Slashdot Mirror
Firefox 3.0.1 Fixes 'Carpet Bombing' Issue
An anonymous reader writes "Firefox 3.0.1 was released today. It fixes 3 security vulnerabilities, including a critical issue reported by Billy Rios, Ben Turner, and Dan Veditz. The issue could be combined with an issue in Apple's Safari browser to read data from the user's disk or to execute arbitrary code. This issue was previously discussed on Slashdot.
The release also fixes a remote code execution bug involving the CSS reference counter, reported by the Zero-Day Initiative (previously discussed on Slashdot here), as well as a Mac-only potential code execution bug involving GIF image rendering, reported by Drew Yao of Apple Product Security."
Actually, it's a .0.1 release. Firefox 3.1 (alpha due this summer) has a lot of new features that didn't make it in time for 3.0.
Interested in open source engine management for your Subaru?
You're right, we need WAY more Internet Explorer updates here: This just in: Animated 'e' is blue.
It's all fun & games until someone loses the game.
Firefox 3 was crashing 3-10 times a day for me even after completely removing everything FF related. At the risk of jinxing myself I will say that I'm crash free on 3.0.1 for 4 hours now.
return EXIT_SUCCESS;
This update disabled my Firebug and "Copy all Urls" extensions.
I'll never take an update on the first day again. Ever. *spit*
... I didn't download Firefox 3 when it came out. In fact, I'm still on Firefox 2, and I'm sure a good percentage of fellow /.ers are as well.
Remember: if there aren't any patches for it, chances are that the reason is not that it's bug-free, but that it's still buggy.
Tomato wedge sperm darts that are Republican.
So have they given us the option to disable their "awesome bar" yet?
I had to giggle at the workaround. To prevent a firefox flaw from biting you, you need to have firefox open. Phew, I'm so glad I'm safe.
Don't anthropomorphize computers. They *hate* that.
So far as I know, the only application that normally runs with its current directory on the desktop (and is thus a potential target for any successful exploit of this issue) is Internet Explorer.
This attack only works if the user is using another internet-connected application with Firefox not running. Using Firefox, or making sure it is at least running, prevents this attack.
So as long as you use Firefox all day long, you will not be affected.
As I was reading this post, the update was auto-downloading.
Slashdot needs a "important software updates" section.
(released the day before yesterday)
http://www.mozilla.org/security/known-vulnerabilities/firefox20.html
Fixed in Firefox 2.0.0.16
MFSA 2008-35 Command-line URLs launch multiple tabs when Firefox not running
MFSA 2008-34 Remote code execution by overflowing CSS reference counter
(released yesterday)
http://www.mozilla.org/security/known-vulnerabilities/firefox30.html
Fixed in Firefox 3.0.1
MFSA 2008-36 Crash with malformed GIF file on Mac OS X
MFSA 2008-35 Command-line URLs launch multiple tabs when Firefox not running
MFSA 2008-34 Remote code execution by overflowing CSS reference counter
Whew! Good thing you didn't upgrade! You might have been vulnerable for a whole extra day! (Wait, you did take the 2.0.0.16 update already, right?)
For anyone on a slow connection or with an old machine (like me) that was almost a showstopper. Thankfully, *seems* to be fixed now.Haven't seen any real crashes to the desktop even with the betas...
A workaround is to go Tools->Options-> Security and turn off the attack site and forgery options.
Andy
Now if only they could get around to fixing the much bigger memory issues that seem to get worse and worse with every release. I'm getting tempted to go back to IE for the first time in years.
http://dictionary.reference.com/search?q=irony
Patrick Doyle
I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
I could swear that I was notified of a security update regarding Firefox a few days ago. After the update, I checked Firefox and it's own About dialog reported it was 3.0.1. Can anyone else confirm this or am I going bonkers? I'm certainly on 3.0.1 now and I only received some mundane updates this morning.
Stop being such a dick twitter.
Okay, just downloaded the version 3.0.1. What do I see now? My Google toolbar is gone, adblock not working, all other add-ons seem to be dead. Any idea when will the add-ons be updated?
I for one, welcome our browser caring overlords.
My issue is that "No one cares when Opera or Safari have a similar release. [or Internet Explorer, or Konqueror...]" but they do when its Firefox.
Opera 9.51 went through a few RC's and a final and is on 9.52RC/Snapshot, Safari has gone through a couple *.*# and a whole #.0 in the last few months for Mac, Win and Mobile...
But no, Firefox 3.1 Sub-Alpha-Hypothetical-Possibility-Beta-RC Build 3219 hits front page and we're supposed to eat a cracker drink some wine and pray to it, but oh wait, we're all for competition and innovation, as long as its Firefox Vs. Firefox.
(stomps off)
And Safari and Opera are both non-free so they are more reluctant to give detailed fix reports.
http://my.opera.com/desktopteam/blog/
When ideas fail, words become very handy.
Slashdot needs a "important software updates" section.
I thought it was called "Freshmeat".
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox. I don't recall paying to download either Opera or Safari for my desktop and laptop. Yes, I do know opera charges now for the Wii browser, but I don't have a Wii.
Free as in? 'Cause, well, I'm pretty sure you should know that both Safari and Opera don't actually cost the end user anything to install. I think it is pretty safe to say that the pay-for-a-browser market on the PC platform is pretty much over.
"So long and thanks for all the fish."
Non-free, as in closed-source, as in proprietary. Sure Safari is mostly open-source, but Opera is as much proprietary as IE.
Taxation is legalized theft, no more, no less.
Your post is sorta worded as flamebait to some, but it does have truth. It doesn't take a statistician or a complex algo to add up how many postings have been about FireFox in the past 6 months compared to all other browsers combined. I applaude the openness that Mozilla chose for it's flagship browser. However, their product seems to have drawn some rather fervent users as well. Don't mind them, they're to Firefox as Fundies are to religion. That is, ignore/condemn anything that doesnt parallel their own viewpoint.
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox.
Safari is Open Source. Head over to WebKit.org and you can get the source via Subversion or browse it via Trac. It's licensed under a mix of LGPL and BSD licenses.
WebKit is open source, but is Safari? One is the engine, the other is the browser using that engine. Is Safari itself open source too?
Safari has gone through a couple *.*# and a whole #.0 in the last few months for Mac, Win and Mobile...
And Internet Explorer is still going through lots of *&^%$#@!
That's what I figured/hoped you'd meant. I actually like Opera a great deal though the current version is too cartoonish looking for my taste. I should, probably, theme it. I dare say I like it more than I like Firefox. Ah well, thanks for making it more clear. (I am not one of the people who really cares if the source is open or closed, I just want it to work in the ways that I expect it to.)
"So long and thanks for all the fish."
I expect Slashdot to either have news of events before they go live or after a 7-day delay, depending on the phase of the moon and CowboyNeal's health.
I never expect it to be "right on time."
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Back in my day we had to squeeze all our tabs in 640KB!
And there were only 5 computers on the whole planet!
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
The update for FF2 was pushed out a day before the FF3 update (on Tuesday morning, versus Wednesday afternoon). If you aren't using 2.0.0.16, you're prone to the same attack.
Usually when people say "ironic" I assume they're using it incorrectly, and I think this is the first time I've been wrong. :-)
Patrick Doyle
I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
Who would want to bomb a carpet company?
Except for on Windows 98... I didn't even know Mozilla had a carpet bombing issue. My only issue with Mozilla is the fact that it just randomly crashes out of nowhere. For no reason that I can think of. Not often, but it happens. I'm on Vista, I expect everything to crash! :((
Even The Sims 2 crashes unexpectedly, along with every other game I own. Stupid Dell. Stupid Ranting. Stupid Vista! STUPID ME! :(
Sorry, getting off topic ^_^
if it's just the appearance changes (i.e., SSL sites not shown in yellow, big layout) you can use "old location bar", but you might also look at changing your theme: "classic compact" looks pretty much as Firefox 2 did, and it saves a lot of vertical space too. (Nice on laptops.) I use it, and install it on all my customer's machines. Instructions below, to prevent pop-up of matches, are excellent.
The appearance doesn't really bother me. It's the matching algorithm. Typing in "ca" should match carrionfields.com, but it shouldn't match chewbac.ca in my opinion.
By what name do you wish to be mourned?
Whenever Firefox is mentioned on slashdot, make sure to bring up the memory leak issue .. :)
davecb5620@gmail.com
http://slashdot.org/moderation.shtml go learn something. damn fool kids...
Safari is closed source. WebKit (the layout engine Safari uses) is open source, but the builds used by Safari rely on a binary closed source blob from Apple. If you value software freedom, you shouldn't use Safari.
no, Safari isn't open source, WebKit is open source, because it is based on khtml.
New things are always on the horizon
Install cygwin to get full chmod support, even on XP Home...
Now fix the Awesome Bar so that I can revert back to the way address bars should work!
"He who can destroy a thing, controls a thing." --Paul Atreides, Dune
eventually that should change.
I used to type just "ma" to get mail.myemployersdomain.com, but it was bringing up slashdot ("Slashdot: News for nerds, stuff that matters"). eventually, after typing "mail" for long enough, now mail.myemployersdomain.com is the first thing that comes up when I just type "ma".
It seems you haven't run Windows Update for a long time then...
It's sad, but in the last couple of months a lot of trolls and flamers are screwing with /. topics. If you don't have nothing good to say or want to be the first to post, please keep it for yourself and don't mess with the thing.
[]Âs
Am I eval()? - http://www.monst3r.com.br
http://developer.yahoo.net/blog/archives/2007/07/yahoo-hadoop.html
Besides, Google's search engine doesn't run on MapReduce - they use MapReduce to build the indexes. The key with Google is the GFS...
Yes, I've used Opera a few times and think it is ok, but really I don't like the closed source aspect of it. Sure it is secure, but if it was the dominant browser, I think it would have as many exploitable holes as IE does now, Firefox and Safari both have open source going for them.
Taxation is legalized theft, no more, no less.
Truecrypt + portable Firefox = pr0n hidden
-
Is not subject to the "my blank is cooler and better than your blank" ethos.
Slashdot, of course, must be contrarian on this point. "My blank is the best of all possible blanks, and you can blank off if you don't blanking think so."
Tell me, do you want to spend the rest of your life window shopping for the awsumest browser or do you just want to pick one that doesn't splash buttcrack juice all over your hard drive and use the bloody thing?
You know, that question I just asked seems rhetorical, but /. rules of etiquette demand a response.
Apple Kool Aid much?
Well it's too late for the Afghanis and the Iraqis, but I'm sure the Iranians are relieved that there is a patch to stop them getting carpet bombed.
What if Tetris was invented by Nazis?
3.0.1 resolves the problem of "[Firefox3] suffers from garbage collection hick up" in Defender of the favicon
Now I can get back to gaming in the corner of my address bar.
Let me save you some time and map out your journey to acceptance of the awesome bar.
First you hate it, because it's new and different to what you expect. You are trained to use it as an address bar and nothing else, so it acting like a search bar is confusing and suboptimal to you.
At this point many people decide to trial the new bar, but you are the kind of person who tends to think he (forgive me, but he) knows what's good and what's not, and even quite enjoy the idea of customizing your Firefox. So you look for a way to preserve your old behavior. There are enough people like you to make worthwhile a mass solution: a config option and an extension.
You and your anti-awesome fellows make use of these. You occasionally grumble that the awesome bar shouldn't be default at all, but you are basically satisfied so the rest of the world hears from you less and less.
As time passes, you occasionally find yourself using other people's computers that have Firefox in a default state. This annoys you at first and if you are spending any serious time on them, you disable the awesome bar. But sometimes you're only using them briefly, so it's not worth modifying. Then, all of a sudden, you find the awesome bar useful. It's a surprise, like a door opening: you suddenly see that if you alter your behavior a little, the awesome bar could be quite useful.
From this point you never disable the awesome bar again, although you leave it disabled on your main desktop, as a matter of principle.
A new version of Firefox is released. The "Disable Firefox Awesome Bar" extension hasn't yet been updated to work on it. But by now you don't really mind. You now prefer the awesome bar. When you have to use Internet Explorer, or Firefox 2, the lack of an awesome bar bugs you. It seems so inflexible, so archaic.
A while later, the author of the awesome-disabling extension stops updating it. People forget that anybody ever didn't like the awesome bar. But this new Firefox feature, the predictive URL form mapping--oh man, that's just so horrible, why is it on by default?
I should buy some cement.
If slashdot does a story on a security hole in Firefox, certainly a story of it being fixed is also appropriate.