Serious Vulnerability In Firefox 2.0.0.12

Oh, Not Now writes "Mozilla Firefox 2.0.0.12, mere hours old, is vulnerable by default to a directory traversal trick, via the view-source mechanism. Although mitigated by the NoScript plug-in, this is quite a serious bug — the default installation is vulnerable from the get-go."

Comments

Damned it all

[Overzeetop]

Just before I opened this session, I had upgraded.

Oh, well, just one more unlocked door in the grass hut I call a computer.

Re:Damned it all

[Nazlfrag]

http://noscript.net/getit.

Re:Damned it all

[captnjameskirk]

They are written in Javascript but with special hooks that allow access to Firefox itself (e.g. creating new Firefox menu items, storing plugin settings between sessions, lots of stuff). The fact that the language is Javascript is not what causes the "bogging down", it's when a user installs many, many plugins. The same thing happens with IE when someone installs many, many toolbars or Browser Helper Objects. Don't overdo it and it's not a problem.

Re:* Stops download of newest Firefox *

[webmaster404]

Also, one thing that I have noticed about OSS bugs is that those severe enough to cause execution of code, there are very very few utilities to easily attack systems unlike their MS counterparts. Most OSS flaws are rarely exploited in the wild. The only thing that annoys me about them is that someone will surely come up to me on Monday stating how bad Firefox is because of this while blissfully ignoring all the flaws that Windows/IE has had for years.

Payload

[milsoRgen]

So my I understanding is that this vulnerability can be used to read the host computer, and...

Other issues can emerge also, this is only a short-hand proof of concept. I'm just curious if this could be eventually exploited to actually alter data on the affected host?

NoScript

[bazald]

Why isn't NoScript just a mandatory extension at this point? It seems like it would be pretty unobtrusive with default settings at a slightly reduced paranoia level.

Re:NoScript

[milsoRgen]

Why isn't NoScript just a mandatory extension at this point? I wouldn't be surprised if it becomes a part of the browser (or something like it), just as pop-up blockers of yore have been incorporated.

Re:NoScript

[ilikepi314]

Because most are not educated how to use it properly yet. It's terrific, but I know firsthand from trying to introduce it to people that they ignore it, realize many of their websites are broken, then I say "Well, you can allow certain websites you visit with this little button" -- they then promptly pick "Enable Globally" (or simply whitelist every single site they ever visit), and it has no effect.

So instead of teaching people security, it just teaches them "Security is annoying and breaks everything, what's teh point?" and they want to use it less.

Re:NoScript

[Firehed]

How would it work at a slightly reduced paranoia level? There are, I suppose, for options: block everything, block nothing, block off-site scripts, and only allow trusted scripts (somehow including a database of checksums of widely-deployed, known-safe scripts like Google Analytics' urchin, jquery, Amazon affiliate stuff, and... that's all that comes to mind). Foreign scripts aren't going to cause any damage unless the site itself is vulnerable to XSS attacks - malicious websites aren't likely to off-site the scripts. A database of the known acceptable scripts would be so minimal that it would defeat the point, especially as so few of them are of any benefit to the site visitor. Unless a built-in NoScript were to block specific functions in Javascript that could be used for malicious purposes (anything other than strict DOM manipulation, I suppose), it wouldn't do much good - and breaking half the JS on a site is probably going to be much worse than breaking everything.

Re:NoScript

[mrsteveman1]

If it became part of the browser, 3 things would happen: Idiots would scream and cry about being forced to use it, it would integrate better making it more effective, and vulnerabilities like the one referenced here would be a non-issue for a much larger percentage of the user base.

Seriously, running every script a page stuffs into a browser should not be the default, and it should not take an extension to fix it.

Re:NoScript

[93 Escort Wagon]

Why isn't NoScript just a mandatory extension at this point? It seems like it would be pretty unobtrusive with default settings at a slightly reduced paranoia level. Well, to tech-savvy users this would be true; but unfortunately most users aren't even marginally tech savvy. It doesn't matter if NoScript puts up a clear, unambiguous giant flashing red sign that says "This site will have reduced functionality because we're blocking some scripts from running. Click here if you really want to run all these scripts" - based on past experience, most people will just be positively flummoxed and won't have the foggiest idea why some sites are now "broken".

The thing is, looking at it from the designer/developer end, most users seem to want the functionality Javascript provides. My job largely consists of designing "intranet" apps for a university department. With forms, the end users want the ability to click a button or link to add extra fields when necessary. They want web-based calculators that figure out totals and percentages automatically. They like little explanatory pop-up boxes that define terms for them if they don't already understand what it means. They prefer drop-down menus that change, based on choices made further up the form.

I realize that NoScript actually allows white-listing for situations like this (just like IE does for ActiveX, God bless 'em) - but I don't have much confidence that non-technical end users will understand, even with training. Making NoScript or a similar tool the default will end up meaning significantly more of my time being wasted dealing with support calls - after all, if the web's broken you don't call the desktop support people, you call the webmaster, right?

(BTW is Firefox 3.0b2 or b3 vulnerable?)

Re:NoScript

[punissuer]

Have you noticed how often NoScript gets updated? I wouldn't quite call it unobtrusive, especially since NoScript likes to make your browser open a tab to the NoScript site after an update. Really, how hard is it to prevent execution of javascript that didn't come from a site that's been whitelisted? I now use AdBlock Plus instead.

Re:NoScript

[milsoRgen]

On a similar note, I would not mind integration of Adblock Plus. Shhhhh! Once sites learn more and more people are blocking ads, they are going to move on to an even more insidious manner to deliver screaming, moving obnoxious hobbknobbery to our computers...

Re:NoScript

[SJS]

... (somehow including a database of checksums of widely-deployed, known-safe scripts like Google Analytics' urchin, jquery, Amazon affiliate stuff, and... that's all that comes to mind)

Why is everyone in love with checksums?

Disk is cheap. The amount of scripting I should trust is small.

So cache the *actual* scripts... and then use those as keys into what scripts are actually run.

That is, when you first hit a website that tries to run a script, capture all of the script functions and fragments, and indicate to the user how many un-approved scripts are on this page. The user than has the option to say "Trust this set of scripts" (like noscript now), or "Let me look at these scripts."

And this is where the fun can begin.

The browser can present to me a list of script functions and fragments, each with a "allow", "deny", or "remap" option. Allow is just that -- allow that script function or fragment to be run as-is, temporarily or for that page, machine, or domain. Deny is just that -- deny that script function or fragment, again, for that page, machine, or domain.

For remap, however, I should get a little two-window/textarea display (top/bottom, left/right, don't care, should probably be the user's choice), one read-only (the key) and the other editable. I can then edit the second chunk of code as I please -- stupid client-side verification, gone, replaced with "return true;". Code that disables a feature, deletes information from the display, and so on and so forth... gone. The test for browser/os versions... gone. Bugs become fixable. (Sure, I might introduce bugs, but that's my own fault, and it's my browser anyway.)

Most folks wouldn't ever use "remap" in this way, but that's okay. The ability is there, just like most folks don't compile open-source programs from scratch. That's not the point... if they wanted to, they could.

The next step is to share remapping libraries, like people are sharing greasemonkey scripts now. I could get a call from my mother about how some website is broken to how she'd want to use it, and I can go look at the web-page, fix it, export my changes to some convenient archive, drop it on to my webpage, and then send the url to my mother, who can click on the archive, and have the browser ask "Do you want to install this?", click "Yes", and all is well in the world.

Sure, some websites will take steps to make every bit of client-side scripting unique for every connection. They'll obfuscate their code, randomize the variable names on a per-session basis, mess with the structure... and now you KNOW those websites are hostile and malicious and should be treated as such.

Don't bother with checksums, that doesn't put any power into the hands of the users. Track code, and allow for client-side replacement of code. Allow end-users to share their code-replacement libraries. We can kinda-sorta do that now with plugins and greasemonkey, but that's tricky and error-prone and tedious. Let the computer solve the problems that are tricky, or error-prone, and especially the problems that are tedious!

Re:NoScript

[93 Escort Wagon]

So because you decide to use the browser as some sort of generic code execution engine and GUI for your own hacks instead of writing your programs to run as a real application like everyone else, people browsing the web should remain a target for javascript abuse, bloat and exploits.

It's not 1994 anymore. People don't just work on their own discrete data sets living on their own desktop computer now. People use webapps because the information is often centralized in places such as MySQL databases, and numerous different people need read and/or write access to it for differing reasons depending on their job function.

The "real" applications (gotta love that required platform lock-in, btw) you talk about would still need access to that centralized data. So you pick your poison - do you provide direct access to that central data repository for a wide number of computers, or do you limit access just to connections from a web server (which is then open to that wide number of computers)? Personally I'd rather keep as much insulation as possible between that back-end data and the rest of the world.

Re:NoScript

[the_womble]

Exactly, the average users reaction would be: Internet Explorer (or "the normal internet" as I recently heard it called) works on this site, Firefox does not, so Firefox is broken.

The minority who can cope with those sort of settings can manage to install an extension.

Re:NoScript

[thejynxed]

Easy fix for the issue you mentioned...

In about:config, you put noscript.firstRunRedirection into the filter box. Modify the boolean from true to false. Restart FireFox.

No more NoScript Update page. Enjoy.

Re:NoScript

[PReDiToR]

God save us all from creature feep.

While you're at it, why not put AdBlock Plus in there and FlashBlock and Greasemonkey and Fasterfox and GMail Notifier and ...

Some people don't want everything included in the distribution, some developers don't want to have to make all those things work with every release and compile they do of test builds.

AutoUpdate of things you choose to install works just fine, and the people who build the add-ons make sure they work without having to work for MozFoundation.

Re:NoScript

[CNeb96]

You forgot the 4th, it wouldn't be upgraded nearly as often as the current maintainers upgrade it. Noscript is updated all the time. Firefox needs a hybrid approach include extensions by default AND allow them to be independently updated separately from the main release, they don't do that currently for any extension.

yahoo or mozilla

[erat123]

Maybe microsoft should have looked into mozilla instead of yahoo...

Re:* Stops download of newest Firefox *

[De Lemming]

As far as I understand, versions before 2.0.0.12 are also vulnerable...

Re:* Stops download of newest Firefox *

[LiquidCoooled]

Why stop downloading it?
I cannot work out from the article whether older versions of Firefox are vulnerable or not.
If its an unfixed bug from previous versions you should continue to download.
Which would you rather:
have 20 known vulns in the wild (stay as you are),
have 1 known vuln wild (latest update).

Until we can be certain though, just click pause ;)

Re:* Stops download of newest Firefox *

[More_Cowbell]

You don't run NoScript? Personally I'm using 3.0 beta2 (the few bugs are totally worth the better memory management, IMO), but I would never dream of running any version without NoScript.

I sure hope it's only this version...

[WiglyWorm]

Hopefully the Firefox 3 beta is not affected by this, that's what I've been running since Beta 2 came out. Anyone know?

Re:I sure hope it's only this version...

[tetromino]

It looks like Firefox 3 Beta 2 is vulnerable. The proof of concept from the article works on FF3b2 on my machine (Linux i686).

or just visit sites you trust

[hcmtnbiker]

That's right, back to the drawing board with this one. In the mean time you can either use another browser, or install the NoScript plugin to mitigate these issues. Or you can take the first step like you always should, and not visit sites you don't trust. Vulnerabilities always exist, betting that the developers will find them before someone else can exploit them is not a smart thing to do. Visiting only sites you trust will keep you away from people who want to compromise your computer 99.99999999% of the time, it really is the best thing you can do it terms of browser security.

Re:or just visit sites you trust

[Beryllium Sphere(tm)]

>Visiting only sites you trust will keep you away from people who want to compromise your computer 99.99999999% of the time

Assuming that the sites you trust haven't been compromised, this still leaves out the serious problem of attack code inserted into advertising.

Re:or just visit sites you trust

[11223]

Or you can take the first step like you always should, and not visit sites you don't trust.

Ever use an open 802.11 access point? Ever been redirected to a legalese page before being allowed onto the internet? Now what if that page had the exploit in it? For added fun, imagine the hotspot isn't malicious but there's an attacker on the network using a rogue DHCP server to feed you a bogus set of DNS servers.

People assume that their web browser is a trusted execution environment. Vulnerabilities which affect the browser are worth caring about for that reason.

Re:or just visit sites you trust

[saleenS281]

If the sites you trust have been compromised, no script isn't really going to help now is it? People tend to whitelist sites they trust...

Re:* Stops download of newest Firefox *

[croddy]

Oh, you make a good point. I always wondered what people were talking about when they went on and on about Firefox consuming tons of memory because I would look at mine and it would never look even remotely like what people were describing. Of course, it all makes sense now -- less crappy unnecessary javascript running, fewer memory leaks. I can't imagine web browsing without manually whitelisting scripts either.

nifty trick

[Deanalator]

It makes me happy that this type of vulnerability is what we call serious these days. If you remember, just a couple of years ago microsoft was downplaying the WMF vulnerability. It was not considered "critical" because the target needed to manually visit a malicious website for the attacker to take over the target machine.

While this is a really neat find, and I am glad that it will be patched pretty soon, I don't think it is quite at the level of "sky falling" etc. From what I understand, an attacker that can execute javascript in your browser has the ability to read any file in the targets mozilla directory. This worst that I think an attacker could do would be to grab your stored password file. While this is definitely something to be concerned about, the headline had me pretty worried :-)

Re:nifty trick

[Anonymous Coward]

Actually they can't even get your stored passwords. They can only get files in "C:\Program Files\Mozilla Firefox\" which consists of nothing related to stored data, except for the greprefs folder, which isn't even YOUR preferences. From the looks of it, it's what a default Firefox profile gets stuck with. So, this is a pretty lame exploit, definately not serious, you can't access outside of the Mozilla Firefox directory from the looks of things.

Re:* Stops download of newest Firefox *

[sundarvenkata]

But but.....don't many eyeballs watch the mozilla codebase?

Re:Fixed is hours!

[BasharTeg]

You gotta love Firefox apologists. They can turn a complete failure on behalf of Firefox development and release engineering into a discussion about how Microsoft is horrible and IE fails.

You're living in the past. Everyone knows IE6 was horrible. I'm running IE7 under protected mode. If you're going to talk shit, at least talk shit about current software. People who spend their time talking about how Windows 98 crashed a lot, IE5 and 6 were really insecure, and IIS 5 was the fastest way for a computer to get hacked on the net, are really starting to sound tired and sad. When we're running Windows 7, Internet Explorer 8.0 in Protected Mode, and IIS 7.0 on Windows Server 2008, fools like you are still going to be apologizing for every bug in by bringing up bugs from Microsoft products 5+ years ago.

And even if IE6 was the most horrible browser ever and they waited for "moths if not years" for patches, how does that make this Firefox vulnerability any better? If IE6 is so bad, why is it your example for trying to minimize this Firefox vulnerability?

Microsoft products are getting better. Deal with it. Quit living in the past.

saved passwords

[robo_mojo]

Does anyone still think that it's a good idea to permanently store your passwords in your browser?

Re:saved passwords

[Nazlfrag]

There's this thing called carbon-based memory I use from time to time. Efficient, portable, unfortunately it is easily broken by Johnny Walker and co.

Re:* Stops download of newest Firefox *

[bunratty]

Sure, and some of those eyeballs wait until just after the release of a new version to announce they know of a security vulnerability just to draw attention to themselves. Open source does help security bugs to be found, but it doesn't magically keep the finders from blabbing to all hackers worldwide exactly what the problem is and how to exploit it.

Re:Fixed is hours!

[Anonymous Coward]

>Microsoft products are getting better. Deal with it. Quit living in the past.

So are realplayer's products, but you don't see anyone telling anyone to install them.

Re:Who cares? Use Opera

[FudRucker]

Opera is closed source so you have no idea what vulnerabilities are in it...

What all.js contains

[nonpareility]

The file they're reading from in TFA (all.js) contains a portion of the default Firefox preferences, not your current settings. There may be other ways to exploit this problem, and web pages definitely shouldn't be allowed to read any file from your computer, but the proof of concept isn't as bad as they say it is. The majority of your personal information is in your profile directory (under Application Data on Windows), not the program directory.

Corporate sites

[Overzeetop]

There are quite a few corporate sites which incorporate flash to "enhance" their site, and there are some sites which won't even let you in unless you pass the flash-only home page. If you don't have flash, they don't want your business. (At least, that seem to be the opinion of the web IT staff, I haven't contacted corporate to see if they agree with that assessment). As for examples, Bath & Body Works used to be that way (I emailed them, they are no longer flash-limited...I don't believe those two things are linked, though). Rainforest Cafe is another. BBW didn't get my business back then, and Rainforest missed out on a dinner guest recently - I couldn't find their location, and couldn't use my mobile browser to get to their page. Will they care that they probably lost less than $100, of course not. But it certainly would have been nice if they wouldn't have had a "no flash, no service" sign out front.

huh?

[jelle]

Doesn't look like a vulerability to me. So it can read files in /usr/lib/firefox, but those are just the standard files from the firefox package. User configuration and stored passwords etc are not stored there... It still can't get to $HOME/.mozilla...

Re:huh?

[Shippy]

It's still a vulnerability. It's allowing something that shouldn't be allowed. Does that mean people will take advantage of it and exploit it a lot? Not necessarily, but it's still a vulnerability.

How is this a serious security problem?

[Anonymous Coward]

I'm confused, how is this a serious security problem? All it allows is reading files from the Firefox application directory, which isn't exactly sensitive data, since you can get the exact same files from just downloading Firefox from Mozilla's website. Your prefs, passwords, etc. are stored in your Firefox profile, which lives outside the Firefox application directory, so they *are not* accessible via this trick.

Scare mongering

[Anonymous Coward]

gre is constant data. This report is FUD.

Firefox is open source; anyone who wants to view view-source:resource:///greprefs/all.js can just as easily load http://mxr.mozilla.org/mozilla1.8/source/modules/libpref/src/init/all.js?raw=1 it has the same content.

all.js is *not* user data, it's *public* app data. Your preferences are stored in prefs.js which are not exposed by greprefs.

Update the title... NOW.

[Anonymous Coward]

Seriously, this title should be changed now (get rid of "Serious"), and a "!serious" tag added. The author of the article is an asshole who just waited for this release to fear monger and gain some attention. This bug exists in previous versions, this is not a new issue. The fact is, 2.0.0.12 fixes issues from previous issues, and does NOT introduce this "new" bug.

You should still upgrade. You are already vulnerable to this "attack" without it, but you can at least gain some new fixes for other issues.

You know, we're trying to promote open source software. To scream that firefox has a "serious vulnerability" when it in fact doesn't is IT treason.

How come?

[dreamchaser]

How come when there's a security hole in an MS product it gets the 'haha' tag, but if it's an OSS project it doesn't?

Re:How come?

[jamesh]

If we could tag posts, yours would be tagged 'youmustbenewhere'.

Re:Fixed is hours!

[DMoylan]

> Everyone knows IE6 was horrible. I'm running IE7 under protected mode. If you're going to talk shit, at least talk shit about current software.

well in their defence more people still use ie6. so they are talking about current software.

http://www.w3schools.com/browsers/browsers_stats.asp

at my job it is split about 90% ie6 v 10% ie7 for internet explorer users. thankfully the number of ie users is dropping as more switch to firefox. ie7 has speeded up that switch as many hate the interface.

but to be on topic firefox has a serious bug. i expect it will be patched in a day or so. firefox is good at that.

> Microsoft products are getting better.

only because they have serious competition from firefox, apache etc.

> Deal with it. Quit living in the past.

i don't live in the past i use linux and mac osx.

list of files that can be read (win32)

[Anonymous Coward]

lol, serious stuff 300: file:///C:/Program%20Files/Mozilla%20Firefox/ 200: filename content-length last-modified file-type 201: .autoreg 0 Mon,%2005%20Nov%202007%2016:16:28%20GMT FILE 201: AccessibleMarshal.dll 13952 Fri,%2008%20Feb%202008%2019:42:30%20GMT FILE 201: LICENSE 30869 Thu,%2026%20Jul%202007%2002:39:20%20GMT FILE 201: README.txt 177 Thu,%2026%20Jul%202007%2002:39:20%20GMT FILE 201: browserconfig.properties 232 Thu,%2026%20Jul%202007%2002:39:26%20GMT FILE 201: chrome 0 Fri,%2008%20Feb%202008%2019:42:39%20GMT DIRECTORY 201: components 0 Fri,%2008%20Feb%202008%2019:42:39%20GMT DIRECTORY 201: defaults 0 Fri,%2028%20Sep%202007%2022:59:30%20GMT DIRECTORY 201: dictionaries 0 Fri,%2028%20Sep%202007%2022:59:30%20GMT DIRECTORY 201: extensions 0 Fri,%2021%20Dec%202007%2011:21:24%20GMT DIRECTORY 201: firefox.exe 7655024 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: freebl3.chk 476 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: freebl3.dll 200829 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: greprefs 0 Fri,%2008%20Feb%202008%2019:42:40%20GMT DIRECTORY 201: install.log 28197 Fri,%2021%20Dec%202007%2011:20:32%20GMT FILE 201: js3250.dll 456808 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: nspr4.dll 161392 Fri,%2008%20Feb%202008%2019:42:35%20GMT FILE 201: nss3.dll 378472 Fri,%2008%20Feb%202008%2019:42:36%20GMT FILE 201: nssckbi.dll 271984 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: old-homepage-default.properties 112 Thu,%2026%20Jul%202007%2002:39:26%20GMT FILE 201: plc4.dll 34424 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: plds4.dll 30320 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: plugins 0 Fri,%2008%20Feb%202008%2019:42:42%20GMT DIRECTORY 201: res 0 Fri,%2028%20Sep%202007%2022:59:27%20GMT DIRECTORY 201: searchplugins 0 Fri,%2028%20Sep%202007%2022:59:30%20GMT DIRECTORY 201: smime3.dll 112232 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: softokn3.chk 476 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: softokn3.dll 254060 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: ssl3.dll 132712 Fri,%2008%20Feb%202008%2019:42:37%20GMT FILE 201: uninstall 0 Fri,%2008%20Feb%202008%2019:42:48%20GMT DIRECTORY 201: updater.exe 132232 Fri,%2008%20Feb%202008%2019:42:38%20GMT FILE 201: updater.ini 709 Fri,%2019%20Oct%202007%2013:36:24%20GMT FILE 201: xpcom.dll 13416 Fri,%2008%20Feb%202008%2019:42:39%20GMT FILE 201: xpcom_compat.dll 73848 Fri,%2008%20Feb%202008%2019:42:38%20GMT FILE 201: xpcom_core.dll 422000 Fri,%2008%20Feb%202008%2019:42:39%20GMT FILE 201: xpicleanup.exe 73336 Fri,%2008%20Feb%202008%2019:42:39%20GMT FILE 201: xpistub.dll 12400 Fri,%2008%20Feb%202008%2019:42:39%20GMT FILE

or not

Re:Fixed is hours!

[zsau]

As someone who uses Linux because I was able to customise it to be exactly compatible with the way I think, and so I'm unable to run Internet Explorer or IIS, I have to say you make an excellent point.

To everyone else: Do you remember before the browser wars, when Netscape was the big, bloated dominant player and Internet Explorer was the fast and light competitor which needed to prove itself (even if it did so by cheating)? Do you remember the time between the wars, when Internet Explorer was buggy and insecure? Now we are in the second browser wars and Internet Explorer is trying to compete. And it's a good thing. The Mozilla foundation cannot afford to sit on their laurels or Firefox will be the also-ran that the Mozilla suite is. Never hold yourself to someone else's standards: Be the very best you can be, and it'll always be better.

And be grateful for it — we on Linux pretty much have no choice but Firefox (or Firefox-based browsers) if we want a vaguely native, somewhat integrated system (well, there's Konqueror if you use KDE but it's not up to the same level as Firefox and Internet Explorer). There's no competition, no choice, and no reason for Mozilla to focus their development effort over on this side of the fence. And we suffer for it, with form widgets that don't look right and menus that don't work properly.

Re:* Stops download of newest Firefox *

[omeomi]

Making it trim on minimize (something it should do by default) helped somewhat

What you're describing has nothing to do with Firefox. Even if Firefox frees it's memory, that freed memory doesn't get reflected in the Task Manager until the program is minimized or you wait long enough...

More info: http://www.garagegames.com/blogs/4517/11311

"The Windows OS employs something like a memory cache for each actively running program. This cache may grow as the needs of a particular program require using magical algorithms Microsoft developers have produced for determining the optimal size for that program. For instance a program over the course of it's life time may require 20 megs of memory but occasionally needs to load data requiring allocations of up to 10 additional megs which is released seconds after it is loaded and processed. The Windows OS may determine then, that the memory cache for this program must increase from the base 20 megs to 25 megs instead. Looking at the Windows Task Manager then, you may see that this program is now using 25 megs of memory, even though currently, it may only be using 20 megs.

That is, the Windows Task Manager is reporting the memory cache allotment and not the memory allocated and used by the program. This is not the same as a memory leak. The program has little to no control over the memory cache allotment the OS has given it."

Re:* Stops download of newest Firefox *

[Rakishi]

Parent is an idiot or a troll, not informative.

To quote the link itself, where it is written in large bold print right above what was quoted (emphasis mine):
FIXED in Firefox 2.0.0.12

Firefox is too large to be secure

[Morgaine]

This isn't a problem just with Firefox, but with all full browsers today (the various midget text-mode ones excluded).

Any non-trivial program contains bugs and vulnerabilities proportional to its size, and the relationship between size and inherent problem-count is probably a lot worse than linear. This is true for all programs and all systems, but it is especially true for monolithic ones, and to a very large extent the main body of modern browsers is quite monolithic. Even the plugins load into the same address space in most cases, although there are exceptions to this in the browser world.

The present situation is not good, and everyone is familiar with the consequences of it: the web browser is by far the most crash-prone of all applications present in our operating systems today.

Is there a solution to this on the horizon? Not at present, because developers in all the most popular programming languages almost always implement monolithic systems (because the languages encourage it and the courses teach it), and are highly adverse to extreme modularization. Again, there are exceptions, but they are rare.

We are living in a bit of a Dark Age in this area currently, and I don't forsee any change within the next five years at least.

Re:* Stops download of newest Firefox *

[Achromatic1978]

So, it's their fault, right? Funny, just reading their page alone mentioned how they'd already made mention of how this affects more than just extensions, but Mozilla ("What leaks? Show us a single leak!") developers shrugged, blamed extensions, and released, without fixing the core problem.

This bug is less important than it seems

[enodo]

If you take a look at what this is doing, there's much less to it than meets the eye.

The way the page works is that it is able to load the file all.js in the greprefs directory inside your firefox installation. However, it is not *reading* this file and making it available to the javascript interpreter, it is *executing* the file. The file is a big list of browser preferences, each set with a call to a function with the signature pref(name, value). There is no code in there other than calls to pref. What the page does is define its own pref(name, value) which gets called, and the names and values are therefore available to the javascript interpreter.

So:

1. It has to know exactly what is in the file, and it has to be able to overwrite a function or functions so that some sort of privileged data becomes available to it. It has to be able to do this without the page throwing errors or halting execution. (That was easy with all.js, because the only thing in there was calls to pref. In other files I doubt it would be so easy.)
2. As demonstrated, it can only read data that's inside the directory of the default install, not your home directory or anywhere else. As others have pointed out, it's not clear that there's ever anything really privileged in there for it to get. (The settings gotten in the exploit demonstrated are not very interesting.)

I would additionally point out that the view-source: part of the URI appears to be unnecessary, since at least for me (Ubuntu FF 2.0.0.12) the "exploit" worked just fine without it.

Re:* Stops download of newest Firefox *

[Compholio]

who really cares, I am gonna use firefox, not to many hackers are that good at getting into Linux Machines, and if I wasn't gonna use FireFox then I would use Opera. Cheers!

Yeah, plus (according to TFA) all they can do is traverse the install folder. Said hacker can have fun looking at all the plugins and blank password database in my ~/.mozilla/firefox/ folder all they want.

DIRECTORY TRAVERSAL?

[dominious]

Indeed,
From TFA: "We can trick Firefox itself in traversing directories back".
but then it says:
"we are able to read out all preferences set in Firefox, or just open or include about every file stored in the Mozilla program files directory"

Since TFA is not clear, I have tried it myself and I WAS NOT ABLE TO TRAVERSE a directory back with resource:///../
So the only files someone can read with this vuln are the files inside firefox directory which from what I can see are just default files and no cookies or passwords.

If anyone thinks any different please let me know.

Re:Memory Usage / No Script

[Symbolis]

On my box it's currently taking around 450MB. I usually kill it when it gets to around 700MB. Maybe it's because I use GMail and Yahoo! Mail open all the time?

Madness.

Mine's sitting at 68MB as I type this.

No tweaking of any sort. Just now hit 70MB

Run NoScript, too.

Re:Memory Usage / No Script

[Mr Z]

Well, I do have over 30 tabs open across 5 windows, and I leave it open 24/7.

Re:Memory Usage / No Script

[Mr Z]

How many windows / tabs do you tend to have open, and how often do you restart the browser? Also, what OS?

Here's the output of ps on my 64-bit Ubuntu 7.04 box, running Ubuntu's Firefox package:

im14u2c 2527 6.1 11.2 987640 454116 ? Sl Feb07 176:30 /usr/lib/firefox/firefox-bin

The first number suggests Firefox is taking nearly 1GB, but 512MB of that is just the X mapping my video card, I think. The second number shows it clearly taking around 450M.

--Joe

Re:It must be Microsoft's fault

[nmb3000]

Well it appears they are attacking an MS box, by the Program Files part of the filename string. I doubt this would do much on a *nix box with proper access permissions set up.

Well then, let's see!

C:\>cacls "Program Files"
C:\Program Files
      BUILTIN\Users:R
      BUILTIN\Administrators:F

root@box:/# ls -l
drwxr-xr-x 2 root root 4096 Mar 19 2007 bin
drwxr-xr-x 69 root root 8192 Dec 4 11:40 etc
drwxr-xr-x 11 root root 80 Mar 19 2007 usr

Hmm, look pretty similar to me. Maybe that because it makes no sense if normal users cannot read and execute applications and their associated data? Program Files on Windows being readable by everyone has nothing to do with what is a Firefox vulnerability.

On the other hand I guess you're right. No "Program Files" directory on the Linux machine, it must be safe!

As a MS executive who has nothing better to do...

[Anonymous Coward]

... I'd like to say that that is a fantastic idea, and I'll ensure that we acquire Mozilla ASAP.

Enjoy being beaten up by your fellow /.ers.

Whew!

[loopiv]

Thank god I use Internet Explorer.

Amazing coincidence

[GlobalEcho]

The browser can present to me a list of script functions and fragments, each with a "allow", "deny", or "remap" option. What an amazing coincidence! My grandmother, my boss and my brother's girlfriend were all wishing out loud for that very feature just yesterday! We'll all be secure in no time!

Re:* Stops download of newest Firefox *

[gaspyy]

Let me get this straight: do you honestly think that something being Open Source will magically protect you? I was going to mod you but there's no "-1 Naive".

There are enough malware targeted specifically at Firefox - I've seen them in action. The good thing with Firefox is that it gets patched pretty quickly, by the time an exploit has been written, hopefully we'll all have 2.0.13 installed.

Still, that's no excuse. It saddens me to say that the quality of Firefox (2.x.x branch) is steadily declining. It's slow, eating too many resources, and it crashes - on some sites it just constantly crashes. If it weren't for all the extensions, I'd dump it in a heartbeat and move to Opera.

Re:* Stops download of newest Firefox *

[sticks_us]

That does it, I'm switching to w3m

(returns ten minutes later)

Ahh...how relaxing...

Not exactly....

[DrYak]

Aren't Firefox plugins just Javascript?

Depends.

Firefox extensions (Like the oh-so-important NoScript and AdBlock Plus, or the must-have for every /.er Resurect pages) are all written in Javascript. That's what makes them portable (installable in Windows IA32 or AMD64, or Linux {whatever CPU you compiled it for}).

On the other hand, web-browser plugins (like Adobe Macromedia Flash, Sun Java, etc.) are binary code in dynamically linked libraries (DLL or SO depending on what's standart on your OS). That's why there are really serious portability problems with closed source companies providing plugins compiled only for a handful of operating system (often without 64bits support).
There are two strategies :
- most of the time open-source projects use very light libraries which obtain the parameters from firefox and launch a player in a separate process that get its output embedded inside the page display (mplayer's plugin just luanch a sepparate mplayer session, gnash' plugin runs gtk-gnash to open the flash movie, webgcjplugin compiles and runs the java applet using gcj, moz-plugger is an universal embedder, etc...)
- whereas most of the proprietary project try to cram everything inside a huge DLL that runs inside firefox' own process (macromedia flash, acrobat reader {BTW who does still use that piece of junk}, etc.)

As I understand it, that's one of the major reasons that Firefox can get bogged down.

The Javascript extensions play some role because the javascript engine of current Firefox isn't very fast (Hopefully the integration of Tamarin VM in some future version will help). If a user has way too many of them, the firefox experience can become slow. But most of the time quite, the extensions are event-driven : they usually add entries in the main menu and the javascripts are only executed when the user clicks the entry.

The other problems comes with memory leaks.
- Javascript extensions, because they are only ran on demand and because of the garbage collector, aren't subject to many leaks. But anyway really badly written code can actually degrade firefox performance and eat up memory.
- Dynamically linked web browser plugins are a completely different animal : because they run inside the browser process (at least, not the open-source one which only launch an external process) if they leak memory, the whole firefox process will get its memory usage up and will only free the memory when the whole program is exited. Also, firefox isn't heavily multi-threaded and if some plugins freezes the whole program gets unresponsive (I've had some awful experience with acrobat and older versions of flash). Similarly crashes inside a dynamically linked library will bring down the whole process that called the function, and any exploit discovered inside flash can be used against firefox itself.

I strongly suspect that most of the memory leaks reported by users are actually due to browser-plugins, because I haven't experienced any leaks even if a use several extensions, whereas I don't run closed proprietary browser plugins at all (mplayer and gnash only !) because of the awful experience with acrobat and flash.

Re:* Stops download of newest Firefox *

[scooter.higher]

Yes, but I feel that "-1: Disagree" is wrong.

To facilitate the discussions we should be having here on /. it should be "+1: Disagree" so that we can respectfully disagree with each other and elevate the discussion so that more people can weigh in on the topic.

But I agree that a post in response would better serve the discussion.

Re:* Stops download of newest Firefox *

[Foolhardy]

Modern CPUs implement virtual memory, which means that any given page of memory (the smallest unit of allocation, per the CPU hardware) may not be directly accessible. The OS can decide to move a page to disk to make room for other things, or implement a memory-mapped file. When that page is accessed, it causes a page fault, which the OS silently fixes by moving the page back into memory. The memory currently accessible without causing a page fault and OS intervention is the working set. The amount of memory allocated (i.e. the amount of storage reserved by the OS), and the working set can be different.

Linux implements a global working set. This means that when the OS decides that it wants to remove a page from its working set (i.e. swap it to disk), it pulls that page out of all the processes that are using it (since the page might be shared), writes it to disk and marks the page as free.

Windows NT implements a per-process working set. A page is moved out of the working set of a particular process, and when it's been removed from all processes (in case it was shared), it goes into the standby cache, a sort of limbo where the page exists both in memory and disk and can't be written to (this makes it possible for the page to be moved completely to disk or back into use without further disk access). Each process has a soft minimum and maximum working set that the memory manager tries to keep a process within. Memory heavy processes have their max working set automatically expanded.

"That is, the Windows Task Manager is reporting the memory cache allotment and not the memory allocated and used by the program. This is not the same as a memory leak. The program has little to no control over the memory cache allotment the OS has given it."

Task Manager reports a process's current working set under the heading of mem usage. More pages allocated to the process may in fact be in memory in the standby list, but they won't show up in this count. Memory cached by the OS (e.g. standby cache, file cache, write cache) is not counted in the working set of any process, even if only one process is really using it. They show up as "System cache" in the performance tab, and some caches are double counted as "Available" because they can be discarded without disk access. When a process calls NtFreeVirtualMemory (the syscall for freeing private memory pages), the OS does not keep it in the process's working set. The working set is always equal or smaller than the sum of shared and private memory allocated to the process. If a process were to free all its private memory, and somehow unload all its modules and free its stack, the working set would go down to zero. A program has full control over what memory is allocated to it. It can't fully control how much of that memory is actually resident in RAM, though, and that's what is reported by Task Manager.

When you minimize a window, the Win32 subsystem sets the process's maximum working set to the system minimum, effectively moving most of its private pages into standby. Those pages will only come back into the working set as they're accessed-- it may take a long time for the working set to get has high as it was previously, and possibly never for memory leaks or unused caches. Firefox definitely implements some hefty caches.

In short: yes Windows implements a memory cache, but not for pages that have been freed.

Godwin's Law for Slashdot

[thethibs]

Slashdot needs an implementation of Godwin's Law that shuts down a thread the first time Microsoft is mentioned and the topic is something that involves neither Microsoft nor any of its products.

Thankfully, that would have put this thread out of our misery almost immediately, with no one any less informed as a result.

Re:text mode browsers that Just Work

[doom]

So, you demolish the good design of the good sites, so you can avoid the bad design on the bad sites? Why don't you just skip the poorly designed sites entirely and stick to the good ones?

I'm not sure what you're trying to say here -- I suspect you're yet another "designer" who resents the fact that you're fabuloso designs are irritating the hell out of a large chunk of the populus -- but you're logic is totally whacked. Why blame the author of some text for the decisions made by other people in the organization?

Consider the way the world looks when I use Firefox. I go to read a column by Robert Fisk in the Independant, and a bar appears at the edge of the screen telling me that the execution of some script has been blocked. I habitually use custom colors with light text on black -- my opinion is this minimizes eye-strain, by the way: computer screens are not paper and should not try to mimic paper -- and the various little graphics they've squeezed in on the page are glaringly bright in comparison, because they presume I'm using a white background. Then I come to the dread Flashing GIG advertisement, and it's once again time to right click and use Adblock to make it go away.

Do you see what I'm getting at? Lynx (or w3m) is not without it's annoyances, but using Firefox is not without it's annoyances either: I need to constantly fuss with it to fight the faddish nonsense that the web is always infested with.

What's so crazy about using a text-mode browser if what you want to do is read some text?

Re:* Stops download of newest Firefox *

[julesh]

It's slow, It's as fast as any browser I've used. You probably haven't tried using it on any machine older than about 2 years old. Firefox is quite unresponsive, particularly on javascript-intensive sites, compared to many other browsers, including Internet Explorer. Very long pages with lots of links cause it real trouble. Try this page. On my system (2.66GHz Celeron D, 1GB RAM) there's a ~10 seconds pause after the page loads before I can scroll or switch tabs, and ~3 seconds between clicking on one of the links and the new page starting to load. IE6 handles it pefectly.

I also don't think this is related to extensions. I'm not using anything unusual (popup alt attribute, tabbrowser prefs, flashblock, web developer).

and it crashes I use Firefox quite extensively every single day for both business and personal uses and cannot recall it ever crashing. Not once, not ever. I've been using it since Firebird 0.6 and used many supposedly "unstable" nightly builds in earlier days. I trust it enough to use it during business presentations with clients rather than IE on which our applications have been most extensively tested. I've rarely had crashes until 2.0.0.11, but I've had about 3 over the last 3 weeks. I think there's something wrong with this build.