Firefox Zero-Day Code Execution Hoax?

Akon writes, "eWeek is running a follow-up story on the claim by two hackers that Firefox's implementation of JavaScript is critically flawed and could result in code-execution attacks. Turns out this is a possible hoax that was overblown for laughs." Mozilla's engineers say the risk is limited to a denial-of-service issue. From the article: "'As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has... I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code,' Spiegelmock said." Spiegelmock also stated that the claim that there were 30 other undisclosed exploits was made solely by his co-presenter, Andrew Wbeelsoi.

Comments

Great!!

[zappepcs]

The first time that I actually started to worry that FF might have a problem, and that I should be careful, it turns out to be a hoax. I don't know whether to be happy about this or not?

Re:Great!!

[__aaclcg7560]

Be happy. It could've been worst and happen on Internet Explorer instead.

...crash and eat up system resources...

[RHIC]

No change there then.

Moo

[Chacham]

FireFox has no exploits. All exploits are actually in IceWeasel, to avoid legal action from Mozilla.

In other news, Microsoft has said thet their version of Genuine Internet Explorer has no bugs, and any bugs, must be due to a bad download, or user tampering. As such, all user installs of Internet Explorer will be renamed to "Meshed-Screen Interpolated E-reader" (MSIE for short), and will subsequently be subject to licensing fees.

Then it wasn't painfully obvious enough

[davidwr]

If the CNET folks didn't get it, the panel should've made sure they did.

Any prank like this NOT done on 1 April needs to end with "and for those of you who left your sense of humor at home, the preceeding presentation was 100% pure entertainment and any resemblance to reality was purely to tweak your nose. Please stay for the next panel on novel approaches to perpetual motion. Thank you."

Re:NoScript

[TheRaven64]

But...

But...

Web 2.0!

*splutter*

Re:Never believe anything without a second source

[gEvil (beta)]

Never believe anything without a second source

Anyone want to reiterate what he said so we can know that we should believe him?

Re:Never believe anything without a second source

[chroot_james]

I'll back him up. Kind of. I propose requiring a third source. Anyone want to reiterate?

Re:Moo

[Anonymous Coward]

> "Intarweb Implorer"

Hey I think you found Debian's new name for Firefox.

Re:Not surprised.

[Jugalator]

I bet you have few friends. :-(

Re:Never believe anything without a second source

[Senzei]

I disagree. Now you still have to find a 3rd source to agree with you and 3 sources to discredit me. And of course I just got off work so I have all day long to disagree with those who disagree with me in the first place. Better put on a cup of coffee. :-)

Actually, I think you owe us two more sources to confirm your disagreement. Well, I would think that, but we haven't found three sources to conclusively prove that three sources are needed to conclusively prove something.

Re:What's in a name

[kayditty]

there's no apostrophe in A. Wbeelsoi.