Slashdot Mirror
Firefox 3.5's First Vulnerability "Self-Inflicted"
CWmike writes "Mozilla has confirmed the first security vulnerability in Firefox 3.5, saying that the bug could be used to hijack a machine running the company's newest browser. A noted Firefox contributor called the situation 'self-inflicted' and said it was likely that the hacker who posted public exploit code Monday became aware of the flaw by rooting through Bugzilla, Mozilla's bug- and change-tracking database. The vulnerability is in the TraceMonkey JavaScript engine that debuted with Firefox 3.5, said Mozilla. '[It] can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code,' Mozilla's security blog reported Tuesday."
Mozilla has confirmed the first security vulnerability in Firefox 3.5, saying that the bug could be used to hijack a machine running the company's newest browser.
Just a note, I think Mozilla tries to shirk any idea of "company" or "corporation" from the open source development side of things. Instead, they are a non-profit foundation and recently created a separate taxable corporation with the intent of distribution and productizing Firefox & Thunderbird.
I think the word 'company' implies commercial interests and the developing part of Mozilla--the Foundation--does not have any commercial interests. While this may seem unimportant to you, I believe it to be a pretty important concept to clarify when you're talking about open source from a non-profit and open source from a company.
My work here is dung.
They already had a standing policy of hiding security related bugs (I.e. those that they figured were exploitable; It is even discussed in the log linked in the summary!).
Nerd rage is the funniest rage.
What do you mean there is a security exploit in a brand new version of a web browser? This is crazy, new versions of software should always be more secure then the previous versions.
Personally I'll be sticking with IE6, I never bought into this whole "Firefox" thing.
'[It] can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code,' Mozilla's security blog reported Tuesday."
Oh sure, I'm definitely going to follow that link now.
If you had read the bugzilla thread (I know, I know) you'd know it's already fixed ;)
(USER WAS PUT ON PROBATION FOR THIS POST)
They haven't released an update yet though, which is probably the more interesting event.
Nerd rage is the funniest rage.
You mean that you actually want example exploit code to be available to everyone? Why?
What a fool believes, he sees, no wise man has the power to reason away.
So when they know about and are actively working on fixing a bug that is an exploit vulnerability, you think they should do it in public?
I get the argument that telling your users about it means that they can protect themselves (say, by running noscript), but for a consumer facing organization like Mozilla, the majority of users aren't going to notice or do anything.
Nerd rage is the funniest rage.
According to TFA, the temporary fix is to disable TraceMonkey (JavaScript will still work). Set 'javascript.options.jit.content' in about:config to false until the patch is released.
Dislike the Electoral College? Lobby your state to join the National Popular Vote Interstate Compact.
Mod Parent Up "this should have been in the summary, Taco".
is Google Chrome...
Nope:
http://chromekb.com/vulnerabilities/
The attitude that some platforms are simply immune to attacks is foolish and counterproductive.
"I zero-index my hamsters" - Willtor (147206)
No-Script has never been spyware. Adware, on the other hand...
They haven't released an update yet though, which is probably the more interesting event.
That's true of course. And I don't want to split hairs but point out the open source nature of the Firefox browser:
The patch is already available.
(USER WAS PUT ON PROBATION FOR THIS POST)
Careful.
The official NoScript site is http://noscript.net/.
To anyone who doesn't already know: NoScript prevents Javascript scripts from running unless they are chosen from a menu. That even protects against vulnerabilities that haven't been discovered yet.
But, the majority of users only update firefox when it pops up a "hey, there's an update. Click here!" prompt.
The issue is unfixed for 90% of users until that occurs.
Ended up going back to noscript recently but it really is an ugly solution, yesscript is only helps against tracking. What is really needed is a good guide for using controldescripts (or a similar extention) allowing all sites to access a list of known safe fucntions (to let you browse the web without it getting in the way), some to be blacklisted (to protect you from tracking), an easy GUI way to allow a greater subset of functions to be accessed (for trusted site) and an security workarounds to stop any vulnerabilities working in the wild.
IranAir Flight 655 never forget!
Pshaw. I use telnet, and read the native code. I don't even see the code anymore... Blonde, Brunette, Red-Head...
Reading sites that use SSL is a bit tricky, though.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
NoScript got buried after the incident with it fucking around with AdBlock's settings, then once that was discovered and pointed out, them adding an AdBlock filter set to bypass blocking on NoScript's author's site.
As far as I know, it does neither any more, but it pissed off a lot of users, myself included, and its author's reputation went through the floor.
GLaDOS for President 2016! "Well here we are again. It's always such a pleasure." -- GLaDOS, 2011
Is it just me who remembers the days when the only way to browse safely was to turn off Javascript? Now we're all drinking the web 2.0 kool aid it seems we've forgotten how many browser vulns are Javascript-related. Websites should never depend on Javascript to function properly but now we have point 'n click JQuery, Dojo etc. it seems websites are built on Javascript foundations with all the security issues that implies.