Slashdot Mirror
Unpatched Firefox Flaw May Expose Users
Corrado writes "CNET is reporting on a new Firefox flaw." From the article: "The problem lies in the way Firefox handles Web links that are overly long and contain dashes, security researcher Tom Ferris said in an interview via instant messaging late Thursday. He posted an advisory and a proof of concept to the Full Disclosure security mailing list and to his Security Protocols Web site...The public bug disclosure comes just as Mozilla released the first beta of Firefox 1.5. The final release of the next Firefox update, which includes security enhancements, is due by year's end, according to the Firefox road map."
Firefox is open source... how can it have a bug in it? Lol, they must have meant Internet Explorer!
Everybody knows that security flaws are only available in Microsoft products. I read it on Slashdot!!! It has to be true!!!
Did anyone else have a sudden concern that using Firefox would cause you to be "pants'ed"?
The Spoon
Updated 6/28/2011
If you have gotten your non-techie friends to switch to Firefox, be sure to tell them about this problem and the possible fixes. Indeed, it is very important that Firefox be kept up to date on as many computers as possible, even if it means a short trip to install it for somebody. Nothing will hurt Firefox's reputation more than unpatched installations being exploited.
Cyric Zndovzny at your service.
For trolling sake, it is still better then IE.
Custom electronics and digital signage for your business: www.evcircuits.com
That the posted exploit only causes Firefox to crash to stop responded (that is what it did to 1.5b1 on my Linux box). The person that found the exploit claims he has tweaked the code to actually run arbitrary code on the system, but I would like to se e proof of this since as of right now we only have a hanging browser.
Unstable Apps: Our Android Apps Don't Suck
I thought MS had a patent on unpatched browser flaws?!?!?
Jerry
http://www.cyvin.org/
more information on the bug at: www.youissostupid.ru/scriptyuiopuioqwhjklfashuiopy uiopuiopuiopuouihjklasd-2789789-hfsjadkhuiof
The world is made by those who show up for the job.
The bug depended on the host name being all ---
It will be hard to craft some exploit code using only the - character.
It may DOS and cause instability; as for those "but, open source should be proof against this" nay-sayers, I'm pretty certain from the advisory that this could only be properly discovered because the source was available.
hmmmm, maybe if you can trick users to click on bad links a few times it might cause heap corruption and crashing; maybe if you get them to download the right page a few times to pre-load the heap, and then a few ----- might cause the browser to execute from the heap,
A look at the soucre will show the consequences of this and show what sort of pathway there is to arbitrary code execution. I guess it could be exploitable...
Sam
blog.sam.liddicott.com
The security vulnerability is a buffer overflow flaw that "allows for an attacker to remotely execute arbitrary code" on a vulnerable PC,
Just for curiosity, can be Firefox compiled with the compiler parameter which adds code to detect a wide variety of such bugs? It's what Microsoft did at IE in the XP SP2; does it have "sense" to do the same for firefox?
"The final release of the next Firefox update, which includes security enhancements, is due by year's end, according to the Firefox road map."
We rightly criticize Microsoft for not responding to security concerns in a timely manner. I hope the Mozilla Foundation will be held to the same standard.
"Ask not what your country can do for you." --John F. Kennedy
would you rather find about about a bug and fix it:
A. before you release a version (Firefox);
or
B. years after you release a version (IE).
Well? Which is better? If you choose option B, you can deny there's a problem for 1-2 years, start working on a fix in 2-3 years, nay-say press rumors about the bug in 3-4 years, and fix it and release the bug fix in 4-5 years.
I choose option A.
-- Tigger warning: This post may contain tiggers! --
Well, unlike Microsoft (and IE) which doesn't really care about the bad press its browser gets; I know for a fact that Mozilla and the people that work on Firefox, do.
Does CNET really think that Mozilla group is going to ignore it? I don't really see the point of the article. It seems like they were more interested in saying, "Oh, hey. Look, we're cool too because we found a flaw in Firefox."
I'm sure it'll be fixed in a couple day in the nightly builds. The new auto-update mechanism in 1.5 wasn't implemented for nothing. And it's the things like these that make Mozilla (Firefox) a good browser. No matter what kind of press (or lack of) that it gets, bugs still get fixed.
Personally, I think CNET is trying to jump on the Firefox-bug-reporting bandwagon like everyone else.
I can see why some folks will publicize exploits if they feel the software maker isn't responding in a timely manner. But c'mon - he just reported this to the Mozilla folks on Sunday!
#DeleteChrome
From TFA:
"The security vulnerability is a buffer overflow"
Buffer overflows aren't very easy to catch, but I thank the guy who discovered it. This way we can make Firefox a more secure browser everytime.
But frankly, I don't know how to feel. Embarrassed because buffer overflows are the result of sloppy buffer programming, or proud because Firefox has much fewer buffer overflows than windows products?
This is why open source is better! M$ expects me to wait until year's end for a patch?! What am I supposed to do until then, hide in a cave?
What's that you say? This isn't an article about Microsoft?
Oh, nevermind then.
Tech, life, family, faith: Give me a visit
Oh please, how is a heap overflow of 0x78787878787878... going to be exploitable. This looks like just a regular crash, if these turn you on just watch bugzilla for a few days, they turn up all the time.
A browser is a complex piece of software, of course there are going to be subtle bugs that turn up now and then. Nobody is perfect, and visualizing every possible execution path through a billion SLOC application is impossible. Please stop making a fuss about "OMG BROWSER DoS!!".
about:config -> network.enableIDN -> false
be happy!
I made a page with the supposed bad link full of dashes and all that happens, is that FF tries to do a Google lookup on "keyword:---lots of dashes here---"
This seems to be a dud exploit...
Oh well, what the hell...
under winxp I can't get this to crash. Crap! I thought windows should help with things like this! (Clippy: -So, it looks like you are trying to crash your browser. Need help?)
You can't handle the truth.
Actually, I have searching from the location bar setup as default, and only thing I get is firefox opening a google search with a bunch of dashes in it. (this is on linux)
8 &q=
So kind of pointless exploit in this case ?
So, to protect yourself
go to about:config and change keyword.URL to http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-
and keyword.enabled to true
Complexity is a measure of our ignorance...
I'd say RTFA, but this is Slashdot after all...
If you had read the article you would have found a link to the advisory which clearly states the following:
This guy was driving and navigated to a bunch of yellow dashes in succession.
This method of action caused his car to crash.
I've only been able to replicate this bug on roads with > 2 cars.
Anyone experience this?
/waiting for roads v1.5
This flaw is only present in Firefox 1.5beta1, 1.0.6 is not affected.
So if you are worried just keep using the stable version until at least the next beta release and be happy.
There's a hidden treasure in Python 3.x: __prepare__()
It's not so much Firefox, as it is the Mozilla codebase upon which Firefox is built. Having recently done some work with Mozilla, I can say that it is a very complex beast. Perhaps even too complex, some might say. The potential for the introduction of bugs is astounding, since it is often very difficult to know for sure exactly what effects a code change will have.
It doesn't help that a lot of the documentation is out of date, often by several years. Nothing is worse than incorrect or outdated documentation, which can often lead to incorrect code being unintentionally added.
While a rewrite of Mozilla is of course out of the question, there should perhaps be some procedures in place to clean up the code base, and ensure that documentation is correct. Performing such basic engineering practices is what results in quality products, be it software or bridges.
Cyric Zndovzny at your service.
Indeed. The main update/fix for Internet Explorer-related problems is Firefox. So that should always be the first solution proposed. That in turn directly leads to my proposal: always keep your non-technical friends' Firefox installations up to date.
Cyric Zndovzny at your service.
You can download a fix here
Does it even crash you? So far I haven't found anyone this actually crashes.
Between 2005-09-03 and 2005-09-06, there were several bugs reported to Mozilla that are now marked hidden. Expect one of them to become visible now that this is announced. (note: bugzilla blocks slashdot referer, so cut&paste is needed, watch out for the extra space)
3 94 03 14 08 48 7
https://bugzilla.mozilla.org/show_bug.cgi?id=3069
https://bugzilla.mozilla.org/show_bug.cgi?id=3069
https://bugzilla.mozilla.org/show_bug.cgi?id=3070
https://bugzilla.mozilla.org/show_bug.cgi?id=3070
https://bugzilla.mozilla.org/show_bug.cgi?id=3070
https://bugzilla.mozilla.org/show_bug.cgi?id=3070
BTW, why is it necessary that so many bug reports be hidden? They can't all be valid security bugs, can they? Besides, full disclosure and an open development model go hand-in-hand.
-molo
Using your sig line to advertise for friends is lame.
Honestly, who cares? Why does this have to be compared to a Microsoft response? Why can't this just be viewed as an event in its own right and not constantly looked at as some insult which might be handing Microsoft an edge?
Objectively, if I use Firefox I have no interest in how Microsoft might have responded to a similar situation. I am purely interested in the Mozilla response (which I'm explicitly not passing judgement on in this post). Can people give it a rest with the constant defensiveness against Microsoft?
Cheers,
Ian
I mean I looked at the official disclosure from him (http://www.security-protocols.com/advisory/sp-x17 -advisory.txt)
and basically he acts like 4 days is all he needs to wait.. and apparently Mozilla isn't doing enough for this?
Mozilla isn't Microsoft or Cisco in two catagories.
A. They arn't ultra large coporatitions that can fix stuff in an instant.
B. They don't ignore problems, especially like this. They're likely working as fast as they can and they are willing to admit fuckups, but they want to have a fix for the fuck up first.
We don't need everyone running around thinking that EVERY company conducts business the same way that Cisco does... How all of them are part of a conspiracy. Firefox is getting known in the industry to be basically good at avoiding problems other browsers have and fixing major bugs.
By having a guy run around like this only 4 days (notice the dates in that link) it can only cause a higher likelyhood that someone will use that find maliciously and Firefox will get blamed for it when it's really the disclosure that's the problem.
The fact is those of us who find these bugs need to give the company time to react, we don't need to act like they don't care. 4 days is hardly enough unless he got back a letter that said screw you, which it doesn't sound like he did. Giving Full Disclosure the first time you hear about a problem, just creates a bigger problem because now more people will learn of the problem.
And there's a definate difference between waiting a couple monthes like the Cisco incident where the company was being forced into an uncomfortable positions and waiting less then a full week with apparently no provacation.
Take 2 seconds to check out his proof of concept:
t ml
http://www.security-protocols.com/firefox-death.h
WARNING: Clicking the above link will crash firefox. It will do nothing else. The hyphens are not normal minus hyphen (the - symbol on your american keyboard will translate to 0x2d) but a soft hyphen (0xad).
Didn't crash my Opera session....
PENAROL: Seras eterno como el tiempo y floreceras en cada primavera.
Telling them its insecure only encourages them to stick with IE. All the studies are showing this with clueless uers since Microsoft does not like to boast about holes in IE.
http://saveie6.com/
Wow, I thought only MS products and Internet Explorer were capable of having bugs or exploits.
Were the people championing these other browser lying to me, or just ignorant in the fact that all software when given mass distribution will exhibit growing pains and exploits will be found no matter how good the programmers think they are.
Hm... (Ok, mark this as Flamebait - even though what I say is factually correct.)
Here's an xxd dump of the offending HTML:
Bugs and flaws are commonplace ... its a model which promotes a fast fix to these shortcomings that really makes a difference.
That is another proof (of known fact) that it is much easier to hack the open sourced then the proprietary application.
But the opposite is also true...it's a proof that it's much easier to debug open sourced applications.
For those testing on their own, *please realize* that it is not simply a dash (0x2D), but the character 0xAD.
I entered the html in hex editor as from:
= 13519728
a aaaaaaa/
m files/96083106_1_rvmshv
http://it.slashdot.org/comments.pl?sid=161697&cid
and clicked on the link. The link pointed to:
https://xn--m1aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
and firefox downloaded this:
http://www.srh.noaa.gov/abrfc/archive/1996/aug/rv
Well, after five security updates that patch numerous security holes (22 since 2004), I'm not sure that Firefox is the solution. It's certainly more secure than IE, but is it secure *enough*? No, it isn't.
I deployed Firefox on the corporate network to improve security. Five updates later, I'm explaining to my manager that Firefox, just like IE, is full of security holes that need to be patched.
Unlike IE, Firefox can't be updated through Windows Update and it doesn't have a patch release cycle. That makes it harder to plan for and harder to deploy Firefox patches.
Having "fewer" vulnerabilities than IE isn't good enough - particularly when your patching system sucks. Open source can do better.
The bug report is now open and you can see that he reported it to Mozilla on the afternoon of the 6th. There was quite a bit of activity from top Mozilla developers and then the reporter posted the exploit publicly on the 8th.
We've determined that disabling IDN is a safe workaround and are working on supplying a small download that will take care of that configuration for the user.
- A
P(Vi) = Probability of being pwned by single vulnerability Vi = (chance of vulnerability being exploited)*(chance of user replicating vulnerability conditions).
Probability of being pwned by multiple vulnerabilities = 1 - PROD over all vulnerabilities(1 - P(Vi)).
Human being (n.): A genetically human, genetically distinct, functioning organism.
The bug has been disclosed by Mozilla staff and a patch fixing the reported buffer overflow has already been applied to the CVS tree, so expect a public security update very soon. In the meanwhile, as a temporary work-around, you can fully protect your browser opening "about:config" and setting the network.enableIDN preference to false, see the full story here.
There's a browser safer than Firefox, it is Firefox, with NoScript
I am sure some nop's and jmp statements could point it in the right direction ;).
The point that the person was trying to make (for which you rather unjustifiably called them a moron) is that you can't encode a nop or a jmp with just 0x78 bytes. That means that you can't push exploit code over into the browser to execute using this hole. That doesn't mean that it's impossible to cause a problem with this -- there is a very slim possibility that something crucial could be overwritten while keeping the program operational (for instance, suppose there is a bit somewhere nearby in memory that, if enabled, allows a remote website full script execution privileges, and a series of 0x78 bytes could overwrite that memory).
The chance of there being a away to finagle this into any kind of security exploit other than a DoS while visiting a specific website is very minimal, though. Maybe Thunderbird users could be hit by email that crashes their mail client, which would be somewhat more serious, as it would be a push DoS instead of a pull DoS.
I don't really worry about every browser flaw that comes out. I run "yum update" every couple of days, and maybe I'm vulnerable for a few days...but, hell, such is life, and I don't really want to waste lots of time worrying about some security bug -- hell, someone could just mug me for my wallet.
Any program relying on (nontrivial) preemptive multithreading will be buggy.