org/comments.pl?sid=161697&cid
and clicked on the link. The link pointed to:
https://xn--m1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
and firefox downloaded this:
http://www.srh.noaa.gov/abrfc/archive/1996/aug/rv
Release Date:
September 8, 2005
Date Reported:
September 4, 2005
Vendor Status:
Mozilla was notified, and im guessing they are working on a patch. Who knows though?
Do I understand correctly that the guy reported the bug to Mozilla on September 4, 2005 and then released it to public on September 8, 2005?
It so that would show a complete lack of responsibility on his part and total disreagard for proper security reporting procedures.
Agreed - but, they do patch & patch FAST. I know, I had written them a couple years back in regards to how FireFox was handling the homegrown forums boards used @ NTCompatible.com (& was 'bugging out' on some of its handlings of the code used in it).
The FireFox/Mozilla team wrote me THAT day, acknowledging it was indeed, a bug on their end, fixed it the VERY NEXT DAY, & even wrote me back directly and came to speak to us there & to the site's owner directly, in regard to the fix and problem.
It is important, & their team KNOWS it... and their response time?
Read the above, rinse/wash/repeat.
(They're FAST about it)
APK
P.S.=> I still am more of an Opera 8.02 fan than I am of FireFox, but FireFox is LOADS better than current models of IE imo, especially security-wise...
Even though various addons like greasemonkey turned up "funny" recently (but too, was fixed fast), it's YOU that installs them & takes the chance...
Whereas IE?
Well, SOMETIMES, the addon stuff installs (because of the lax default security settings in XP/2000 & below models of their OS & IE in them is @ fault, this is correctable too via IE's security & zones settings IF you take the time to look - me? I turn off java/javascript &/or ActiveX usage usually, period in IE) w/out you asking for it...
That's WRONG! MS has corrected a GREAT DEAL of this in Windows Server 2003, especially how its init. security is setup (very restrictive), but has a ways to go before they catch up to Opera &/or FireFox imo... both featureset-wise & also security invulnerable-ness-wise.
apk