Slashdot Mirror
Firefox 3.0.1 Fixes 'Carpet Bombing' Issue
An anonymous reader writes "Firefox 3.0.1 was released today. It fixes 3 security vulnerabilities, including a critical issue reported by Billy Rios, Ben Turner, and Dan Veditz. The issue could be combined with an issue in Apple's Safari browser to read data from the user's disk or to execute arbitrary code. This issue was previously discussed on Slashdot.
The release also fixes a remote code execution bug involving the CSS reference counter, reported by the Zero-Day Initiative (previously discussed on Slashdot here), as well as a Mac-only potential code execution bug involving GIF image rendering, reported by Drew Yao of Apple Product Security."
Actually, it's a .0.1 release. Firefox 3.1 (alpha due this summer) has a lot of new features that didn't make it in time for 3.0.
Interested in open source engine management for your Subaru?
Firefox 3 was crashing 3-10 times a day for me even after completely removing everything FF related. At the risk of jinxing myself I will say that I'm crash free on 3.0.1 for 4 hours now.
return EXIT_SUCCESS;
So have they given us the option to disable their "awesome bar" yet?
I had to giggle at the workaround. To prevent a firefox flaw from biting you, you need to have firefox open. Phew, I'm so glad I'm safe.
Don't anthropomorphize computers. They *hate* that.
So far as I know, the only application that normally runs with its current directory on the desktop (and is thus a potential target for any successful exploit of this issue) is Internet Explorer.
This attack only works if the user is using another internet-connected application with Firefox not running. Using Firefox, or making sure it is at least running, prevents this attack.
So as long as you use Firefox all day long, you will not be affected.
I finally upgraded last night. So far, so good - it's certainly faster, and the most important mods to me (CSL and NoScript) seem to be working just fine.
Of course, if it isn't all good then I'm screwed now, but c'est la vie.
cogito ergo dubito
Slashdot needs a "important software updates" section.
Chances are that the reason is not that it's bug-free, but that it's still buggy.
Chances are that you are not a developer.
"He who is without a sin throw the first stone."
For anyone on a slow connection or with an old machine (like me) that was almost a showstopper. Thankfully, *seems* to be fixed now.Haven't seen any real crashes to the desktop even with the betas...
A workaround is to go Tools->Options-> Security and turn off the attack site and forgery options.
Andy
Now if only they could get around to fixing the much bigger memory issues that seem to get worse and worse with every release. I'm getting tempted to go back to IE for the first time in years.
... I didn't download Firefox 3 when it came out. In fact, I'm still on Firefox 2, and I'm sure a good percentage of fellow /.ers are as well.
Um... the carpet bombing vulnerability also affects Firefox 2. It looks like someone is in trouble :)
http://dictionary.reference.com/search?q=irony
Patrick Doyle
I mod down every jackass who puts his moderation policy in his sig. Oh, wait a sec....
I could swear that I was notified of a security update regarding Firefox a few days ago. After the update, I checked Firefox and it's own About dialog reported it was 3.0.1. Can anyone else confirm this or am I going bonkers? I'm certainly on 3.0.1 now and I only received some mundane updates this morning.
when the authors update them?
of course, you could google for a couple of seconds and fix it yourself (hint: you can force it to ignore the version)
I have developed a truly marvelous proof of this comment, which this signature is too narrow to contain.
I for one, welcome our browser caring overlords.
My issue is that "No one cares when Opera or Safari have a similar release. [or Internet Explorer, or Konqueror...]" but they do when its Firefox.
Opera 9.51 went through a few RC's and a final and is on 9.52RC/Snapshot, Safari has gone through a couple *.*# and a whole #.0 in the last few months for Mac, Win and Mobile...
But no, Firefox 3.1 Sub-Alpha-Hypothetical-Possibility-Beta-RC Build 3219 hits front page and we're supposed to eat a cracker drink some wine and pray to it, but oh wait, we're all for competition and innovation, as long as its Firefox Vs. Firefox.
(stomps off)
And Safari and Opera are both non-free so they are more reluctant to give detailed fix reports.
http://my.opera.com/desktopteam/blog/
When ideas fail, words become very handy.
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox. I don't recall paying to download either Opera or Safari for my desktop and laptop. Yes, I do know opera charges now for the Wii browser, but I don't have a Wii.
Non-free, as in closed-source, as in proprietary. Sure Safari is mostly open-source, but Opera is as much proprietary as IE.
Taxation is legalized theft, no more, no less.
Your post is sorta worded as flamebait to some, but it does have truth. It doesn't take a statistician or a complex algo to add up how many postings have been about FireFox in the past 6 months compared to all other browsers combined. I applaude the openness that Mozilla chose for it's flagship browser. However, their product seems to have drawn some rather fervent users as well. Don't mind them, they're to Firefox as Fundies are to religion. That is, ignore/condemn anything that doesnt parallel their own viewpoint.
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox.
Safari is Open Source. Head over to WebKit.org and you can get the source via Subversion or browse it via Trac. It's licensed under a mix of LGPL and BSD licenses.
Safari has gone through a couple *.*# and a whole #.0 in the last few months for Mac, Win and Mobile...
And Internet Explorer is still going through lots of *&^%$#@!
The update for FF2 was pushed out a day before the FF3 update (on Tuesday morning, versus Wednesday afternoon). If you aren't using 2.0.0.16, you're prone to the same attack.
Safari is closed source. WebKit (the layout engine Safari uses) is open source, but the builds used by Safari rely on a binary closed source blob from Apple. If you value software freedom, you shouldn't use Safari.
no, Safari isn't open source, WebKit is open source, because it is based on khtml.
New things are always on the horizon
It seems you haven't run Windows Update for a long time then...
Let me save you some time and map out your journey to acceptance of the awesome bar.
First you hate it, because it's new and different to what you expect. You are trained to use it as an address bar and nothing else, so it acting like a search bar is confusing and suboptimal to you.
At this point many people decide to trial the new bar, but you are the kind of person who tends to think he (forgive me, but he) knows what's good and what's not, and even quite enjoy the idea of customizing your Firefox. So you look for a way to preserve your old behavior. There are enough people like you to make worthwhile a mass solution: a config option and an extension.
You and your anti-awesome fellows make use of these. You occasionally grumble that the awesome bar shouldn't be default at all, but you are basically satisfied so the rest of the world hears from you less and less.
As time passes, you occasionally find yourself using other people's computers that have Firefox in a default state. This annoys you at first and if you are spending any serious time on them, you disable the awesome bar. But sometimes you're only using them briefly, so it's not worth modifying. Then, all of a sudden, you find the awesome bar useful. It's a surprise, like a door opening: you suddenly see that if you alter your behavior a little, the awesome bar could be quite useful.
From this point you never disable the awesome bar again, although you leave it disabled on your main desktop, as a matter of principle.
A new version of Firefox is released. The "Disable Firefox Awesome Bar" extension hasn't yet been updated to work on it. But by now you don't really mind. You now prefer the awesome bar. When you have to use Internet Explorer, or Firefox 2, the lack of an awesome bar bugs you. It seems so inflexible, so archaic.
A while later, the author of the awesome-disabling extension stops updating it. People forget that anybody ever didn't like the awesome bar. But this new Firefox feature, the predictive URL form mapping--oh man, that's just so horrible, why is it on by default?
I should buy some cement.