Slashdot Mirror
Mozilla Firefox 1.0.7 DoS Exploit
An anonymous reader writes "Whitedust Security are reporting on a new exploit for Firefox which apparently affects all versions of the browser from 1.0.7 down. From the article: "If this exploit has made it out into, or indeed been retrieved from the wild is unknown at this time. However it is clear that this exploit will indeed need patching as soon as possible.""
A 1.0.7 exploit that only affects everything below 1.0.7!
I checked out the Mozilla site -- not a peep about it. I made a post there. I figure this one totally right hooked them. It's a pretty massive crash. Just makes the whole browser lock up. At least I know they'll fix it fast though...I think in 24 hours we'll see a turn around. Anyone try this with version 1.5?
Help me, help you. - Jerry McGuire
Mozilla Thunderbird 1.0.6 is also vunerable.
SIG: TAKE OFF EVERY 'CAPTAIN'!!
Why are there so many nice hackers in the world? Willing to spend their time finding exploits, post them, and even a "safe" example. Do they take pride in helping the surfing community? Why don't they just hijack the world's browsers and make us choose between "Yes" and "Okay" on their PayPal deposit sites?
Where are the evil hackers, or have they all converted, scared about stiff http://news.bbc.co.uk/1/hi/technology/4249780.stm penalties?
~jennifer.k~
OMG there is an exploit for firefox but we don't know anything about it but it might be dangerous. i need to switch back to IE maybe...
How long has a webpage that makes a browser crash been called a "Denial Of Service Exploit".
A browser that can be crashed is a very bad thing, but suggesting this is some sort of "Denial Of Service" attack, is just semantics. It doesn't crash the box, and it doesn't flood/break the network. Every other service on your machine runs as normal. That's not a Denial Of Service by the usual definition of the term.
Athletic Scholarships to universities make as much sense as academic scholarships to sports teams.
What follows is the source code made avaliable on the site.
:(
Mozilla
# milw0rm.com [2005-10-16]
I have 1.0.7 and it caused me to crash
Have you metaroderated recently?
There isn't much incentive for malicious people to crash people's browsers.
The wording from the security company has me thinking they're just trying to make a name for themselves.
This can freeze your browser.
Wheres the vulnerability? when does the spyware attack? Do I need to reinstall Windows?
Should I buy a virus checker?
Anyone stupid enough to host this "exploit" on their site are just dumb,
"oooooh it makes your firefox freeze" BFD - stay away from dodgy parts of the net
(goatse is a bigger "exploit" and generally leads to complete machine shutdown/restart as you attempt to hide it from your colleagues)
liqbase
1.5 is beta, dude. 1.0.7 is the latest final release of firefox. 1.0.7 is like 1 month old.
And after I clicked on it, nothing happened, the browser just said: mozilla
Apparently firfox 1.0.7 on linux is not affected. So not all versions of firefox are affected.
Advisory: Install linux, then restart your browser and have fun.
My wife's sketchblog Blob[p]: Gastrono-me
The exploit is:
t ml>
<html><body><strong>Mozilla<sourcetext></body></h
and it also makes Mozilla suite 1.7.12 hang.
The sourcetext tag is used when a parser error occurs; the Mozilla DOMParser will accept any string and always returns a valid XML DOM object, but in the case that the string was malformed, it returns something like this:
<parsererror xmlns="http://www.w3.org/1999/xhtml">XML Parsing Error: mismatched tag. Expected: </strong>. Location: file:///1253.html Line Number 3, Column 37:<sourcetext> (text here) </sourcetext></parsererror>
which you may have seen formatted before in a nice red-on-yellow page.
I guess I'll just stick with Konqueror.
Despite the article summary if you click through and read it you'd find that there is code out there.
Danger Will Robinson test your firefox Danger Will Robinson
Your hair look like poop, Bob! - Wanker.
...it shows an "update" icon, which updates when clicked. How much easier could it be without hijacking your system to do it for you?
I think you meant "less than," rather than "greater than".
sig
There's not much to it though:
Ah well, not much harm done. Of course, there's nothing to stop Microsoft putting it into MSN deliberately to break the browser, in much the same way they tried to nobble Opera some months back.
Never email donotemail@WeAreSpammers.com
So clicking on a link can lock up the browser. So what?
How is this any different from this, which effectively locks up *all* current browsers?
<script>
while(true){
alert('Haha!');
}
<script>
This is hardly important. I don't see any way this can crash my machine or infect me with a trojan.
PS if you want a fix for the above vote for bug 61098] at bugzilla.
Comment removed based on user account deletion
You got it all wrong. That particular problem has more to do with Athlon processors than with Internet Exploder.
Any ideas as to what is going wrong?
http://www.thebricktestament.com/the_law/when_to_
I think the poll at the top of the page should ask, "Do you trust WhiteDust security?"
Oh, wait - that's what the 'Test the exploit' link is for.
"Our interests are to see if we can't scale it up to something more exciting," he said.
The difference between FF having an issue and IE having an issue is that when FF has an issue it only affects the browser itself. When IE has an issue it can cause issues with your entire operating system because the browser (an application) has been retro-welded into the OS.
Also, FF is being developed by people who aren't getting paid (well, most aren't) for their service compared to Microsoft, a multi-billion dollar corporation which has had 10 years to try and get the bugs out of their product.
We will bankrupt ourselves in the vain search for absolute security. -- Dwight D. Eisenhower
It's hardly news to be able to DoS a browser. I DoS both FF and IE regularly while working on DHTML scripts, often when I use a debugging "alert" in the wrong place. Try this one and see how much farther you get during your morning browsing:
<html>
<body onmousemove="while(1) alert('ooooh');">
</body>
</html>
Watch out before you run it! You wouldn't want to lose that Xanga post you've been working on.
This crasher bug has no effect on my post 1.5 beta 2 version of firefox on Linux. Gecko/20051017. A new crasher bug is also not news. There are hundreds of ways to crash mozilla. Lets face it most browsers aren't at a state to jump every time there is a new bug to crash or "DOS Them" as the article states. Just another security site trying to make themselves look good at a products expense. How much money does it cause companies like the Mozilla Organization to release a new version of their browser, just to put an end to the bad press of a so called "exploit"?
We cannot use this as an excuse in the open-source community; it's very dangerous. When you are trying to convince the general population that FF is superior to IE and can be successful in an enterprise environment, which is generally the goal, you can't consider the two to be on equal footing in performance and features and then shoot it down by relegating it to a niche position. Though we realize the FF devs are volunteering a lot of time, we want to convince others that it doesn't matter, or in fact, it improves their ability to solve problems.
And let's suppose it is in the wild and to get infected I don't have to go to some Russian site selling stolen credit cards. Can anyone see how that could be possible? You'd have to go to a site knowingly and maliciously designed to exploit this, right?
Since you have to go to a specific web page, with a specific browser ... and the only thing that will happen is that your browser will crash ... is "attack" the correct term for this kind of behaviour?
If you crash your car into a tree, did that tree "attack" you?
If you crash your car when driving over ice, did that ice "attack" you?
If you drive your car off a bridge and into a lake, did that lake "attack" you?
Since you cannot use your car immediately after a crashes, are trees considered a DoS exploit?
Install better plugins for flash/pdf/etc or just remove the bad plugins. You get the same affect in windows if you're a moron and install the old adobe 5.0 plugin that hangs. When the plugin hangs or uses a lot of cpu it affects the browser.
If you didn't know this I guess the joke is on you. Welcome to russia.
Also, FF is being developed by people who aren't getting paid (well, most aren't) for their service compared to Microsoft, a multi-billion dollar corporation which has had 10 years to try and get the bugs out of their product.
That does not matter in the least. As a user deciding which software to use I don't care how it was developed in the least. What I care about is what I get for my money. FOSS software has no more of an excuse for bugs and exploits then propriatry.
And I say that as one of the mentioned developers who have worked on mozilla for years, most of which unpaied.
That said, this advisory doesn't mean anything. Sure, it's bad that a website can crash your browser, but that has always been the case with any browser released. But it's not nearly as bad as exploits that allow sites to steal your data or hack into your system, which this so far does not claim to be.
And no matter what, what happened to responsible reporting? Releasing exploits in the wild without giving the developers a chance to develop a patch first is just plain stupid and shows a complete lack of professionalism.
Failing to learn from history dooms you to repeat it.
Ok, this isn't really a security bug. It's a crasher. If this is a security bug, so is this one (you'll likely need to cp/paste into new window to open) that I discovered a few years ago.
IMHO "security" bugs are for ones that have an impact on "security". If it doesn't fit that criteria, it's not a security issue.
A JS permissions exploit would be a security bug. So would the IDN issues, and buffer overflows...
but a crasher? I think that's pushing the benchmark. It's not really a DoS... it's a crash/hang.
It would be a security issue if say, it caused 911 to become unavailable, or killed US Radar systems... but not for crashing a web browser.
I think people have been pushing for a while in hopes of getting new security bugs. And that's all products, not just Moz. There are legitimate security bugs, but I don't think this qualifies. IMHO you need to be able to do something that violates security to be a security issue.
No remote execution or personal data being revealed, it just hangs the browser. It doesn't even seem to slow down the rest of the system, it just makes Firefox unresponsive. So?
t ml>
It's easy to do that to almost any browser. Loading a lot of really big images will crash Firefox when it runs out of memory, and has the side-effect of slowing the rest of the system (or probably crashing it if it's based on windows 9x).
The "exploit's" entire HTML source reads like this:
<html><body><strong>Mozilla<sourcetext></body></h
It's clearly a silly bug, but I feel that saying "it is clear that this exploit will indeed need patching as soon as possible" is excessive hype. This is not a security issue. This is part of the known problem that Firefox is not very tolerant of buggy code, which is a general serious issue that does need fixing.
I wonder if this is a Gecko bug? An email version of this for Thunderbird would be very annoying.
# cat
Damn, my RAM is full of llamas.
[about slashdot's 'failure' to treat MS and FOSS screw-ups with equal equanimity] Why not offer equal critiques, and understanding, for any product regardless.
It has taken more than a decade of loathsome business practices, corrupt corporate ethics, and abusively bad coding practices for Microsoft to earn the unique status it holds on Slashdot and other fora where people who've been in the business for a while congregate. Would you deny Microsoft the community recognition it has strived so hard for so long to achieve?
1. A bug is found in Microsoft software that allows remote execution of code on your machine, without user intervention.
2. Story is posted on Slashdot.
3. People rightly comment on it.
Show me the stories of bugs that simply crash IE. Really. I'm curious. Because there are literally hundreds of ways to crash IE with a malformed webpage. These don't make it as Slashdot stories. Pretty much the only vulnerabilities in MS software posted here are ones that allow an attacker to actually DO SOMETHING NASTY.
Contrast this with OSS, where we post every single meaningless bug in a piece of software, even if it has hardly any practical effect.
If anything, the double standard is that we're far more critical of OSS here than MS.
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
When will they wake up and stop releasing buggy software.
I will not have any of their software on my computer. I ONLY use Microsoft products.
OK, the IE fanboys are really stretching now. If crashing the browser is an "exploit" then that opens a whole new avenue of attack on IE. IE crashes like this (for me) far more often then firefox, and firefox crashes just about every time I visit a site with really involved flash or those really annoying smiley face banner ads (those are firefox killers).
ctrl+alt+del kill process is a good workaround for this "extremely dangerous" exploit. Again if this is a security vulnerability, then flash is the greatest hacking tool against firefox. Java is probably the greatest hacking tool against IE.
People are just really desparate for Firefox to have more bugs than IE. Thanks for finding some code that should probably be cleaned up, but crashing the browser is not in any way violating the security of the system on which the browser is running.
You want the truthiness? You can't handle the truthiness!
Ok, you might be a troll, or flamebait, but it is worth a response...
This discussion is not any different than it would be if it was about IE. There are always those saying "no big deal" about IE security flaws, and plenty of people screaming blood on this conversation. Maybe the balance is slightly altered because so many of us have been burned by IE though....
Having said that.... This is no big deal. Even TFA says "This is not an advisory, just a comment" indicating that the authors don't think it is a big deal either.
LedgerSMB: Open source Accounting/ERP
Just create a large (~500Mb) file full of zeroes. gzip it, and place it on your webpage. Most browsers open .gz files in the browser, and loading something like 500Mb in the browser takes some time. May not crash the browser, but is definately as DOS as the articles "exploit" :P
This hardly counts as a DoS attack in its traditional meaning. However it is an annoying bug. I am glad to read that it has been addressed in the latest beta.
What follows is probably an ad hominem attack. Moderate accordingly.
I decided to spend a little time on the Whitedust site. The site is advertised as "The Leading Independent Security News Portal".
The site is run by a group of former crackers. Of course one has to wonder about their cracking, security, and business skills when:
In short this web site has no redeeming value.