Slashdot Mirror
Mozilla Firefox 1.0.7 DoS Exploit
An anonymous reader writes "Whitedust Security are reporting on a new exploit for Firefox which apparently affects all versions of the browser from 1.0.7 down. From the article: "If this exploit has made it out into, or indeed been retrieved from the wild is unknown at this time. However it is clear that this exploit will indeed need patching as soon as possible.""
A 1.0.7 exploit that only affects everything below 1.0.7!
I checked out the Mozilla site -- not a peep about it. I made a post there. I figure this one totally right hooked them. It's a pretty massive crash. Just makes the whole browser lock up. At least I know they'll fix it fast though...I think in 24 hours we'll see a turn around. Anyone try this with version 1.5?
Help me, help you. - Jerry McGuire
Mozilla Thunderbird 1.0.6 is also vunerable.
SIG: TAKE OFF EVERY 'CAPTAIN'!!
>>Whitedust Security are reporting on a new exploit for Firefox which apparently affects all version of the >>browser below 1.0.7. From the article:
contrary to how the article makes it sound, 1.0.7 is indeed affected by this.
Why are there so many nice hackers in the world? Willing to spend their time finding exploits, post them, and even a "safe" example. Do they take pride in helping the surfing community? Why don't they just hijack the world's browsers and make us choose between "Yes" and "Okay" on their PayPal deposit sites?
Where are the evil hackers, or have they all converted, scared about stiff http://news.bbc.co.uk/1/hi/technology/4249780.stm penalties?
~jennifer.k~
OMG there is an exploit for firefox but we don't know anything about it but it might be dangerous. i need to switch back to IE maybe...
How long has a webpage that makes a browser crash been called a "Denial Of Service Exploit".
A browser that can be crashed is a very bad thing, but suggesting this is some sort of "Denial Of Service" attack, is just semantics. It doesn't crash the box, and it doesn't flood/break the network. Every other service on your machine runs as normal. That's not a Denial Of Service by the usual definition of the term.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
What follows is the source code made avaliable on the site.
:(
Mozilla
# milw0rm.com [2005-10-16]
I have 1.0.7 and it caused me to crash
Have you metaroderated recently?
There isn't much incentive for malicious people to crash people's browsers.
The wording from the security company has me thinking they're just trying to make a name for themselves.
This can freeze your browser.
Wheres the vulnerability? when does the spyware attack? Do I need to reinstall Windows?
Should I buy a virus checker?
Anyone stupid enough to host this "exploit" on their site are just dumb,
"oooooh it makes your firefox freeze" BFD - stay away from dodgy parts of the net
(goatse is a bigger "exploit" and generally leads to complete machine shutdown/restart as you attempt to hide it from your colleagues)
liqbase
I'm using Debian, and the 1.0.7 build they have out is affected by this 100%. It works on any 1.0.7 build.
Help me, help you. - Jerry McGuire
1.5 is beta, dude. 1.0.7 is the latest final release of firefox. 1.0.7 is like 1 month old.
1.0.7 is the current stable release. 1.5 is beta.
Just a thought.
-How about starting with all the old win9x exploits.
No, 1.07 is the current release. 1.5 is the release candidate or "Deer Park" which is currently a pre-release. As far as I understand!
And after I clicked on it, nothing happened, the browser just said: mozilla
Apparently firfox 1.0.7 on linux is not affected. So not all versions of firefox are affected.
Advisory: Install linux, then restart your browser and have fun.
My wife's sketchblog Blob[p]: Gastrono-me
Hey dipshit. Wake up! This is like me saying "I'm running Vista. Why are they bothering posting information on XP exploits?"
Be a real patriot: Question authority. Think for yourself. Formulate your own conclusions.
Thank you very much for clearing that up, i'm sorry should have RTFM on firefox
Cheers thanks
Del
The exploit is:
t ml>
<html><body><strong>Mozilla<sourcetext></body></h
and it also makes Mozilla suite 1.7.12 hang.
The sourcetext tag is used when a parser error occurs; the Mozilla DOMParser will accept any string and always returns a valid XML DOM object, but in the case that the string was malformed, it returns something like this:
<parsererror xmlns="http://www.w3.org/1999/xhtml">XML Parsing Error: mismatched tag. Expected: </strong>. Location: file:///1253.html Line Number 3, Column 37:<sourcetext> (text here) </sourcetext></parsererror>
which you may have seen formatted before in a nice red-on-yellow page.
I guess I'll just stick with Konqueror.
Despite the article summary if you click through and read it you'd find that there is code out there.
Danger Will Robinson test your firefox Danger Will Robinson
Your hair look like poop, Bob! - Wanker.
Simply shows the word Mozilla when the test web site is loaded in Beta 2. I guess they have already taken care of it in the Beta release
whenever there is a firefox exploit, /. is understanding, and people say things like "well no software is perfect... its rare and hard to do, not really an explot... ". When there is an IE exploit its, "MS Sucks, IE Sucks, and if you use IE your computer is going to blow up, not to mention global warming will continue"...
I exaggerated a bit there, but you know what I'm saying. Why not offer equal critiques, and understanding, for any product regardless. I have a few macs for web testing but don't really like them, but it doesn't stop me from saying that there are some things that apple does a damm good job with. IE isn't a horrible web browser, it may not be as cutting edge with functionality today as firefox, but it isn't all bad. And before you scream standards, only do it if you include safari, and all the other browsers that have "standards" problems.
...it shows an "update" icon, which updates when clicked. How much easier could it be without hijacking your system to do it for you?
And this has what to do with a vulnerability in Firefox exactly? Upon RTFA, the exploit appears to be a one-liner - is that it....?!?! (And, no, I'm not going to run it to find out thank you very much.) GC
1.5 is a BETA version which Mozilla only recommends bleeding-edge types and extention developers use.
Comment removed based on user account deletion
...the RIAA has finally managed to lock up all malicious computer users. It's about time!
I think you meant "less than," rather than "greater than".
sig
There's not much to it though:
Ah well, not much harm done. Of course, there's nothing to stop Microsoft putting it into MSN deliberately to break the browser, in much the same way they tried to nobble Opera some months back.
Never email donotemail@WeAreSpammers.com
So clicking on a link can lock up the browser. So what?
How is this any different from this, which effectively locks up *all* current browsers?
<script>
while(true){
alert('Haha!');
}
<script>
This is hardly important. I don't see any way this can crash my machine or infect me with a trojan.
PS if you want a fix for the above vote for bug 61098] at bugzilla.
A DOS is, by definition, a vulnerability. Less significant than others, especially for user systems, since you quit firefox and it's fixed, no system change, no arbitrary code running.
Comment removed based on user account deletion
Any ideas as to what is going wrong?
http://www.thebricktestament.com/the_law/when_to_
Except you have no reason not to update something that automatically updates itself and for free.
Occam's razor is the blind faith in the natural selection of least resistance and in universal oversimplification. -- EF
I think the poll at the top of the page should ask, "Do you trust WhiteDust security?"
Oh, wait - that's what the 'Test the exploit' link is for.
"Our interests are to see if we can't scale it up to something more exciting," he said.
Comment removed based on user account deletion
Great example of more FUD for the fire (no pun intended). Why just post a bug report to the bug list like everyone else when you can make a 'proof of concept' bug, post it on slashdot and increase visitors to your site? No no, we can't go the normal route, that wouldn't make IE look better. All a proof of concept virus does is make all the new people want to flock back to IE
Face it people, Bugs like this are reported and fixed all the time. Just because another person decided to post about their 'proof of concept' on slashdot doesn't mean the world is coming to an end
It's hardly news to be able to DoS a browser. I DoS both FF and IE regularly while working on DHTML scripts, often when I use a debugging "alert" in the wrong place. Try this one and see how much farther you get during your morning browsing:
<html>
<body onmousemove="while(1) alert('ooooh');">
</body>
</html>
Watch out before you run it! You wouldn't want to lose that Xanga post you've been working on.
I guess I must've missed the part where my STABLE release of 1.0.7 (susceptible to the exploit) automatically updated itself to the BETA 1.5...
Be a real patriot: Question authority. Think for yourself. Formulate your own conclusions.
assuming the Secunia Advisory is referring to the same vulnerability linked to in the /. article, its Critical level is the lowest, Not Critical
do {print "Mini-Geek Rules!\n";}
until ($TheEndOfTheWorld);
OK, I'll take you up on that offer.
If, in the unlikely event that they don't patch this very scary DoS exploit within a week, you can send me $10.
Thanks,
--Barry
Linux? You should try it on a Solaris 8 box. I wouldn't call it random cause it is 100% reliable when it decides it doesn't like a page, but I have yet to determine what about the pages crash it.
X(7): A program for managing terminal windows. See also screen(1).
This crasher bug has no effect on my post 1.5 beta 2 version of firefox on Linux. Gecko/20051017. A new crasher bug is also not news. There are hundreds of ways to crash mozilla. Lets face it most browsers aren't at a state to jump every time there is a new bug to crash or "DOS Them" as the article states. Just another security site trying to make themselves look good at a products expense. How much money does it cause companies like the Mozilla Organization to release a new version of their browser, just to put an end to the bad press of a so called "exploit"?
I bet we won't have to wait 'til MS Patch Tuesday for it to come out!
We're all hypocrites. We all have hidden parts, it's the contrast between them that make us more a hypocrite than others
Microsoft should start putting this code in all its mass mailings ;^)
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
Nah, parent just made the stupid mistake of assuming the submitter would actually RTFA before writing his summary, or the even stupider mistake of thinking the editor might actually check the facts before posting the story.
I am trolling
To clarify: " And this has what to do with a vulnerability in Firefox exactly? " refers to the parent post. Looks like the quoting I managed to remove the quote from my post. Agreed - a DoS certainly is a vuln.
Mine's been running for 2 weeks solid with no problems, and at least 8 tabs constantly open. Maybe you're doing something wrong.
You moderators may think this is funny, but it's actually true - Mozilla (both Firefox and Seamonkey) is generally a rather crash-happy program. I'm using Seamonkey 1.7.12, myself, which really is supposed to accumulate only critical bug and security fixes, but it still crashes or locks up at least once a day.
If it wasn't for AdBlock, I'd switch to Opera in an instant.
quidquid latine dictum sit altum videtur.
And let's suppose it is in the wild and to get infected I don't have to go to some Russian site selling stolen credit cards. Can anyone see how that could be possible? You'd have to go to a site knowingly and maliciously designed to exploit this, right?
OK, I just wasted 15 minutes of time trying to figure out the point of this story.
Whitedust.net's technique of giving the wrong content type to the linked files that contain any real information about this so called exploit causing Firefox to open links in a text viewer was particularly effective.
This may be the largest human DoS attack in recent memory (and slashdot was the vector).
--Barry
A bug enables you to install anything you want on the end-users system without agreement...
htop(top on stereoids): http://htop.sf.net
Since you have to go to a specific web page, with a specific browser ... and the only thing that will happen is that your browser will crash ... is "attack" the correct term for this kind of behaviour?
If you crash your car into a tree, did that tree "attack" you?
If you crash your car when driving over ice, did that ice "attack" you?
If you drive your car off a bridge and into a lake, did that lake "attack" you?
Since you cannot use your car immediately after a crashes, are trees considered a DoS exploit?
while(1) {
open("hi!","about:blank");
alert("you llamma!");
}
-Woof woof woof!
Doesn't even register a hit in CPU usage.
If an application crashes, I'm sorry, but it isn't the users fault. Application crashes are not the fault of the users.
In programs like this, bugs are inevitable, as there are *soo many* forms of input, and it is hard for a programmer to take them all into account. But in any case, if blame has to be put on anyone, it would be the developers.
If they were complaining that the browser was spitting back a "Malformed page" error, and continuing on, then you could say that it was the fault of the user (in this case, the writer of the html)
Denial of Sheep. Because when you're browsing your alternative exciting imagery, and your browser crashes, you are denied.
Even those who arrange and design shrubberies are under considerable economic stress at this period in history.
Install better plugins for flash/pdf/etc or just remove the bad plugins. You get the same affect in windows if you're a moron and install the old adobe 5.0 plugin that hangs. When the plugin hangs or uses a lot of cpu it affects the browser.
If you didn't know this I guess the joke is on you. Welcome to russia.
Indeed it does, indeed, need to be patched. Indeed.
Well, aren't you teh kewl little script kiddie?
Why is this marked funny? Because it has that Paris Hilton thing at the end? Funny should be used for posts that are entirely a joke. I assumed the OP was serious about the main question.
where there's fish, there's cats
No, you didn't miss it. Why the hell would any software automatically update to BETA level software. But in a month or two it will be released and then it will automatically update to 1.5. In the mean time they are still doing bug fixes to the current stable. This one is not particularly bad, so I don't know if they will try to address it.
Occam's razor is the blind faith in the natural selection of least resistance and in universal oversimplification. -- EF
I will use this Firefox post to ask something: I think Firefox has a problem rendering divs.
7 22), And guess what, it was opened on 2004-08-07 14:20 PDT!
If you go to www.netvibes.com and then open one of the "frames" it will maximize, with the standard colors the maximized frame will be over all the page hiding everything else (the expected behaviour), but if you change the page colors (Tools/Options/General/Font & Colors) to Text: White and Background: Black and then select the option "always use my colors" and reload the page [netvibes.com] then maximize again any of the frames and the background will be transparent.
I thought it was a design flaw of the netvibes page but after doing the same (changing the text color to white and background color to white) on Internet Explorer (Tools/Internet Options/Colors), the page (netvibes) is still rendered correctly.
If you wonder why did I changed to those (white text on black bg) you should try it for one day (configure your screen so ALL background colors are black or less than 0x33 [of a total 0xFF] in R,G or B).
Way off topic but anyway there it is.
Oh and BTW, allow me to rant about a Firefox bug that has not been fixed (https://bugzilla.mozilla.org/show_bug.cgi?id=254
Who said OpenSource software was fixed faster than closed source uh?
ok, enough for a rant
Ubuntu is an African word meaning 'I can't configure Debian'
Check out Deer Park, either beta 1 or beta 2. Neither is vulnerable to this.
It just prints Mozilla. Back to the exploit drawing board with you, script kiddies...
insecurity asks the wrong question irritation gives the wrong answer
You're on!
On a totally unrelated note, this is the EULA for this post:
I'll give $5 to anyone who can fix this Mozilla exploit within a week. And here's the catch: whoever can't has to give *me* the $5.
How can I possibly lose! EULA's rule! 8)
-Copyright law #69:Whenever Mickey Mouse is about to enter the public domain,copyrights get extended by 25 years.
Ok, this isn't really a security bug. It's a crasher. If this is a security bug, so is this one (you'll likely need to cp/paste into new window to open) that I discovered a few years ago.
IMHO "security" bugs are for ones that have an impact on "security". If it doesn't fit that criteria, it's not a security issue.
A JS permissions exploit would be a security bug. So would the IDN issues, and buffer overflows...
but a crasher? I think that's pushing the benchmark. It's not really a DoS... it's a crash/hang.
It would be a security issue if say, it caused 911 to become unavailable, or killed US Radar systems... but not for crashing a web browser.
I think people have been pushing for a while in hopes of getting new security bugs. And that's all products, not just Moz. There are legitimate security bugs, but I don't think this qualifies. IMHO you need to be able to do something that violates security to be a security issue.
My SuSE 9.1 survived it. Weird though that it would depend on the linux version. It might have something to do with the libraries in use.
My wife's sketchblog Blob[p]: Gastrono-me
.....to their webpages to keep Mozilla clients from being used. That way you don't get rid of that IE icon on your desktop.
This is my opinion. To make sure you don't steal it, it's covered by the DMCA.
Funny, I haven't had to uninstall Firefox since 1.0 was released. Since then I've only had to click the red-tree-button-thing in the upper-right hand corner when an update was ready, run the installer, and be done with it.
Hell, now that I'm on Ubuntu I just wait until Synaptic has an auto-update ready, click on the red button in the notification area, and *poof* - my OS and my third-party software is updated.
Of course, to counter your argument "is this acceptable for a production enviornment" I would say that, yes, it is. Microsoft, the king of production enviornments to date, has shown that regular updates to the core operating system, its components, and provided software (IE, Outlook express, Office, etc...) is not only helpful, but required on a monthly basis. These updates often require rebooting the machine, whereas Firefox only really needs you to install a piece of software. Heck, the upcoming version will be modular so you won't even need the installer.
As for your question "why is the testing so poor?" It's not. The OSS model, for the most part, is to release beta software so users can, well, use it during normal day-to-day operations. This ensures that the product will, in fact, work when nominal conditions are met. The real problem is anticipating extrordinary conditions, which is almost impossible - a lesson which Microsoft has learned the hard way over the past 5+ years.
You could, in fact, turn your own argument around: "Well, another bug was found, and now we have to wait until patch tuesday. Unil then, we'll have to hold our breath and hope that an exploit doesn't spread in the wild. When patch Tuesday comes around we'll all have to hit windows update, download the large patch, install, reboot, and hope that the atch doesn't break any of our third-party and in-house products."
The truth is OSS and Closed-source are two sides of the same leaf: programming. Bugs are a part of programming. When you're dealing with multiple class inheritence, nests upon nests of loops, parsers, lexical analysis, et al. bugs are just a part of life. I've never met a developer - FOSS or otherwise - who has developed a program that is bug-free and 100% to spec.
No remote execution or personal data being revealed, it just hangs the browser. It doesn't even seem to slow down the rest of the system, it just makes Firefox unresponsive. So?
t ml>
It's easy to do that to almost any browser. Loading a lot of really big images will crash Firefox when it runs out of memory, and has the side-effect of slowing the rest of the system (or probably crashing it if it's based on windows 9x).
The "exploit's" entire HTML source reads like this:
<html><body><strong>Mozilla<sourcetext></body></h
It's clearly a silly bug, but I feel that saying "it is clear that this exploit will indeed need patching as soon as possible" is excessive hype. This is not a security issue. This is part of the known problem that Firefox is not very tolerant of buggy code, which is a general serious issue that does need fixing.
I wonder if this is a Gecko bug? An email version of this for Thunderbird would be very annoying.
# cat
Damn, my RAM is full of llamas.
Proud member of the American Non Sequitur Society. We might not make much sense, but boy do we love pizza!
1. A bug is found in Microsoft software that allows remote execution of code on your machine, without user intervention.
2. Story is posted on Slashdot.
3. People rightly comment on it.
Show me the stories of bugs that simply crash IE. Really. I'm curious. Because there are literally hundreds of ways to crash IE with a malformed webpage. These don't make it as Slashdot stories. Pretty much the only vulnerabilities in MS software posted here are ones that allow an attacker to actually DO SOMETHING NASTY.
Contrast this with OSS, where we post every single meaningless bug in a piece of software, even if it has hardly any practical effect.
If anything, the double standard is that we're far more critical of OSS here than MS.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
websites have been suffering DoS attacks and they can't do anything about it (specially if they're distributed).
DoS is the last resource for a hacker when he can't penetrate the website's server. It's not "hacking" in fact.
What astounds me is that people seem less afraid of remote execution vulnerabilities than of DoS attacks. Or is it just me?
What the heck.. I clicked and clicked and clicked. No crash!
:)
And then I realised, I was on 1.5b2
... "follow me" the wise man said, but he walked behind
When will they wake up and stop releasing buggy software.
I will not have any of their software on my computer. I ONLY use Microsoft products.
I can finally run Mozilla on my MS-DOS box? Sweet!
"The wording from the security company has me thinking they're just trying to make a name for themselves."
I was just about to comment the same - if every Internet Explorer crash bug was reported with this much visibility, Slash would be full of news every day.
"Although it is not true that all conservatives are stupid, it is true that most stupid people are conservative."
Hmm, maybe you should turn JavaScript off before you browse for pr0n...
Oh well, what the hell...
OK, the IE fanboys are really stretching now. If crashing the browser is an "exploit" then that opens a whole new avenue of attack on IE. IE crashes like this (for me) far more often then firefox, and firefox crashes just about every time I visit a site with really involved flash or those really annoying smiley face banner ads (those are firefox killers).
ctrl+alt+del kill process is a good workaround for this "extremely dangerous" exploit. Again if this is a security vulnerability, then flash is the greatest hacking tool against firefox. Java is probably the greatest hacking tool against IE.
People are just really desparate for Firefox to have more bugs than IE. Thanks for finding some code that should probably be cleaned up, but crashing the browser is not in any way violating the security of the system on which the browser is running.
Does this mean I can sue sites for using excessive flash and javscript for DoSing my browser?
Uh huh. Try again. I'm neither trolling nor trying to be funny. I use Firefox on Linux as my primary browser on multiple machines - except when I need to be SURE that my browser won't decide to randomly crash when doing something as simple as loading my bookmark on google.com or clicking on a link to just about anywhere. Then I fire up VMWare and run either MSIE or Firefox for Windows.
I've been using browsers since Mosaic was state-of-the-art and that funny IMG tag was getting Marc A. flamed. Firefox on Linux is bar none the most unstable browser I use. I like the browser (why else would I use it as my primary browser?) - but even 1.0.7 is NOT terribly solid. If you use it heavily - it WILL crash.
Show me the stories of bugs that simply crash IE. Really. I'm curious. Because there are literally hundreds of ways to crash IE with a malformed webpage.
/. where major exploits like remote code execution on Firefox are downplayed, usually by the same people mentioned above.
/., but Firefox is routinely given a pass whenever it has a major bug or a slew of patches released.
And there are hundreds of ways to do this with Firefox as well, no doubt, but for some reason this story made "news." Comments saying this is "no big deal because it happens all the time" are right, in my opinion. What's bothersome is that many of these same people sing completely different tunes with IE under similar circumstances. I've also seen far too much commentary on
If anything, the double standard is that we're far more critical of OSS here than MS.
I'm sorry but I cannot agree with your interpretation here. Microsoft is given absolutely no quarter on
In the end they will lay their freedom at our feet and say to us, Make us your slaves, but feed us. - Fyodor Dostoyevsky
wow, overrated with no moderation, how'd they manage that?
I totally agree. FF works great when it works, but it craches or locks up far more easily than anything else. Some important parts of it seems to be completely single threaded. It can sit for several minutes to forever waiting on a plugin or renderer that isn't available. Sometimes I think the developers have never heard of error handling and timeouts. A browser is a real-time system, but the developers don't seem to have much real-time experience.
Oh well, what the hell...
10 PRINT "HELLO WORLD"
20 GOTO 10
and some workaround for the lameness filter. Indeed, some workaround for the lameness filter
there are hundreds of ways to do this with Firefox as well, no doubt, but for some reason this story made "news."
/., but Firefox is routinely given a pass
:)
Microsoft is given absolutely no quarter on
Thank you for proving my point so eloquently
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
So get over it.
Don't be thick. Both I.E. and Microsoft have a long history of creating buggy software that rarely works as advertised. Firfox is the new kid on the block, even though most of us know its pretty much the same ol netscape (pronounced mozilla), it has a new name and a new face. So yes people are going to be more prone to give it the benefit of the doubt and this has little to do with a double standard and more to do with the idea that past performance = future performance and firefox doesn't have enough of a history yet to be raked over the coals for its indiscretions.
Then Windows would be labaled as a weapon of mass destruction.
Frankly, this is non news as there are thousands of ways to just crash a browser or just hang it. It is an entirely other issue with the bugs that lets you crash a full windows computer because of an IE bug. If it crashes other apps or the computer its bad but this is just about wrongly written web pages.
HTTP/1.1 400
Ok, you might be a troll, or flamebait, but it is worth a response...
This discussion is not any different than it would be if it was about IE. There are always those saying "no big deal" about IE security flaws, and plenty of people screaming blood on this conversation. Maybe the balance is slightly altered because so many of us have been burned by IE though....
Having said that.... This is no big deal. Even TFA says "This is not an advisory, just a comment" indicating that the authors don't think it is a big deal either.
LedgerSMB: Open source Accounting/ERP
I just tried the code on Camino (1.0a1) and it appears totally unaffected.
Just create a large (~500Mb) file full of zeroes. gzip it, and place it on your webpage. Most browsers open .gz files in the browser, and loading something like 500Mb in the browser takes some time. May not crash the browser, but is definately as DOS as the articles "exploit" :P
How come whenever there's a Firefox or Internet Explorer exploit some guy like you moans about how whenever there's a Firefox or Internet Explorer exploit a bunch of fanboys get modded up when they criticise Firefox or Internet Explorer?
What /. filter are you using? Obviously you forgot:
4. ???
z5. Profit!
What would an EWOULDBLOCK block, if an EWOULDBLOCK could block would? -- me
Looks like its time to switch back to IE.
http://saveie6.com/
I stand by my statement.
r mat=advanced&short_desc_type=allwordssubstr&short_ desc=crash&resolution=DUPLICATE&resolution=---&chf ieldto=Now
r mat=advanced&keywords_type=allwords&keywords=crash &resolution=DUPLICATE&resolution=---&chfieldto=Now
"crash" in bug summary:
https://bugzilla.mozilla.org/buglist.cgi?query_fo
"crash" keyword (5306 open or duplicate reports):
https://bugzilla.mozilla.org/buglist.cgi?query_fo
So this is the 5307th. What's the big deal? Zalewski's "mangleme" crashers were interesting enough to be on slashdot because he presented an interesting tool to do testing, but this is just one crash among thousands.
My server
Thank you for proving my point so eloquently :)
/. is harder on OSS than it is on MS software. I pointed out that, by and large, IE flaws get top billing and scathing comments whereas Firefox flaws get rationalizations and lame excuses from OSS zealots if it gets an article on it at all. And anyone pointing out that both FF and IE have had numerous serious security flaws gets a verbal load of buckshot from the zealots claiming that all the IE flaws are serious flaws but all the FF flaws are trivial. It's one sided. It's hypocritical. It's rabidly commonplace.
No, I didn't prove your point at all. You claimed
I have no problem whatsoever with taking MS to task for all the crap they've done, but you can't remain honest and objective if you don't give FF that very same treatment.
In the end they will lay their freedom at our feet and say to us, Make us your slaves, but feed us. - Fyodor Dostoyevsky
This reminds me of a bug in Firefox (and other Mozilla products) I reported in December 2004. It's fixed in the 1.5 beta series, but still unfixed in the stable versions (e.g. FF 1.0.7).
The links:
Advisory
PoC
This appears to have no effect on Gentoo's 1.0.7-r2 (64bit) or the 1.0.7 binary (32bit).
Way to miss the point.
The original poster said "SHOW ME A SLASHDOT STORY ABOUT A IE BUG THAT SIMPLY CRASHES IE".
You did not do that.
Actually there was one about 4 years ago I think. The point was however that somebody was purposely crashing IE, not that there was a bug. You could at least show the sense to try to look it up.
This hardly counts as a DoS attack in its traditional meaning. However it is an annoying bug. I am glad to read that it has been addressed in the latest beta.
What follows is probably an ad hominem attack. Moderate accordingly.
I decided to spend a little time on the Whitedust site. The site is advertised as "The Leading Independent Security News Portal".
The site is run by a group of former crackers. Of course one has to wonder about their cracking, security, and business skills when:
In short this web site has no redeeming value.
Okay genius, how about this one? If you're trying to insinuate that I couldn't find a DoS exploit for IE 6.x, guess again. At some point, proving a point that's obvious becomes tiresome. Next time, go look up your owned damned exploits, because I was right to begin with and I'm still right.
In the end they will lay their freedom at our feet and say to us, Make us your slaves, but feed us. - Fyodor Dostoyevsky
I don't need an exploit to crash Firefox, it crashes during normal usage!
The word Hacker was initially intended to describe a smart tinkerer who finds inventive/ingenious solutions to problems from all areas of life ("hacks" a solution together). At some point big media started using the word to describe malicious programmers who use their abilities to compromise others' systems ("hacks into" ...'s computers and steals ...).
So here you have a word describing 2 different things.
For the "tinkerer/inventor" part of the Hacker population, finding out how something works, how it is broken, how it may be fixed is a joy -- the journey is the destination. The satisfaction of discovery and the recognition of peers is more than sufficient to feel satisified.
No need to be evil to feel successful.
I'm running Marillat's binary of Firefox Deer Park Alpha 2 for Debian, it seems to not crash with this bug.
"goodbye and hello, as always" ~Prince Corwin, from Zelazny's Amber series
As many may people have pointed out, this is just a plain old ordinary borking. Sending broken input to make the application crash or break. There was a time when it was popular to do the same with various versions of Microsoft Outhouse and Express Outhouse by sending carefully crafted email messages that tickled bugs in Outhouse. At the time, people did take those bugs as signs of serious design problems in Outhouse.
This bug and others like it are not of much consequence in and of themselves, but they do help underscore the big problem for browser development. The very early browsers, Mosaic and lynx, made the mistake of being "liberal in what they accepted". That is they made an effort to render broken HTLM. (Lynx, to its credit, at least produced a warning notice.)
This made it easier for web authors to grow ever sloppier in their HTML. And when the browser wars were in full swing, they were largely competing based on which could better render broken HTLM. This of course allowed web page developers to get even sloppier. And they started writing to the unpublished languages of MS-HTML and Mozilla-HTML.
I haven't looked at the actually HTML parsing code of any browser, but my guess is that more than 80% of it is there only to deal with broken HTML. This exploit (and it is an exploit with limited damage) exists only because mozilla is trying to render broken HTML.
This problem with HTML (and so the difficulty and complexity of writing browsers) is the clearest example to me of what is wrong with taking "Be liberal in what you accept, conservative in what you send" to mean that protocol and language violations should be tolerated.
I wish I could offer a realistic suggestion of how we get out of this mess. But the simple fact of the matter is that if one browser starts rejecting broken HTML, then people will use a more tolerent browser.
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
It always amazes me how ALL THESE NEW firefox exploits are comming out, even more exploits then Microsoft someone recently told me... it's still amazing how I NEVER have problems with Firefox, or with my clients that use firefox, but all my NEW clients that run IE or OLD clients who forgot to STOP using IE, have serious problems... That always amazes me how that works out...
-=Linsys=-
http://www.intrusionsec.com
I meant a Slashdot story about a DOS-only bug in IE, not a bug itself (there are hundreds in both IE and Firefox).
Perhaps someone should post a corrected version and hope that it is copy and pasted enough to become the dominant version.
sig
yours,
kbs
Exactly! This is NOT NEWS. Who gives a flying freak if some carefully crafted code crashes a certain version of Firefox. That is not a "Denial of Service" and certainly no big deal. Indeed, if Slashdot posted an article on every time some part of MS-Windows crashed, 99% of the articles would be junk.
I think it was posted by someone excited to see ANY kind of flaw in Firefox. But what I don't understand is how an article like this, with no merit, got approved to appear in front of everyone.
this one is my favorite to stuff in between the header tag
>script> for(;;){window.open('');} >/script>
freezes the fox for a bit, but it will recover in a minute. Freezes 1.5 too, but only freezes it for a few seconds.
DON'T TRY THIS IN IE
(yeah, yeah, replace the leading > with the "less-than" sign...can't include tags in posts, now, can we?)
No patch yet as far as I can tell.
So, how would you like to pay me the $10?
--Barry