Slashdot Mirror

← Back to Stories (view on slashdot.org)

Firefox 3.0.1 Fixes 'Carpet Bombing' Issue

Posted by CmdrTaco on from the break-out-the-bug-spray dept.

An anonymous reader writes "Firefox 3.0.1 was released today. It fixes 3 security vulnerabilities, including a critical issue reported by Billy Rios, Ben Turner, and Dan Veditz. The issue could be combined with an issue in Apple's Safari browser to read data from the user's disk or to execute arbitrary code. This issue was previously discussed on Slashdot. The release also fixes a remote code execution bug involving the CSS reference counter, reported by the Zero-Day Initiative (previously discussed on Slashdot here), as well as a Mac-only potential code execution bug involving GIF image rendering, reported by Drew Yao of Apple Product Security."

13 of 168 comments (clear)

  1. Re:Who Cares... by bconway · · Score: 5, Informative

    Actually, it's a .0.1 release. Firefox 3.1 (alpha due this summer) has a lot of new features that didn't make it in time for 3.0.

    --
    Interested in open source engine management for your Subaru?
  2. Workaround by brunes69 · · Score: 3, Informative

    This attack only works if the user is using another internet-connected application with Firefox not running. Using Firefox, or making sure it is at least running, prevents this attack.

    So as long as you use Firefox all day long, you will not be affected.

  3. Re:"awesome bar" by -Tango21- · · Score: 5, Informative

    Hmm, a Google search reveals that while the "awesome bar" is still the default, you can disable it by following the directions below (but, maybe you already knew this):

    1. Type about:config into the location bar and change the value browser.urlbar.matchOnlyTyped to true. After this, you need to restart Firefox. All this does is make it so that Firefox only searches the URLs you have typed and not the titles of pages.

    2. Install the Old Location Bar extension. This changes the location bar so that it looks like how it looked in Firefox 2. As of me writing this post, it is an experimental addon so you will need to register to the Firefox addon service to install it.

  4. Re:When will Microsoft fix IE? by argent · · Score: 3, Informative

    When you run an application from Windows Explorer, it is normally run with its current directory set to the directory that the executable is located in. The vulnerability exposed by the "carpet bombing" attack involved attacking Internet Explorer, because Internet Explorer runs with its current directory set to the desktop... not the directory containing the IE executable. There is no obvious reason why IE does this, nor any reason I can come up with for Microsoft not to change it.

  5. crash crashing or? by Fallen+Andy · · Score: 4, Informative
    OK, if you saw the following I may have an answer for you. If you installed FF3 and around a day or two later mysteriously it seemed to put up the hourglass cursor with the disk thrashing a lot, then you got bitten by the urlclassifier db (anti-phishing sqlite database) being downloaded. After a day or so things go back to normal. (It would look more like a temporary freeze of the program rather than a crash to the desktop).

    For anyone on a slow connection or with an old machine (like me) that was almost a showstopper. Thankfully, *seems* to be fixed now.Haven't seen any real crashes to the desktop even with the betas...

    A workaround is to go Tools->Options-> Security and turn off the attack site and forgery options.

    Andy

  6. Re:And this is why... by Spy+der+Mann · · Score: 5, Informative

    ... I didn't download Firefox 3 when it came out. In fact, I'm still on Firefox 2, and I'm sure a good percentage of fellow /.ers are as well.

    Um... the carpet bombing vulnerability also affects Firefox 2. It looks like someone is in trouble :)

  7. You may find this useful by p3d0 · · Score: 3, Informative

    http://dictionary.reference.com/search?q=irony

    --
    Patrick Doyle
    I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
  8. Re:Addons? by slimjim8094 · · Score: 3, Informative

    when the authors update them?

    of course, you could google for a couple of seconds and fix it yourself (hint: you can force it to ignore the version)

    --
    I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
  9. Re:Who Cares... by badpazzword · · Score: 3, Informative

    And Safari and Opera are both non-free so they are more reluctant to give detailed fix reports.

    http://my.opera.com/desktopteam/blog/

    --
    When ideas fail, words become very handy.
  10. Re:I didn't even know there was a problem. by thePowerOfGrayskull · · Score: 3, Informative

    Nice to repeat the same ol' FUD, but you do realize that FF3 memory usage is significantly lower than FF2 and IE, don't you? You /did/ know that, right?

  11. Re:"awesome bar" by andy9701 · · Score: 3, Informative

    Lifehacker has instructions on how to restore the yellow for SSL sites, among other nice UI changes (such as removing the Go and Search buttons from the Address and Search bars, respectively). It does require an extension (either Stylish or Greasemonkey), but it definitely works, I've been using this at home for a few weeks now.

  12. Re:Who Cares... by HeroreV · · Score: 4, Informative

    Safari is closed source. WebKit (the layout engine Safari uses) is open source, but the builds used by Safari rely on a binary closed source blob from Apple. If you value software freedom, you shouldn't use Safari.

  13. Re:Who Cares... by Lennie · · Score: 4, Informative

    no, Safari isn't open source, WebKit is open source, because it is based on khtml.

    --
    New things are always on the horizon