Slashdot Mirror
Another Denial of Service Bug Found in Firefox 2
An anonymous reader writes "A second security flaw that could cause the new Firefox 2 browser to crash
has been publicly disclosed.
The vulnerability lies in the way the open-source browser handles
JavaScript code. Viewing a rigged Web page will cause the browser to exit,
a representative for Mozilla, the publisher of the software, said
Wednesday. Contrary to claims on security mailing lists, the bug cannot be
exploited to run arbitrary code on a PC running Firefox 2, the
representative said.
This flaw in the JavaScript Range object is different than the
denial-of-service vulnerability in Firefox 2 that was confirmed by Mozilla
last week. That bug is related to a more serious security hole, which was
fixed in earlier versions of Firefox, the organization has said.
The two 'crashers' are the only publicly released vulnerabilities that
have been confirmed by Mozilla in the week since Firefox 2 was launched.
The issues are only minor, the organization has said."
Switch to Firefox, idiots! None of the security problems!
See?
It used to be that if one an application crashed and it was called just that: it crashed. Today its a DOS attack! Imagine how many DOS my old Windows 3.11 had... come to think of it, it only had one DOS.
We present "DOS reloaded"!
Is anyone else thinking that running firefox 2 with noscript installed means this vulnerability is no big deal?
A non-mofo extension that avoids the problem by disabling javascript isn't really a solution. 99% of Firefox users don't even know what noscript is.
It also has a beginner's privacy bug: (full disclosure: my blog) http://tech-dissect.blogspot.com/2006/10/firefox-p rivacy-bug.html.
In short: Ctrl-Shift-Del doesn't delete everything you expect it to delete, your browse history can still be recovered.
FF: "It's a bug!"
IE: "It's a feature!"
Just FYI, Microsoft has officially put IE 7 on Microsoft/Windows Update as an option to automatically upgrade.
For reals this time.
Another bug?? I want a refund! It's free? I want double my money back!
Fight Spammers!
You could install NoScript addon... Great utility :)
I remember reading about the memory leak. While others see this as a "failure" of the browser, I see it as increasing the odds that the browser exits and frees up your memory. I mean, how hard is it to re-open a browser?
IANA*
The difference is that the so-called "crashing" (closing the FF screen) is due to miscoding (couldn't handle JavaScript the way it was supposed to be done) whereas for IE 7, the real irony is that the anti-spoofing is one of the feature (read: strong points) the new browser is supposed to deal with. If you consider a bugged feature as a major feature, then
Secunia: If you open up an IE 7 pop-up, the phishing address is masked
Shady M$: Not if you follow our safety browsing guidelines and verify HTTPS contents
End-user: You mean we have to browse to your page to read the safety guidelines before I can browse the Web safely? That is after reading your EULA on Windows, and then the IE 7 installation?
So when is Opera releasing their new browser to compete against these 2 and get their fair share of nit-picking?
Yahoo! mail seems to use a less dangerous of these vulnerabilities - while stable versions earlier than 2.0 would crash, 2.0 only crashes when exiting Yahoo! Mail or when closing all the tabs of Yahoo Mail. Firebird 0.7 is not affected
Editors need to RTFA.
Install NoScript plug-in and allow Javascript only for the sites that you absolutely have to use. This solution also protects you against any future Javascript related security issues.
How slashdotters start pointing and laughing when there's a IE exploit, doesn't matter how big or small, and always the "workaround" is looked at as unacceptable.
When it's about Firefox, they immediatly relativate it and minimalize it. "Oh, just install noscript", "tis just a small exploit", "well, why not restart your browser? If it crashes, so what? Why don't you click the icon again? You lazy bastard!"...
I even read some comments, in reply that there's said IE 7 feels better then FF 2.0, that the faults in FF are acceptable. It's a complete double standard.
For me, Firefox 2.0 is worthless; bloathed, crashes constantly, and is just not workable anymore. I've been using Firefox from the very start, but Firefox 2.0 make me switch to Opera.
I think we can keep recursing like this until someone returns 1
Firefox 2 is not ready for the desktop! The world speaks AJAX today and Firefox just jibberish. This is not the performance someone would expect... especially when he tries Firefox 2 on advanced operating systems like Windows.
I suggest you rethink the ways of your project and have a look at IE to see what quality looks like. Because 80+% of a net-citizens can't be wrong.
What a load of utter crap, calling a bug that crashes an application a "Denial of Service'. Morons!
Bart
... it is Firefox with NoScript :)
I wrote this Firefox add-on just after one of these disclosures, because the majority of the browser vulnerabilities was JavaScript related, and the suggested work-around was always "turn off JavaScript".
Disabling JavaScript as a whole seemed quite an impractical advice to me in this AJAXified Web 2.0: I thought that maintaining a white-list of trusted sites allowed to run JavaScript and keeping all the unknown web content "static" until I decided otherwise was a still safe but more convenient approach.
Since then I've been browsing the web with my shields up (NoScript can block also Java, Flash and other plugins), but I allow on the fly with one click, either temporarily or permanently, those sites which I trust and which do need dynamic client side technologies to work properly. To my surprise in 1 year and half I found few sites belonging to this category, because most places I usually browse are well designed enough to work with plain XHTML/CSS and nothing else (like Slashdot itself).
Notice: Firefox is a very safe browser because its vulnerabilities gets patched very quickly, once they're found by developers. I'm a Firefox contributor myself, and I'm very proud of the quality of the Mozilla developers community. NoScript, though, provides some extra protection even against those JavaScript/Java related vulnerabilities which have not been found yet...
There's a browser safer than Firefox, it is Firefox, with NoScript
I'll just add my 0.02 Euros by saying that domain-specific JavaScript settings are available in Konqueror, too (I don't know since which version, but 3.5.2 has them). It also has domain-specific settings for Java, images, and cookies.
Please correct me if I got my facts wrong.
when Firefox 2.0 seems to quite happily lock up on its own with no need for help from the script-kiddies?
And behold, a command prompt and he who sat upon it, his name was shutdown and -h 3:11 followed with him
I already ditched FF2 and went back to the previous version.
What is up with the developer team? Were they just so horny to get a "2.0" out before the end of the year that it was "ok" to release this thing?
You are right, there is a double standard. MS is an easy target as negative comments are expected and encouraged by the moderation system here.
Firefox is no longer Firefox most of us want. Sorry, its nearing the point where we will need to clamour for that slim browser that we had when Firefox first came out (well before the naming hassles).
As for the Netscape 4.xx title, remember the days when IE was better than Netscape? Netscape was great until the 4.xx series, you could never tell which version would work.
* Winners compare their achievements to their goals, losers compare theirs to that of others.
I'm a Opera user and i keep wondering why do ppl adamently use a software which keeps crashing and yet they find a reason to either bash it (IE) or support it (FF fanboys) saying there is such and such workarounds. Why don't ppl switch to the browser with fewest bugs/security holes. Don't give me the crap by saying IE has lot of users so the attackers target IE. While it may be true, a common security analyser like Secunia.com has identified fewest bugs in Opera compared to FF and IE. .... and yet the slashdot crowd is so much in love with FF. and look at the comments above from FF fanboys, they just keep writing suggestions and saying how it is not a flaw. If the posting had IE instead of FF, we would've seen hundreds of posts scolding IE and Bill.
Talk about hypocrisy.
I don't want a signature.
The title reads " Another Denial of Service Bug Found in Firefox 2" but the summary says "... the bug cannot be exploited to run arbitrary code on a PC running Firefox 2, the representative said. This flaw in the JavaScript Range object is different from the denial-of-service vulnerability in Firefox 2 that was confirmed by Mozilla last week."
So which do I trust? There's no way in hell I'm gonna actually read the article!
Immediately stop using Internet if you're using one of those browsers:
.. ..
IE
Firefox
Safari
Konqueror
A new denial of service attack was discovered floating in the cyberspace, that can render any browser inoperable, and it has to be forcefully crashed and reopened. The signature of the exploit was reported to be:
while(true) alert('Hahaha, suckers!');
People are advised to immediately move to Lynx: the only browser known to be immune to this attack.
The two "crashers" are the only publicly released vulnerabilities that have been confirmed by Mozilla in the week since Firefox 2 was launched. The issues are only minor, the organization has said...
They also added, that the reason the issues are minor, is because Firefox 1.5x and later releases of the popular Mozilla browser feature a special "issue shrinking" technology, patent pending, where no matter what happens, the issue becomes small.
This is opposition to Microsoft, which appears to ship all their products with "issue expanding" FUD generator technology, now considered by many specialists as obsolete, where never mind what's the trouble, it's blown out of proportions, and brings chaos and despair among geeky web users.
Since when has a crashing browser been a security problem?
Back when mozilla was young, certain sites would make it regularly crash. I just didn't go back to those sites. The browser was still far superior to IE, which drives me nuts if I have to use it.
I'd like to see how this would be received by slashdotters had the story instead been:
"A second security flaw that could cause the new IE7 browser to crash has been publicly disclosed. The vulnerability lies in the way the closed-source browser handles JavaScript code. Viewing a rigged Web page will cause the browser to exit, a representative for Microsoft, the publisher of the software, said Wednesday. Contrary to claims on security mailing lists, the bug cannot be exploited to run arbitrary code on a PC running IE7, the representative said. This flaw in the JavaScript Range object is different from the denial-of-service vulnerability in IE7 that was confirmed by Microsoft last week. That bug is related to a more serious security hole, which was fixed in earlier versions of IE7, the organization has said. The two "crashers" are the only publicly released vulnerabilities that have been confirmed by Microsoft in the week since IE7 was launched. The issues are only minor, the organization has said."
If you go search Firefox's bug database for bugs with the "crash" and "testcase" keywords at any time, you'll find dozens of known crash bugs. I imagine it's the same for any other major browser. Meanwhile, very few sites intentionally crash web browsers. It makes more sense for developers to focus on lowering the average time between crashes (by fixing the most common crashes), or on fixing actual security holes, than to focus on squashing the largest number of crash bugs.
Why are CNet and Slashdot so interested in these particular two crash bugs? They aren't crashes that can be exploited to run arbitrary code.
The shareholder is always right.
With a tremendous amount of code there is bound to be bugs. The difference between Firefox and IE will be what the Firefox team does about the bugs, and how serious they are. If the Firefox team doesn't handle the bugs well and the bugs are "serious", Firefox might be, *gasp*, put in the same bucket as IE! I'll still use it though..
today i switched back to IE after getting sick of firefox.
yes, i am ashamed to admit it. but help me solve the problem anyway.
i read about this somewhere (slashdot i think), where sites with flash ads make firefox hang, where i have to end process using the task manager in windows. the site in question is friendster. turning off flash isn't really an option, as i use flash for other sites, and my adblock plus doesn't work on flash ads.
so what do you think?
I have bad karma. What do I care what you think?
So, what, is it a link like <a href="javascript:window.close()">Click Here for Money!!!</a> that causes this "DOS"?
If I can interrupt your usage of a particular program remotely, it IS a denial of service attack. I am denying you the ability to use a service.
DoS does not always involve botnets, although they are one way to bring a service down.
Registered Linux user #421033
This is not new because There isnt a browser out there with no flaw, no bug, Firefox is as vulnerable as any other software, you just need to keep prying at something until you found the desired problem, problems are starting to appear in firefox because it has become largely distributed and soon enough they will be viruses specially designed for it. The truth about internet browser is, if you dont want people to find flaws, dont be big. I have never seen a hacker trying to hack a technology or software that is not taking a large market share. Have you seen MAC viruses.....i think not
FF is. That makes it much more apealing to people technically inclined.
IANAL but write like a drunk one.
Why, because even though Opera follows more standards then both other browsers combined, it renders most pages poorely adn has rancid javascript support.
I cant think of a good anology, but basically i use what makes the majority of the sites I visit look good. This is not Opera.
It achieves a sort of sacred status in which people engage in flat-out denial that there are issues because they put too much blind faith in the development process behind it. They will tell you that the only real way of proving anything is the scientific method and then turn around and say they have complete faith that this is the year of Linux on the desktop. This is the primary reason why this site is not considered respectable among some IT professionals: it thrives only on fanboys and huge amounts of bias. Zealotry always involves a certain level of chosen ignorance.
Anyone who uses Optionsxpress and their streaming quote java application should be well aware of the bugs with Firefox and Java. Crashes, lock-ups, and randomly moving your cursor to the left one character after typing. These bugs have been listed in bugzilla for quite some time but I haven't seen anybody tackle them.
Dekker Dreyer
Being able to cause something to crash consistently is neither a denial-of-service flaw nor any other kind of security flaw. Even ignoring that, the article incorrectly mentions denial-of-service as that, in terms of security, usually refers to taking over other machines to create huge amounts of network traffic - it's the taking-over of machines that is the security flaw - the use of the machines to cause a denial of service is just an attack. You would think that the staff of a technical publication would know what they are talking about.
Having a flaw which crashes the browser and only the browser is called a security flaw? Personally I would say that it's a security protection; a security flaw would be when a flaw doesn't cause the browser to crash and allows malicous code to be installed unobserved. If what causes the broswer crash is an attempt at using a flaw for such installation, how come the cracker can't get it right even with the source code available? And what if the broswer is part of the OS...
Yea, like IE has never crashed just loading the google homepage.
FlashBlock?
What's nice about FlashBlock is that it still draws the place where the Flash applet is placed, and then you can click on it if you want to see it. Actually, since I've installed it, I haven't really needed AdBlock too much. (Banner ads don't bother me that much, though.) No annoying audio, unless you want it. No Flash-originating popups. It's actually sort of interesting just to see the "hidden" Flash on some pages that are obviously used for some sort of tracking. There are a few times where the Flash applet is specified to cover part of the page, so that you have to click on it to activate it, then click on it to close/hide it, but that's pretty rare. In fact, the only place I can remember it being a problem is SI.com, which is probably not a site most Slashdotters visit very often.
Forgive me if this is a stupid question...I don't know much about the Mozilla org, or for that matter, how open source collaboration works in real life.
I had the opposite experience, I'm afraid. I found I was enabling scripts/plugins/etc for probabbly about half the sites I visited more than one page on. Worse, many of those were sites I would most want that stuff disabled on -- e.g., MySpace. Eventually, I decided that I was effectively just browsing the same as without NoScript, but with more clicks and page reloads.
I suspect this has a lot to do with personal browsing habits and preferences. If you haven't tried NoScript yet, it's probabbly worth trying, to see if it will work for you. But, it didn't work for me, I'm afraid.
dragonhawk@iname.microsoft.com
I do not like Microsoft. Remove them from my email address.
A non-exploitable bug is not a security flaw , it is a bug.
If there were pages with the intention to crash firefox other than those proof of concept ones. I would worry
It is not only a rule for firefox: When the initial Opera 9 had DoS exploits, nobody really abused them
It Is mostly because a good hacker would like to have the biggest odds so they target IE
In fact, no matter how vulnerable the alternatives are they are simply not targetted
I will just stick to Firefox+NoScript , I consider executing code in my computer a privilege that I would only give to certain webpages, it also saves me from the new kind of annoying popups, those that use pure html and no windows.I would say that if opera had a noscript plugin I would switch, but that's not true, I simply don't like opera mostly for interface reasons (for example the mouse doesn't become a I when you are over text, hoo) And it doesn't even allow plugins.
Copyright infringement is "piracy" in the same way DRM is "consumer rape"
Just crashing browsers is easy enough. Even just with HTML. Remember this story?
(A bit of self promotion.) I took his idea and incorporated it into a genetic programming system that manages to crash most browsers. It also finds HTML source that causes browsers to work for a looooonnnggg time to render a single page (in one case 19 hours for a page). The HTML is not particularly legal, but then there is no guarantee that any web page you load into a browser will follow any particular standard. Source (Java) is available at sourceforge - unpack and look for subdirectory "html". (Warning: As this is an evolving program subject to random hackery to "enhance" things, it is commented sketchily, way underdocumented and far from pretty in most places.)
For me, Firefox 2.0 is worthless; bloathed, crashes constantly, and is just not workable anymore.
What is this "bloathedness" of which you speak?
I've been running FFv2.0 on my home machine for 5 days with my usual full complement of 25+ extensions[*], sessions longer than 24 hours, usually 8-12 tabs open, often using OOo and the GIMP concurrently (under WinXP at 1.6 GHz with 768 MB ram). For the enriched experience and development tools that FF offers, it isn't bloated. It is more stable in this development environment than FFv1.5 was.
[*]Manifest of add-ons:
- 1-Click-Weather
- AdBlock Filterset G Updater
- AdBlock Plus
- Answers
- Calculator
- ChromeEditPlus
- ColorZilla
- CustomizeGoogle
- DomInspector
- eQuake
- Firebug
- FlashBlock
- FoxNotes
- GetMail
- GMail Space
- HTML Validator
- IE View
- Image Zoom
- MeasureIt
- Nuke Anything Enhanced
- Pearl Crescent Page Server Basic
- Performancing
- SpiderZilla
- Sun Cult
- Tabbrowser Preferences
- Talkback
- Web Developer
- Wikipedia Lookup Extension
I will add Blockfall and Colorful Tabs, and possibly Blogger Bar, to this when these become available on v2.0Shocking, so I'm denied service to a website which denies service. Hmmm, perhaps I'll try another site.
Sorry I couldn't think anything else after reading the title of your post.
Now zealots mod me down again.
We are Turing O-Machines. The Oracle is out there.
Here is an easy example, a segmentation violation by not specifying the namespace in xbl.
This is simple way to make people keep away from your site. OTOH I think I just had an idea for browser based minesweeper.
Hi Willem,
when the software patents fight was heating up, I hacked the NoSoftwarePatents image into my site. That's probably the image that's flowing into the text. I removed that now. I've also removed the "Valid HTML" link. I don't see any other problems, but if so, I wouldn't mind an email.
Thanks
Bart
OMG hes posting facs!
Woman are denying me cervix all the time, why should firefox be any different.
Oh wait... denial of service! I need a better screen reader.
The Toyota site did crashed my firefox 2 while trying to build a truck. Very Frustrating.
JavaScript is a programming language. It is turing complete. The halting problem for it, then, is undecidable, making it impossible for any browser to detect all infinite loops / large amounts of memory/cpu consumption.
If theory makes you gag, check out this thread on JavaScript Denial of Service for a list of concrete examples. All of the samples are extremely effective at taking out all browsers (IE, Firefox and Opera alike).
I am more concerned about pages that can crash browsers without the intervention of JavaScript. This includes imagecrash (may crash you!), mailto crash, and an huge XML file crash. They should be preventable.
Anyway, the reason why DoS's aren't actively pursued by the black-hat community is that it's very difficult to put them to good use. Sure, it will annoy someone, but it's hard to monetize, etc.
Amen to that man.
I also am/was an ardent FOSS evangelist, damn in love with Firefox and religious about kicking IE's butt whenever I had the opportunity to, but the fact is that if IE is a worthless piece of crap (though I like the IE7 interface better than FF's), FF is also nothing but a spoilt brat. Word has it that it snatched a lot of IE's market share but though it might be partly due to innovations, much of it is a result of the blind support from the FOSS community because as far as quality and innovation is concerned, Opera rulz the roost. FF is a memory hog, has less standard support than Opera (get thru the goddam acid test u fatass!), crashes damn much, copies a lot from Opera with no real innovation till date. It boasts of tab browsing and popup blocking but it was Opera that came up with that. In version 2.0 it comes up with spell checking which is fine (Opera got it too), but which is nothing when compared to those of Opera (widgets and bittorrent!). I know what u guyz are probably thinking - Firefox has extensions which bring about unlimited functionality yay! Extensions are probably the main thing that kept me clinging to firefox for so long but it aint worth the cost coz FF is pretty unstable and guzzles tons of memory, running many extensions only adds to the burden, Opera does much better by natively supporting features that everyone wants, and leaving the extra gloss to things like widgets. Indeed Opera got not only a browser but also an email/news reader, bittorent client, irc client, and lots of nifty features like remembering my previous session which was until 2.0 unsupported but for tabbrowser extension (highly unstable in its beginnings) and all that with half disk space compared to FF. With about that extra space you could get speech support for Opera which is perfect for those with handicaps or who are plain too lazy to hold a click-a-doo. Needless to add that Opera is much much more secure than FF.
And yeah Opera IS the fastest browser on earth, firefox AIN'T!!!! Even my non-geeky silver surfer dad noticed it. Someone should really step up and give Firefox a good spanking coz it really needs one if one day it wants to acquire the quality of a first class browser. Get real dudes, get opera, I did.