Slashdot Mirror
Unpatched Firefox 1.5 Exploit Made Public
ThatGuyGreg writes "C|Net is reporting that an unpatched exploit in Firefox 1.5 has been made public, making it very easy for ne'er-do-well-sites to cause your browser to crash on startup with a single visit. Until a patch is released, it is recommended that you disable your history.dat file."
I can report that the exploit doesn't work on FC4, with the latest 1.5 built from source.
I'm still using Internet Explorer!
If it's already happened to you, just delete your history.dat file in your profile folder, and FireFox will create a new (empty) one on startup.
Dat file will be history, man.
If this only crashes Firefox, how is it an "exploit"? I tend to use "exploit" as something that an attacker can use to their advantage to do something malicious. This is just an annoyance to have to move my poor cursor back to the icon and issue an oh-so-painful double-click.
today is spelling optional day.
Sounds like a great opportunity to show off the snazzy automatic incremental update feature Firefox 1.5 has. Pushing a fix quickly to users who've got it enabled would be great.
Switch back to Slashdot's D1 system.
Cheers,
Toby Haynes
Anything I post is strictly my own thoughts and doesn't necessarily have anything to do with the opinions of IBM.
The 'exploit' seems only capable of a Denial of Service. There's no proof to indicate that malicious code could be executed.
Plus, read this (from the article):
"We have gotten no independent verification that it crashes (Firefox), but there have been a lot of attempts to try," Schroepfer said.
So, this is all very hypothetical then?
This slashdot-related signature is a stub. You can help kihjin by expanding it.
thats what thet get for making an extension that runs explorer within firefox https://addons.mozilla.org/extensions/moreinfo.php ?application=firefox&id=1419
*ducks*
This isn't even related to security. Its just a bug.... lots of apps crash when something happens. Doesn't mean its ok, but it doesn't represent a security issue does it? (Unless I'm missing something...)
Those of us with sturdy tin hats already have our histories disabled. Take that, evil!
Is it just me or is this a pretty worthless report? I can't really see this as being an exploit anyone would care about unless you happen be work for a certain company in Redmond.
Quote from the bottom of the article:
Correction: This story incorrectly stated the affiliation of Mike Schroepfer, Mozilla's results in verifying the Firefox 1.5 flaw, and the nature of the problem. Schroepfer is vice president of engineering with Mozilla Corp., and Mozilla has not been able to verify its browser can crash and lead to a denial-of-service condition. The problem itself was a not security vulnerability but actually a flaw in the browser.
Read the article before you consider posting it with a sensational title!
Before someone starts saying Firefox is vulnerable to exploits just as IE, this exploits crashes the browser and only that, now compare this to IE's execution of arbitrary code.
No software is perfect, but still, Firefox is clearly ahead.
The IT section color scheme sucks.
This will be a good test for the new Update System that was implemented in Firefox 1.5. Too bad it will need to be utilized so soon.
With the speed that the Firefox developers release their fixes and the ease of getting those fixes with the new system, I hope this will develop as proof of how well Firefox can handle these situations.
--
Brandon Petersen
http://www.brandonpetersen.com/
The guy who reported it called it a 'buffer overflow' and clearly had no understanding of what it actually meant.
which
most users won't figure out.
this proof of concept will only prevent someone from reopening
their browser after being exploited. DoS if you will. however, code
execution is possible with some modifcations.
Tested with Firefox 1.5 on Windows XP SP2.
ZIPLOCK
-->
heh
function ex() {
var buffer = "";
for (var i = 0; i ZIPLOCK says CLICK ME
When an app crashes (firefox does quite often for me) it means that it is doing something that the programmer didn't expect. That could be all sorts of things, from taking all the cpu, to writing to memory that it shouldn't be. Most overflow exploits started as mere crashes.
concrete5: a cms made for marketing, but strong enough for geeks.
Wow, that is accurate reporting, which was then amplified in the summary to the point of absurdity.
Sig under construction since 1998.
I ran the proof of concept on my installation of 1.0.7 (WinXP SP2) and it crashed the next time I opened FF. Task Manager showed that FF was eating up the memory like crazy. I deleted the history.dat file (which was 10 MB in size!!!!!!!) and sanity returned instantly :)
In other news: Water is wet. Seriously, whoever wrote the history code needs to be shot. Once your history gets to any significant size, all operations on it start getting annoyingly slow. For me, it takes 15 seconds for firefox to open the Go menu for the first time in a session, and once you've done that, even more annoyingly there's a delay of a few seconds on every new page you visit for the rest of that session. The history sidebar is so excruciatingly slow it's practically unusable.
Preferences > privacy > history > [0] days; ok.
Patched. I use the history feature about twice a year, won't miss it till the right fix is found.
Not quite like disabling all the javascript in MSIE, is it?
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
Another tip for you: if you remove the gas pedal from your car, you won't have any crashes! Really!
DOWNLOADING MORE SOFTWARE to intentionally disable part of a program that is supposed to work is 150% unacceptable.
Jesus, how bad does software have to get before people finally start to not use it? Luckily, I didn't pay anything for my Firefox installations, so I can't really bitch. But I CAN look at other, less buggy alternatives (like IE) that also offer useful features that Firefox doesn't, like Active X.
No, just a badly worded summary of the original storm center diary entry in which the ISC handler attributes the possible FAILURE of this bug to crash firefox to the McAfee software, which, in his mind, has some mystical power to optimise firefox's inefficient string parsing algorithm even when it's deactivated!
This bug is slightly lame, even as DOS -- There are no confirmed reports from half-or-more-brain-having people that it even crashes the browser in the first place. All it does is make the subsequent startups slow, especially noticable in slower machines.
See bug 319004 at bugzilla.mozilla.org.
I recognize that it can cause inconvenience, but come on. Exploits in IE typically result in executing arbitrary code on the user's computer. I guess this is just another argument as to why system diversity is important. If no browser had more than 20% of the market it'd be difficult to target a large portion of internet users.
Rendered using Microsoft's *NEW* CSS/Teenager parsing utility:
False alarm. No security-related concerns, just overenthusiastic reporting.
If you run the script below, it will create a page with a title that's quite huge. Close your browser and open it again. The browser will spin for about 2 minutes what it tries to make sense the contents of your history file. Once it's finished, you'll be back up and running, with no degradation in performance or visible side-effects. You'll be able to even view your browsing history (including the offending page). In fact, I'm posting this response after following the process described above (on WinXP), and I have a history entry entitled "AAAAAAAAAAAAAAAAA..."
A bit of an annoyance, but hardly a security issue.
Here's the official exploit code:
"With sufficient thrust, pigs fly just fine. However, this is not necessarily a good idea...."
RFC 1925
C|Net has added the following correction at the end of the story:
"Correction: This story incorrectly stated the affiliation of Mike Schroepfer, Mozilla's results in verifying the Firefox 1.5 flaw, and the nature of the problem. Schroepfer is vice president of engineering with Mozilla Corp., and Mozilla has not been able to verify its browser can crash and lead to a denial-of-service condition. The problem itself was not a security vulnerability but actually a flaw in the browser."
So Firefox crashes, but no security vunerabilty.
Jumpstart the tartan drive.
The claim of a buffer overflow is nonsense. I suspect that that claim is a joke. The only thing that makes this mild borking work is a very long document title. In setting that up, the author uses a variable called "buffer" and "buffer2". Just because a JS variable gets named "buffer2" and gets set to something very long doesn't make this a buffer overflow. I like to think that the guy must be joking, instead of actually being that stupid.
But in the end, there is a bug to be fixed in Firefox
Prime numbers are exactly what Alan Greenspan says they are -S. Minsky
I love how this is considered Informative.
What? Oh, Jamaicans say "mon" instead of "man". I should write that important information down. Maybe it should be added to http://en.wikipedia.org/wiki/Jamaican_English.
Keep that information flowin', mon! Irie!
Shabba!
You know where you are? You're in the $PATH, baby. You're gonna get executed!
Sorry, having just posted that, it THEN crashed when I closed the Apple tab.
Sure, the proof of concept uses JavaScript. But the problem itself has nothing to do with scripting. One could easily generate a 2.5MB HTML file with a really long title. 2 million "A"s in a row will probably compress pretty well, so if you serve it with on-the-fly compression, it doesn't have to take much extra time or bandwidth to retrieve.
Bingo: exploited with no scripting involved at all.