Slashdot Mirror
Firefox 3.5's First Vulnerability "Self-Inflicted"
CWmike writes "Mozilla has confirmed the first security vulnerability in Firefox 3.5, saying that the bug could be used to hijack a machine running the company's newest browser. A noted Firefox contributor called the situation 'self-inflicted' and said it was likely that the hacker who posted public exploit code Monday became aware of the flaw by rooting through Bugzilla, Mozilla's bug- and change-tracking database. The vulnerability is in the TraceMonkey JavaScript engine that debuted with Firefox 3.5, said Mozilla. '[It] can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code,' Mozilla's security blog reported Tuesday."
Mozilla has confirmed the first security vulnerability in Firefox 3.5, saying that the bug could be used to hijack a machine running the company's newest browser.
Just a note, I think Mozilla tries to shirk any idea of "company" or "corporation" from the open source development side of things. Instead, they are a non-profit foundation and recently created a separate taxable corporation with the intent of distribution and productizing Firefox & Thunderbird.
I think the word 'company' implies commercial interests and the developing part of Mozilla--the Foundation--does not have any commercial interests. While this may seem unimportant to you, I believe it to be a pretty important concept to clarify when you're talking about open source from a non-profit and open source from a company.
My work here is dung.
Everyone download NoScript Pronto!
It pays to be obvious, especially if you have a reputation for being subtle.
Let's see how long it takes them to patch this
Probably won't be too long
Build a Man a Fire, and He'll Be Warm for a Day. Set a Man on Fire, and He'll Be Warm for the Rest of His Life.
I've wondered: will having an up to date NoScript addon for firefox prevent these attacks? or will this bypass NoScript?
"Going to war without the French is like going deer hunting without your accordion." ~General Norman Schwarzkopf
Has anyone notice performance degradation in 3.5? Opening a slew of bookmarked pages into tabs tends to make it feel like my internet connection has slowed down. Yet when all the tabs load, they all respond snappily.
And sometimes certain sites act sluggish when opening the same exact site works fine in Safari.
It wasn't like this in 3.01
"I am the king of the Romans, and am superior to rules of grammar!"
-Sigismund, Holy Roman Emperor (1368-1437)
They already had a standing policy of hiding security related bugs (I.e. those that they figured were exploitable; It is even discussed in the log linked in the summary!).
Nerd rage is the funniest rage.
What do you mean there is a security exploit in a brand new version of a web browser? This is crazy, new versions of software should always be more secure then the previous versions.
Personally I'll be sticking with IE6, I never bought into this whole "Firefox" thing.
'[It] can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code,' Mozilla's security blog reported Tuesday."
Oh sure, I'm definitely going to follow that link now.
I only use IE 5.5!
I had heard about this earlier in the week and decided to give the demo exploit (which executes calc.exe) a run. As soon as I tried to save the HTML to a file Microsoft's Forefront A/V popped up with an alert detecting the shellcode within the sample code. Not bad, MS.
But if you really want to be safe you should be running noscript. It'll save you from running malicious code on sites you don't trust.
but isn't every application vulnerability self-inflicted? unless perhaps somebody hacked in and wrote the code for you!
"Looking at the exploit code and our test cases, I think this is self-inflicted and we should have hidden the bug earlier"
Nice attitude, guys...
Go on and mod me troll but, IMNSHO, this is just a display of the expertise of the full disclosure movement: Just post a test-case from an open bugtracker as your own exploit and enjoy your 15 minutes of fame amongst all the other skript-kiddies.
Well done, hacker!
(USER WAS PUT ON PROBATION FOR THIS POST)
So.... Time till someone makes a post saying how much better Firefox is because it doesn't practice "Security through obscurity?"
According to TFA, the temporary fix is to disable TraceMonkey (JavaScript will still work). Set 'javascript.options.jit.content' in about:config to false until the patch is released.
Dislike the Electoral College? Lobby your state to join the National Popular Vote Interstate Compact.
Mod Parent Up "this should have been in the summary, Taco".
Still it was fixed by the time I heard about it, yesterday. I've become a recent Microsoft convert, but they tend to pretend this isn't happening, till they release a fix on their own good time. And Apple just breaks everything for everyone else all the time so let's not go there. I'll be the first ever person to ever say I bought Apple hardware just to find out that Apple broke it for me cause I wasn't just cool.
Hey they allow links from slashdot again. that was blocked in the past.
Who cares if they do? Security through obscurity is a perfectly valid strategy, as long as it is used in conjunction with other strategies, so when someone criticizes the mere use of secrecy, they can be disregarded.
(Think about it for a minute; passwords, keys, access codes, hidden safes, etc.)
Nerd rage is the funniest rage.
is Google Chrome...
Nope:
http://chromekb.com/vulnerabilities/
The attitude that some platforms are simply immune to attacks is foolish and counterproductive.
"I zero-index my hamsters" - Willtor (147206)
Why not post in the summary the simple fix?
In lieu of a patch, users can protect themselves by disabling the "just-in-time" component of the TraceMonkey engine.
To do that, users should enter "about:config" in Firefox's address bar, type "jit" in the filter box, then double-click
the "javascript.options.jit.content" entry to set the value to "false." The popular NoScript add-on will also ward off attacks.
If you are worried about IE, why did you link to a bug in Office?
Of course, Mozilla won't add a NoScript-like UI to Firefox, as it would make it convenient to block scripting, and hence annoy advertisers.
GCHQ Quantum Insert installed. If only our tongues were made of glass, how much more careful we would be when we speak
Why does it take me several minutes to slosh through the GUI just to make a new folder and alphabetize some bookmarks in it?
I don't know. Why dose it take you that long? I takes me seconds. Maybe the issue is you?
Why is it so hard to only have politicians for a few years, then have them go away?
I have it set in FF, to open a new link in a new tab. This has worked beautifully till now. When I click a link in Gmail now, rather than open a new tab, it opens the link in a new windown without any scroll bars!?!?!
Now, if I want to open a link from Gmail, I have to rt. click and tell it to open in a new tab.
This kinda sucks IMHO.
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Careful.
The official NoScript site is http://noscript.net/.
To anyone who doesn't already know: NoScript prevents Javascript scripts from running unless they are chosen from a menu. That even protects against vulnerabilities that haven't been discovered yet.
Sometimes it's better to just hold back and wait until my distro decides it is time to update my versions.
“Common sense is not so common.” — Voltaire
fixed, but not pushed out yet. For the 'days to a fix' count, you need to count all days from the time the hole was discovered to the day a fixed version / patch is pushed out to users. (if I have to go looking for it, it's not 'fixed' yet) Most people are trained to only respond to Firefox's Update popups.
milw0rm who can be easily put to definition of "script kiddie lamer" spied bugzilla bug reporting system which should not be open regarding security issues and posted a quick exploit code to a bug which its was already in progress of fixing.
So, open source system was abused in some form. It was error on mozilla's part though, security issues of open source apps shouldn't be discussed in public along with crashers etc.
Not a surprise. These people subscribe to all update/security mailing lists and grab couple of issues and claim they hacked OS X.
On the other hand, Mozilla should be glad that he picked it. If it was a real black hat professional, he wouldn't be stupid enough to publicly disclose it and milk it as long as possible.
So.... Time till someone makes a post saying how much better Firefox is because it doesn't practice "Security through obscurity?"
Uh, "Security through obscurity" doesn't refer to whether or not existing security vulnerabilities are made public before a fix is available. "Security through obscurity" means that lack of information is the only thing keeping something secure, such as assuming that nobody will ever guess that putting "&admin=true" at the end of a URL will give them administrator access.
browser.link.open_newwindow.restriction
double-click that pref to edit the value to 0
I've had it this way for years without any problems. "
Thank you, that worked!!
I've not had to do that before I don't think...wonder why they changed that in the 3.5 version?
What exactly does this setting do? My value was a "2".
Light travels faster than sound. This is why some people appear bright until you hear them speak.........
Well, you could check for known problems first.
http://mozillalinks.org/wp/2009/07/workaround-for-firefox-3-5-slow-startups-on-windows/
If that doesn't fix it for you, post a bug report with the firefox devs (instead of on slashdot).
I thought security bugs were supposed to be confidential.
That's correct. I was mistaken. I gave a correct answer, but the only perfect way to know which URL is to go through the Mozilla web site.
Is it just me who remembers the days when the only way to browse safely was to turn off Javascript? Now we're all drinking the web 2.0 kool aid it seems we've forgotten how many browser vulns are Javascript-related. Websites should never depend on Javascript to function properly but now we have point 'n click JQuery, Dojo etc. it seems websites are built on Javascript foundations with all the security issues that implies.
323 // 0: no restrictions - divert everything // 1: don't divert window.open at all // 2: don't divert window.open with features
324
325
326 pref("browser.link.open_newwindow.restriction", 2);
See http://hg.mozilla.org/mozilla-central/annotate/94909af358c4/browser/app/profile/firefox.js
such as assuming that nobody will ever guess that putting in a password of "&aR4q=Xj9_n½" will give them administrator access.
I would have edited in a password like "12345", but I had to enclose it in "strong" tags so that felt kind of cheap.
"Security through obscurity" means that lack of information is the only thing keeping something secure
yeah, kind of like lacking my username and password is one of the few practical things keeping you from using my online identity, and lacking my credit card number keeps you from running me into debt. Things like that. ;3
People willing to trade their freedom of expression for temporary entertainment deserve neither and will lose both.
This post is lifted directly from trollaxor.
http://www.trollaxor.com/2009/07/some-questions-comments-about-firefox.html
Please, when a post is as obviously a troll as this, mod it fucking troll.