Mozilla Plans Fix For Critical Firefox Vulnerability In Next Release

← Back to Stories (view on slashdot.org)

Mozilla Plans Fix For Critical Firefox Vulnerability In Next Release

Posted by Soulskill on Saturday March 20, 2010 @04:05AM from the sooner-than-later dept.

Trailrunner7 writes "A month after an advisory was published detailing a new vulnerability in Firefox, Mozilla said it has received exploit code for the flaw and is planning to patch the weakness on March 30 in the next release of Firefox. Mozilla officials said Thursday that the vulnerability, which was disclosed February 18 by Secunia, is a critical flaw that could result in remote code execution on a vulnerable machine. The vulnerability is in version 3.6 of Firefox."

140 comments

Your official guide to the Jigaboo presidency by Anonymous Coward · 2010-03-20 04:06 · Score: -1, Troll

Congratulations on your purchase of a brand new nigger! If handled properly, your apeman will give years of valuable, if reluctant, service.
INSTALLING YOUR NIGGER.
You should install your nigger differently according to whether you have purchased the field or house model. Field niggers work best in a serial configuration, i.e. chained together. Chain your nigger to another nigger immediately after unpacking it, and don't even think about taking that chain off, ever. Many niggers start singing as soon as you put a chain on them. This habit can usually be thrashed out of them if nipped in the bud. House niggers work best as standalone units, but should be hobbled or hamstrung to prevent attempts at escape. At this stage, your nigger can also be given a name. Most owners use the same names over and over, since niggers become confused by too much data. Rufus, Rastus, Remus, Toby, Carslisle, Carlton, Hey-You!-Yes-you!, Yeller, Blackstar, and Sambo are all effective names for your new buck nigger. If your nigger is a ho, it should be called Latrelle, L'Tanya, or Jemima. Some owners call their nigger hoes Latrine for a joke. Pearl, Blossom, and Ivory are also righteous names for nigger hoes. These names go straight over your nigger's head, by the way.
CONFIGURING YOUR NIGGER
Owing to a design error, your nigger comes equipped with a tongue and vocal chords. Most niggers can master only a few basic human phrases with this apparatus - "muh dick" being the most popular. However, others make barking, yelping, yapping noises and appear to be in some pain, so you should probably call a vet and have him remove your nigger's tongue. Once de-tongued your nigger will be a lot happier - at least, you won't hear it complaining anywhere near as much. Niggers have nothing interesting to say, anyway. Many owners also castrate their niggers for health reasons (yours, mine, and that of women, not the nigger's). This is strongly recommended, and frankly, it's a mystery why this is not done on the boat
HOUSING YOUR NIGGER.
Your nigger can be accommodated in cages with stout iron bars. Make sure, however, that the bars are wide enough to push pieces of nigger food through. The rule of thumb is, four niggers per square yard of cage. So a fifteen foot by thirty foot nigger cage can accommodate two hundred niggers. You can site a nigger cage anywhere, even on soft ground. Don't worry about your nigger fashioning makeshift shovels out of odd pieces of wood and digging an escape tunnel under the bars of the cage. Niggers never invented the shovel before and they're not about to now. In any case, your nigger is certainly too lazy to attempt escape. As long as the free food holds out, your nigger is living better than it did in Africa, so it will stay put. Buck niggers and hoe niggers can be safely accommodated in the same cage, as bucks never attempt sex with black hoes.
FEEDING YOUR NIGGER.
Your Nigger likes fried chicken, corn bread, and watermelon. You should therefore give it none of these things because its lazy ass almost certainly doesn't deserve it. Instead, feed it on porridge with salt, and creek water. Your nigger will supplement its diet with whatever it finds in the fields, other niggers, etc. Experienced nigger owners sometimes push watermelon slices through the bars of the nigger cage at the end of the day as a treat, but only if all niggers have worked well and nothing has been stolen that day. Mike of the Old Ranch Plantation reports that this last one is a killer, since all niggers steal something almost every single day of their lives. He reports he doesn't have to spend much on free watermelon for his niggers as a result. You should never allow your nigger meal breaks while at work, since if it stops work for more than ten minutes it will need to be retrained. You would be surprised how long it takes to teach a nigger to pick cotton. You really would. Coffee beans? Don't ask. You have no idea.
MAKING YOUR NIGGER WORK.
Niggers are very, very averse to work of any kind. The nigger's most
1. Re:Your official guide to the Jigaboo presidency by rdavidson3 · 2010-03-20 05:08 · Score: -1, Offtopic
  
  I could mark this one down as a troll as well, but what's the point since he is wasting one of my mod points in doing so, and it will just post this hate garbarge in another posting.
  
  Has anyone contacted the police and get IP records and get this bozo charged with hate crimes? We do live in the 21st century; language, culture and humanity has moved waaaaaaay past this, and there are laws that are being broken here. Although I think this behavior shouldn't have been allowed to happen then and definitely not now. I am getting upset that I keep seeing this and have to waste time and points burying it, and have seen people posting that to just "ignore it and it will go away", but it hasn't gone away.
  
  I really don't know why after so many months, we are allowing this clown to continue posting. The wording and language is almost exactly the same. So, why doesn't the filter pick this up and log IP and delete the post? Do the overlords in slashdot secretly agree with this language and choose to let this continue.
  
  I come to slashdot to read and comment on various IT / science topics and may not agree with everyone here, but we can be civilized about it.
  
  Sincerely,
  White guy that hates racism in all forms.
  
  P.S. Sorry for the rant, but this has gone on for too far. This will be the last time I will waste any of my time commenting on this or using mod points to deal with it. Mod me into oblivion if you wish to do so, but its your conscience.
2. Re:Your official guide to the Jigaboo presidency by Clover_Kicker · 2010-03-20 05:33 · Score: 0, Offtopic
  
  With a small amount of work you can post from a different IP address every time.
  Or it might be a dozen different losers cutting and pasting the same thing.
  BTW, a reaction like yours will keep them motivated and posting, thanks ever so much.
3. Re:Your official guide to the Jigaboo presidency by rdavidson3 · 2010-03-20 05:42 · Score: 0, Offtopic
  
  That's why logs are keep at the ISPs. Get the police involved and the time of the post, and they can identify the people or bots behind it.
  
  With the language the same in every single post, why doesn't slashdot just filter this out to the garbage before it gets posted.
  
  Maybe we should have a "-1 hate crime" mod, and the overlords can determine what to do with it. As it is, I only see myself or other mods pushing it down, thus wasting one of my mod points whereas I can be modding someone "+1 interesting" instead.
4. Re:Your official guide to the Jigaboo presidency by gbjbaanb · 2010-03-20 05:52 · Score: 0, Offtopic
  
  good - wasting time commenting on this stuff keeps them motivated to post.
  that said, after reading your comment, I had to see what the fuss was about.. I found it quite amusing really. Well, no less amusing that "installing boyfriend 2.0" or "upgrading girlfriend to wife", or any Irish, Polish, or random celebrity jokes that no-one seems to have a problem with. (I'm not American so I don't have the same 'horror' of the N word BTW, round here it's the C word that's the 'uh-oh' one).
  It obviously falls into the "not meant to be taken seriously" category (except by the author perhaps, but then he didn't care - he just cared to push your buttons).
  So - ignore it and although it won't go away, you can stop caring about it. *That* is what will rile the poster.
5. Re:Your official guide to the Jigaboo presidency by TheRaven64 · 2010-03-20 05:54 · Score: -1, Offtopic
  
  Way off topic now, but you seem to have a really warped idea of what constitutes a hate crime. A hate crime is a crime motivated by the victim's social group. Assaulting someone because they are black is a hate crime. Smashing someone's windows because they are gay is a hate crime. The key fact is that these things are crimes irrespective of motivation, they become hate crimes because they are also motivated by hatred of a particular group.
  Posting a rather boring monologue is not a crime. The fact that the monologue is racist just makes it stupid as well as boring. The original poster is exercising his right to free speech by posting as he does. We have the right to ignore him, and can also exercise our free speech rights to tell him to shut the fuck up.
  The latter is unlikely to have any effect, because it is quite unlikely that the poster is actually racist - it's more likely that he just posts racist drivel in an attempt to provoke a reaction such as (for example) a hysterical and over-the-top demand to get the police involved.
  You say 'laws have been broken,' but you don't give any indication of which laws. Hate crime laws are obviously not applicable here, so what do you think the police should be looking for?
  
  --
  I am TheRaven on Soylent News
6. Re:Your official guide to the Jigaboo presidency by Anonymous Coward · 2010-03-20 05:59 · Score: 0
  
  Hate crime? I'm sorry, but you are a fucking idiot. It is not illegal to be racist, nor is it illegal to state your hatred of any specific race, gender, age, sexual orientation, religion, etc.
7. Re:Your official guide to the Jigaboo presidency by Lehk228 · 2010-03-20 06:00 · Score: 0, Offtopic
  
  hate speech is not a hate crime, it is protected by the US constitution regardless of how distasteful it is.
  
  fortunately for you, being an idiot is also completely legal
  
  --
  Snowden and Manning are heroes.
8. Re:Your official guide to the Jigaboo presidency by causality · 2010-03-20 06:04 · Score: -1, Offtopic
  
  Has anyone contacted the police and get IP records and get this bozo charged with hate crimes? We do live in the 21st century; language, culture and humanity has moved waaaaaaay past this, and there are laws that are being broken here. Although I think this behavior shouldn't have been allowed to happen then and definitely not now.
  I am definitely not a lawyer. Having said that, if this individual is in the USA, then no crime has been committed as far as I know. We don't really need to use the police power of government to censor such people anyway. Not only would it be quite difficult to catch many of them, but we simply deal with this differently here. Here, being called "racist" is one of the worst things that could happen to your social life. If you identify yourself as having beliefs like this, it's a tremendous stigma. Thus there is little or no open racism here, at least from white people, and no one has to go to jail to arrange that. If anything, the police would have to protect an open racist from others, and not the other way around. This is quite effective.
  
  I really think that's how you deal with this. The problem with "hate crime" laws is that they are actually thought crimes. For example, if a criminal mugs someone in order to get his money, he receives X punishment. But if that criminal specifically mugged that victim because of race, he might receive X+Y punishment, depending on the state. The difference amounts to what the criminal was thinking. If I get mugged because of what I look like, I'm just as mugged as someone who was targeted randomly. My suffering isn't any more important than theirs; the contents of the attacker's brain does not change this. If muggers are not punished enough, then increase the penalties for all of them. I just don't want the government in the thoughtcrime business, not even when the stated reason is noble. To me that's just as dangerous as all of the "protect the children" and "stop terrorism" reasons that are so often given.
  
  With text posted to a Web site, no one was physically harmed. People are going to say things on the Internet all the time that you and I would find absolutely despicable. Even if we released all the violent criminals and drug offenders today, I doubt there would be enough prison space to hold even a fraction of them. Additionally, you have a choice about whether you react emotionally or not to things you can't control.
  
  When I read the post to which you replied, I just shook my head. I didn't get upset about it, I didn't get offended, and I didn't let it ruin my day. I already knew there were assholes in the world, so I'm not shocked or surprised by an example of one. With over 6.5 billion people in the world, I can guarantee that someone, somewhere is saying or doing something right now that I really wouldn't like. Should I be miserable 24/7 because of that? Should I be miserable only when I am reminded by an example of this? Should I allow some rather immature people to control my emotional well-being by taking them seriously? Like Richard S. Bach wrote, if your happiness depends on what other people are doing, then yes you do have a problem. This pathological tendency is exactly what trolls are counting on, what they exploit. It's so widespread that it's very rarely recognized as pathological.
  
  I am getting upset that I keep seeing this and have to waste time and points burying it, and have seen people posting that to just "ignore it and it will go away", but it hasn't gone away.
  I think they do this just because they want an emotional impact. As I mentioned above, you have 100% control over whether you give them what they want. You're really not ignoring it, and I very rarely see instances of these troll posts that are totally disregarded by everyone (I browse at -1). So I think we have yet to really try that. If that's true, we can't make too many statements about its effectiveness. Meanwh
  
  --
  It is a miracle that curiosity survives formal education. - Einstein
9. Re:Your official guide to the Jigaboo presidency by Anonymous Coward · 2010-03-20 06:08 · Score: 0
  
  You are truly pathetic. And I sure as hell hope that you're not living in a Western country. Your attitude has no place in a society that values freedom.
  Since you probably don't know this, let me inform you that my mother was a Jewish Ethiopian woman, and my father was from India. My skin is very dark, I have some black and Indian features, I'm Jewish, and I'm a woman. That has caused me to face all sorts of intolerance and prejudice over the years. Unlike you, I have actually endured real racism on many occasions.
  However, NOTHING is more important than free expression. Absolutely nothing. Even though I find that post very distasteful, I would never think of preventing anyone from posting it if they wanted to.
  It is absolutely sickening to read your post suggesting that somebody else should be muzzled. Censorship is a much greater social offense than racism ever could be.
  Express your opinion if you want, but in terms of offensiveness, your post is many times worse than the GP's. We can laugh away racism; we can't laugh away censorship when people like you have taken away our ability to laugh.
10. Re:Your official guide to the Jigaboo presidency by b4dc0d3r · 2010-03-20 06:10 · Score: 0, Offtopic
  
  Congratulations, you just encourage it. Twice, and with multiple replies. The moderation system is designed to account for this stuff. It's designed so you just need a single person with a single mod point to mark it as troll or flamebait, cleaning up the comments for others.
  The only thing you've said that makes sense is filtering multiple copies of things. Everything else is heavy-handed censorship type stuff. Police involved for being racist? That's excessive.
  Just ignore it. It's going to be harder than ever, because you just fed the troll. Do not feed the trolls. But just ignore it. I get a kick out of it every time. "Oh that again, silly retard, no one reads that." But I was wrong - you read it. Ignore it.
11. Re:Your official guide to the Jigaboo presidency by rdavidson3 · 2010-03-20 06:15 · Score: 0, Offtopic
  
  Maybe its a good thing I am Canadian then. We do have laws that do something about this.
  
  http://cnews.canoe.ca/CNEWS/Crime/2010/03/20/13300256-qmi.html
12. Re:Your official guide to the Jigaboo presidency by Clover_Kicker · 2010-03-20 06:26 · Score: 0, Offtopic
  
  With the language the same in every single post, why doesn't slashdot just filter this out to the garbage before it gets posted.
  
  Yes, because no-one would change a word or two in their post or do variations on the spelling. Yay, we get to have another lameness-filter style arms race, that'll improve the quality of the posts.
  
  Maybe we should have a "-1 hate crime" mod, and the overlords can determine what to do with it. As it is, I only see myself or other mods pushing it down, thus wasting one of my mod points whereas I can be modding someone "+1 interesting" instead.
  Maybe you should grow a skin and realize that you can't win this kind of pissing contest with griefers.
  Seriously, just ignore it.
  This very moment, some guy in his mom's basement has his pants down fwapping away to your outrage. You've provided motivation for gods know how many more cut'n'paste trolls, because you provided the kind of hysterical reaction they find so entertaining.
  Good job, internet tough guy.
13. Re:Your official guide to the Jigaboo presidency by Anonymous Coward · 2010-03-20 06:40 · Score: 0
  
  Uhh, no. That story says that the guy was busted for vandalizing buildings, not because he said something hateful. He would have been busted even if he had been tagging "I love Jews" graffiti and the Star of David.
  So, yeah, learn to read.
14. Re:Your official guide to the Jigaboo presidency by Zen+Hash · 2010-03-20 08:32 · Score: 1
  
  (I'm not American so I don't have the same 'horror' of the N word BTW, round here it's the C word that's the 'uh-oh' one).
  Cracker? Communist?
  
  --
  Here I sit, all broken hearted.
  Came to poop, but only farted.
15. Re:Your official guide to the Jigaboo presidency by Anonymous Coward · 2010-03-20 08:59 · Score: 0
  
  What laws are being broken? Also, President Obama will be going away in 2012.
16. Re:Your official guide to the Jigaboo presidency by Anonymous Coward · 2010-03-20 13:28 · Score: 0
  
  DANGNABIT COMMIES!
17. Re:Your official guide to the Jigaboo presidency by Anonymous Coward · 2010-03-20 16:32 · Score: 0
  
  Curious.
18. Re:Your official guide to the Jigaboo presidency by Philip_the_physicist · 2010-03-20 17:48 · Score: 1
  
  Yeah, these copypasta trolls are tedious and annoying, but this guy is no worse than the tron fanzine guy, the library shit-eater, and the GNAA's broken Markov chain that posts the goatse links. He's just another retard.
19. Re:Your official guide to the Jigaboo presidency by Philip_the_physicist · 2010-03-20 18:39 · Score: 1
  
  Apart from what the SP says, that doesn't mean that hate speech laws are a good thing. Haven't you heard the saying "sticks and stones may break my bones, but words shall never hurt me"? That sort of post isn't libellous, slanderous, or defamatory, because it wouldn't actually harm anyone's opinion of either a specific black person or black people in general (anyone who would take it seriously would already believe that crap), and there is no measurable harm done by it.
  Even hate crime laws are pretty silly IMO. I had this discussion with a local GLBTQ-rights activist a couple of years ago[1], in the context of a series of gay-bashings that had taken place not long before and the proper response to it. Her understanding of the problem was essentially as a public relations problem, people hate GLTBQ people so let's encourage them to like us, and if they won't we'll punish them for saying so. I saw the problem as a law and order question, people were committing assault and getting away with it, so let's have some more police in the known trouble spots (which were perfectly well known to the general community), because an arbitrary assault[2] for one reason isn't going to hurt any more or less than an arbitrary assault for a different reason. If beating someone up for fun deserves punishment X, it shouldn't matter why you thought it was fun.
  To bring this back to your post, if I vandalise your building, it doesn't matter whether I did it because you are Jewish, because of sexual jealousy, becuase you are short/tall/ugly/good-looking, or just for "teh evulz", and yet hate crime laws say, in effect, that it is more legitimate to victimise someone because they are not from some special category.
  [1] I actually support GLBTQ rights and whatnot, I just completely disagree about strategy with the local movement.
  [2] By this I mean an assault which is not the result of an argument or motivated by anything practical (such as a mugging or a mob shakedown)
1.5 months for a response and release?! by carlhaagen · 2010-03-20 04:08 · Score: 1, Troll

There's a disturbing amount of "Microsoft" in this.
1. Re:1.5 months for a response and release?! by Anonymous Coward · 2010-03-20 04:13 · Score: 0
  
  Then why don't you fix it?
2. Re:1.5 months for a response and release?! by bunratty · 2010-03-20 04:14 · Score: 2, Informative
  
  The flaw was disclosed to Mozilla only recently (perhaps just a few days ago), and there is already a patched build available.
  
  --
  What a fool believes, he sees, no wise man has the power to reason away.
3. Re:1.5 months for a response and release?! by Anonymous Coward · 2010-03-20 04:15 · Score: 0, Interesting
  
  Why don't you fix it?
4. Re:1.5 months for a response and release?! by wizardforce · 2010-03-20 04:16 · Score: 2, Informative
  
  Mozilla already has released a beta build of Firefox 3.6.2, which contains the fix for the unpatched vulnerability.
  A fix already exists, it's just not in the official release.
  
  --
  Sigs are too short to say anything truly profound so read the above post instead.
5. Re:1.5 months for a response and release?! by Anonymous Coward · 2010-03-20 04:20 · Score: -1, Redundant
  
  Why don't you fix it?
6. Re:1.5 months for a response and release?! by rossdee · 2010-03-20 04:31 · Score: -1, Redundant
  
  So when is the official release coming out?
7. Re:1.5 months for a response and release?! by masmullin · 2010-03-20 04:42 · Score: 2, Informative
  
  RTFS
  March 30th.
8. Re:1.5 months for a response and release?! by Gadget_Guy · 2010-03-20 04:46 · Score: 1
  
  The flaw was disclosed to Mozilla only recently
  Well, we don't actually know when the flaw was disclosed. We only know that it was acknowledged to be disclosed recently, but it could have been a while back. However, I don't have a problem with it taking time to do the find, fix and test. The fix for the bug may have ramifications in other parts of the code, and it takes time to check this.
  I think people can be a bit unreasonable with their expectations of patch times.
9. Re:1.5 months for a response and release?! by Anonymous Coward · 2010-03-20 04:48 · Score: 2, Informative
  
  1) about:config
  2) app.update.channel = beta
  And join the beta testers :)
10. Re:1.5 months for a response and release?! by Anonymous Coward · 2010-03-20 05:03 · Score: -1, Troll
  
  Open source is great, except won't this mean hackers are able to do a diff on the source code and figure out the exploit?
11. Re:1.5 months for a response and release?! by daveime · 2010-03-20 05:06 · Score: 3, Funny
  
  Welcome to the FOSS bug patching system
12. Re:1.5 months for a response and release?! by nschubach · 2010-03-20 05:15 · Score: 1
  
  In actuality, it's more the egoist side of human nature. There is someone, somewhere that would likely fix it and recompile. Whether they can get past this idea that their code is their intellectual property and thus, "Someone will have to pay!" will determine if the world can move past such an ego and continue thinking about more important things than a silly exploit.
  
  --
  Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
13. Re:1.5 months for a response and release?! by BrokenHalo · 2010-03-20 05:21 · Score: 2, Informative
  
  There is someone, somewhere that would likely fix it and recompile.
  
  If you had taken the trouble to read the fine (and brief) article, you would be aware that the fix is already available in the release candidates.
14. Re:1.5 months for a response and release?! by AmberBlackCat · 2010-03-20 05:28 · Score: 0, Troll
  
  Is this the part where some government official is supposed to recommend people stop using Firefox until March 30th, or does that only apply to Internet Explorer?
15. Re:1.5 months for a response and release?! by Anonymous Coward · 2010-03-20 06:03 · Score: 0
  
  The difference being that in the case of IE, the patch wouldn't get fixed for 6 months and there'd be *nothing* for the public to use. In the case of Firefox, Secunia didn't release any details about the problem until a few days ago for which a beta patch was quickly created and can be downloaded *right now*.
16. Re:1.5 months for a response and release?! by nschubach · 2010-03-20 07:22 · Score: 1
  
  I know this. I really wasn't referring to this exact instance... the daveime was speaking in generalities and I like to believe I was as well.
  
  --
  Every time I start to have faith in humanity, I ruin it by driving to work between 7 and 8 am.
17. Re:1.5 months for a response and release?! by iPhr0stByt3 · 2010-03-20 09:32 · Score: 0, Troll
  
  MS haters - please mod parent troll.
18. Re:1.5 months for a response and release?! by petermgreen · 2010-03-20 12:20 · Score: 1
  
  This seems like a very risky strategy to me. If the vulnerability is already in the wild they should be pushing out the fix ASAP. If it's not in the wild they should be keeping details quiet until they can make a proper release.
  
  --
  note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
19. Re:1.5 months for a response and release?! by larry+bagina · 2010-03-20 13:49 · Score: 0, Offtopic
  
  There is someone who would fix it and send in a patch. And there's also someone on the other side of bugzilla who will ignore it, decide it's not an issue, or reject the patch because they used 2 spaces for indentation instead of 4.
  
  --
  Do you even lift?
  These aren't the 'roids you're looking for.
20. Re:1.5 months for a response and release?! by AmberBlackCat · 2010-03-21 02:48 · Score: 1
  
  I would rather be a realist labeled a troll than be a shill who is labeled "Insightful". I'd like to also point out that if Microsoft followed the same policy Mozilla used with Flash, every time you launched Firefox, a window would pop up saying "this application has been disabled due to security concerns".
21. Re:1.5 months for a response and release?! by badkarmadayaccount · 2010-03-21 10:08 · Score: 1
  
  https://bugzilla.mozilla.org/show_bug.cgi?id=552350 Please see this bug if you are running FF 3.6. I have a sneaking suspicion that it's the culprit. I wouldn't mind anyone reproducing it, it's sitting unconfirmed as I reported it.
  
  --
  I know tobacco is bad for you, so I smoke weed with crack.
What kept them? by RAMMS+EIN · 2010-03-20 04:14 · Score: 1

Ok, so, since the summary didn't make this clear and I didn't find any explanation in the article, maybe someone on Slashdot can shed some light on this. What took Mozilla so long? It's a critical vulnerability that allows remote code execution. Why did is it taking over a month to fix?

--
Please correct me if I got my facts wrong.
1. Re:What kept them? by bunratty · 2010-03-20 04:16 · Score: 3, Informative
  
  Because the vulnerability was not disclosed to Mozilla at first.
  
  --
  What a fool believes, he sees, no wise man has the power to reason away.
2. Re:What kept them? by abhishekupadhya · 2010-03-20 04:16 · Score: 1, Insightful
  
  Also if this was IE, browser fanboys would take the flamebait oh-so-quickly. Every browser has its own issues. Deal with it.
3. Re:What kept them? by NotQuiteReal · 2010-03-20 04:19 · Score: 4, Funny
  
  Lynx is pretty secure
  
  --
  This issue is a bit more complicated than you think.
4. Re:What kept them? by Securityemo · 2010-03-20 04:33 · Score: 1
  
  Well, the code surface area exposed is pretty small, and the code is old and stable, but how do you know? Have you checked, ran a fuzzer against it? (Only half joking. The punchline being, you never do know until you go look.)
  
  --
  Emotions! In your brain!
5. Re:What kept them? by TheLink · 2010-03-20 05:07 · Score: 1
  
  > Lynx is pretty secure
  
  Yeah, no botnet creator in his right mind is going to target lynx.
  --
  
  Too many replies beneath your current threshold
6. Re:What kept them? by csmanoj · 2010-03-20 05:08 · Score: 1
  
  Wow. If only someone added images, javascript and css support (and still kept it secure), I'll dump all these other browsers.
7. Re:What kept them? by 68kmac · 2010-03-20 05:23 · Score: 1
  
  Lynx is pretty secure
  Even Lynx has had security issues. While searching for an example, I found this, which is even better ;-)
8. Re:What kept them? by thetoadwarrior · 2010-03-20 05:31 · Score: 2, Insightful
  
  If it's patched on March 30 then that's just over a month since it was revealed. That's not too bad and better than Microsoft's record as a whole.
  
  No one claims Firefox is perfect (or any browser for that matter) but IE gets more grief because it most certainly has more problems than the rest. If it weren't for competition as well we'd probably still be stuck on IE6 too since MS was quite happy to stop updating IE when they thought they had the market cornered.
  
  So no need to get defensive about an awful browser like IE.
9. Re:What kept them? by Anonymous+Brave+Guy · 2010-03-20 05:51 · Score: 1, Flamebait
  
  No one claims Firefox is perfect
  Part of the problem with trying to have a sensible discussion on this topic is that so many people do pretty much claim $FOSS_APP is perfect: with enough eyes, all bugs are shallow, yada yada. If a large chunk of your culture and advocacy is based on that sort of foolishness, you're bound to get negative press when inevitably you can't always live up to your own hype.
  Even the parent poster seems to be somewhat guilty of this, throwing in a couple of knee-jerk IE bashing responses. Have you actually looked at the security record of IE vs. Firefox in recent versions, particularly the number of vulnerabilities and the time required to get systems in the field patched against them? Firefox still runs all its tabs under the same process, so its fans are hardly in a position to be throwing stones at anyone else over security and reliability.
  
  --
  If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
10. Re:What kept them? by Korin43 · 2010-03-20 10:24 · Score: 1
  
  Oh my god! Not all of the tabs in the same process! That's the worst security problem I've ever heard of!
11. Re:What kept them? by Anonymous+Brave+Guy · 2010-03-20 11:02 · Score: 1
  
  It's a fundamental flaw in the architecture, which allows (at a minimum) any web page to trivially lock up the entire browser, causing the loss of whatever is being done in the other tabs.
  
  --
  If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
12. Re:What kept them? by buanzo · 2010-03-20 12:59 · Score: 1
  
  you gotta love that netcraft article from APRIL :)
  
  --
  Buanzo Consulting - 15 Years of GNU/Linux experience, for you.
13. Re:What kept them? by Anonymous Coward · 2010-03-20 19:21 · Score: 0
  
  With enough eyes, all bugs are shallow is a silly statement...or rather an attempt to avoid over-complicating the issue by adding in too many conditionals. "With enough eyes with an intelligent, creative mind capable of understanding what is read, enough testers with the patience and forethought to attempt otherwise unforeseeable circumstances, and enough experience in the field that corner cases get tested ad nauseum, all bugs are shallow" is far from pithy. I believe, though, that amending the statement to "With enough of the right eyes, all bugs are shallow", the statement is valid. The reason being, of course, that the definitions of enough and right are fungible, so any undiscovered and potentially not shallow bugs just haven't been seen by 'enough' eyes or the 'right' eyes. No app will ever be perfect. The binary logic used by ICs today is a digital approximation of an analog signal, so even so-called perfect code would fall victim to stray interference, both hardware and software. Or, to quote a movie that began great and turned into a "Blade Runner"-esque Will Smith action movie without any of the class, "there have always been ghosts in the machine". The rest of your post isn't worth rebutting as many here can perform that rebuttal far more vehemently and eloquently than I would even care to do. Although I recommend you google electrolysis, both in regards to firefox and that hairy mole above your lip.
Further details available in Customer Area by tepples · 2010-03-20 04:19 · Score: 1

It's a critical vulnerability that allows remote code execution. Why did is it taking over a month to fix?
Answer: Further details available in Customer Area
1. Re:Further details available in Customer Area by Anonymous Coward · 2010-03-20 04:27 · Score: 1, Interesting
  
  Regardless of your stance on full disclosure, disclosure in return for payment seems to be little more than extortion. I'm going to blame this one on secunia.
So this just shows, that you can't relax. by Securityemo · 2010-03-20 04:23 · Score: 2, Insightful

Just because you run Firefox, you can't relax about malware attacks. Not on Windows anyway. Imagine how quickly an exploit of this type could be integrated into a malware kit, already running on countless compromised sites? No one can relax about buffer/stack smashing, dangling pointers, etc..., until there's a bulletproof safeguard against them built into the OS/processor architecture.

--
Emotions! In your brain!
1. Re:So this just shows, that you can't relax. by Anonymous Coward · 2010-03-20 04:45 · Score: 0
  
  I don't know why people think Linux is a silver bullet. Imagine a world where "they" manage remove code execution on a remove machine, any remote machine.
  On Linux with Firefox, the browser runs as the normal user, so when it gets exploited they can't take over the OS, but they still steal your personal information and can destroy all your personal documents. For me, at least, my personal data is far more important than my OS! Corporate networks may disagree.
  On Windows (Vista+) with IE, the browser runs in low integrity mode, so it doesn't even have access to local user data. (!) Users running as normal users are more protected by the architecture than on Linux. The majority of attacks are crippled, but occasionally something bad happens.
  On Windows with Firefox, the browser runs as the normal user, so when it gets exploited they can't take over the OS, unless they're running as administrator, which post XP is a stupid thing to do. They can lose personal information in all cases.
  Of course, this assumes we're not comparing modern Linux to a Windows release from 2001.
  Written from Firefox on Windows 7 running as a standard user, because I still care more about usability than security.
2. Re:So this just shows, that you can't relax. by causality · 2010-03-20 05:00 · Score: 1
  
  Just because you run Firefox, you can't relax about malware attacks. Not on Windows anyway. Imagine how quickly an exploit of this type could be integrated into a malware kit, already running on countless compromised sites? No one can relax about buffer/stack smashing, dangling pointers, etc..., until there's a bulletproof safeguard against them built into the OS/processor architecture.
  Agreed. Personally I use Gentoo Hardened with PaX and Grsecurity in the kernel plus a hardened toolchain and userspace measures against buffer overflows. That includes things like address randomization, non-executable pages, mprotect() restrictions, etc. Further measures are also available, like capability systems. It's good, though I would not call it "bulletproof", not even if I thought it was.
  
  Really none of this is any substitute for patching known vulnerabilities. What it does provide is a second line of defense against vulnerabilities you don't yet know about or cannot yet patch. Because I am building Firefox (really all my programs) from source with these features enabled, I benefit from some protection against flaws like this.
  
  I think some of these measures are becoming increasingly common on more mainstream Linux distributions. That's a very good thing as well, since I realize that many users don't want to compile source code. For example, one of my friends is set up with OpenSUSE and it has AppArmor and other protections available by default. I can't remember whether they were enabled by default, but it's still a step in the right direction. You can arrange your systems so merely discovering that you run a vulnerable version is not good enough for the attacker. At least with Linux this is readily achievable, though still not commonplace.
  
  I'd be interested in knowing what options are available for similarly hardening Windows. What I'd really like to see is for the average system to become difficult enough to compromise that there is no longer fertile ground for automated attacks and the botnets that follow. I think that's achievable too, if we really wanted to do it.
  
  --
  It is a miracle that curiosity survives formal education. - Einstein
3. Re:So this just shows, that you can't relax. by Securityemo · 2010-03-20 05:03 · Score: 0, Troll
  
  Currently, you *can* relax about _malware_ if you're on Linux/*nix, because it's just not a target. Windows 7 has good security on the native-level front, with stack/heap NX, and full ASLR, but both of these can be coded around, in many exploit situations. It's still better than many end-user-oriented linux dists, code quality notwithstanding. Also, you forget one attack vector, and perhaps the easiest in terms of not having to deal with security measures: having the payload embed malicious code in the browser itself and steal data from, say, banking sessions.
  
  --
  Emotions! In your brain!
4. Re:So this just shows, that you can't relax. by Anonymous Coward · 2010-03-20 05:15 · Score: 0
  
  No one can relax about buffer/stack smashing, dangling pointers, etc..., until there's a bulletproof safeguard against them built into the OS/processor architecture.
  That's already done. It's called DEP (NX bit). WinXP have to enable it manually for non-MS apps. Win 7/Vista users enjoy the protection for all apps by default.
  (And even if your old CPU doesn't support the NX bit, DEP will work for you as they have a software emulation for it in the OS.)
5. Re:So this just shows, that you can't relax. by Securityemo · 2010-03-20 05:18 · Score: 1
  
  Personally, I just run Arch with the standard security (ASLR, not sure about NX), and use an OpenBSD VM when I need to touch "places" that have a risk for targeted attacks. I even run sudo without password prompting. For hardening Windows boxes, take a look at eEye's products? Frankly, however, I don't know about exploitation prevention frameworks/apps on Windows (other than signature-based IDS) either.
  
  --
  Emotions! In your brain!
6. Re:So this just shows, that you can't relax. by Securityemo · 2010-03-20 05:38 · Score: 1
  
  Nope, we're not *entirely* there yet: http://skypher.com/index.php/2010/03/01/internet-exploiter-2-dep/
  
  --
  Emotions! In your brain!
7. Re:So this just shows, that you can't relax. by Anonymous+Brave+Guy · 2010-03-20 05:59 · Score: 1
  
  Your point, that data can be more valuable than system integrity and is not protected by Linux-style user vs. root access control, is excellent. I just wanted to pick up on this comment:
  
  For me, at least, my personal data is far more important than my OS! Corporate networks may disagree.
  Anywhere I've ever worked, the corporate network would agree with you, and strongly. Replacing a compromised machine is just a format and reinstall of a drive image, something Corporate IT do all the time with new machines anyway. On the other hand, losing confidential information about business plans, trade secrets, or God forbid anything sensitive that has been provided in confidence by a client or business partner, can be crippling to the point of killing projects or destroying the business.
  This is why threats from within (employees gone bad) are usually the most dangerous, but the same principle applies to any external attacks.
  
  --
  If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
8. Re:So this just shows, that you can't relax. by TheRaven64 · 2010-03-20 06:01 · Score: 2, Informative
  
  (And even if your old CPU doesn't support the NX bit, DEP will work for you as they have a software emulation for it in the OS.)
  Not true. The DEP code on machines without NX bit support in the page tables will only protect you from a certain category of attack involving Microsoft's Structured Exception Handling system.
  Contrast this with the OpenBSD implementation, which uses the x86 segment protection mechanism to enforce W^X when the NX bit is not present.
  
  --
  I am TheRaven on Soylent News
9. Re:So this just shows, that you can't relax. by Rick17JJ · 2010-03-20 06:56 · Score: 2, Interesting
  
  I run Firefox sandboxed from within SandboxIE on my Windows XP computer. SandboxIE builds a virtual sandbox around the default browser on a computer. In addition, my computer is set up to where I am normally logged in with a user name. I only log in as administrator, when needed. I also use the NoScript and Adblock Plus extensions for Firefox. I only enable the running of scripts for certain Websites that I trust. Perhaps, those measures might help, but I am not a computer expert and do not know for sure.
  
  I use Kubuntu Linux on my other computer, which is my main home computer. That is the computer which I am using at the moment. I also use Firefox on it, but there is not a Linux version of SandboxIE. Perhaps, I should use the Konqueror browser instead, until the final release of the patched version of Firefox becomes available. The Konqueror browser is already installed on this computer.
  
  In the Linux version of Firefox, I also use the NoScript and Adblock Plus extensions. Of course, when using the Linux computer, I am normally logged in under under my user name, with the limited privileges which go with it. Like most Linux users, I do not run as root all the time. When I temporarily need more privileges I use sudo.
  
  I am not a computer expert. I am just someone who uses both Linux and also Windows XP on my two computers at home.
  
  http://esecurityplanet.com/features/article.php/3842331/Sandboxie-Blocking-Web-Based-Malware-From-Your-PC.htm
10. Re:So this just shows, that you can't relax. by Stray7Xi · 2010-03-20 11:18 · Score: 1
  
  The ubuntu version of sandboxie is apparmor. You can install apparmor-profiles that include profiles for a lot of apps.
  https://help.ubuntu.com/community/AppArmor?action=fullsearch&context=180&value=linkto%3A%22AppArmor%22
  
  Since Ubuntu 9.10 (Karmic), AppArmor ships with a profile for Firefox which is disabled by default.
  You can enable it using the following command:
  sudo aa-enforce /etc/apparmor.d/usr.bin.firefox-3.5
11. Re:So this just shows, that you can't relax. by fluffy99 · 2010-03-20 12:31 · Score: 1
  
  I'd be interested in knowing what options are available for similarly hardening Windows. What I'd really like to see is for the average system to become difficult enough to compromise that there is no longer fertile ground for automated attacks and the botnets that follow. I think that's achievable too, if we really wanted to do it.
  You could start with using the features already provided in Windows http://technet.microsoft.com/en-us/library/cc507874.aspx and http://www.microsoft.com/downloads/details.aspx?familyid=A3D1BBED-7F35-4E72-BFB5-B84A526C1565&displaylang=en.
  The nice part is that almost all of the security settings are trivially deployed via Active Directory and GPOs. Deploying Linux security settings in a corporate environment generally involves rolling your own scripts and distribution methods.
  I'm not saying Windows doesn't have room for improvement in the realm of security. On the contrary, there are tons of hardening features and settings in Windows but most are turned off by default for compatibility reasons (or really annoying like the Vista default implementation of UAC).
Planning? It's not enough! by bogaboga · 2010-03-20 04:26 · Score: -1

I am afraid, just planning for a fix isn't enough. Saying definitively that a fix will be available is more useful.
You might ask why:
Because plans are notorious for remaining just that. That is, plans.
1. Re:Planning? It's not enough! by Anonymous Coward · 2010-03-20 04:38 · Score: 0, Informative
  
  RTFA. The fix is already there in beta version of Firefox 3.6.2. They're QA-ing it.
2. Re:Planning? It's not enough! by maxume · 2010-03-20 04:40 · Score: 5, Informative
  
  Are you being intentionally ridiculous?
  The fix is in the latest beta release already, that binary is slated to be the release candidate, and if testing goes well, it will be the release.
  
  --
  Nerd rage is the funniest rage.
3. Re:Planning? It's not enough! by Athanasius · 2010-03-20 04:42 · Score: 4, Informative
  
  As someone else already quoted:
  
  Mozilla already has released a beta build of Firefox 3.6.2, which contains the fix for the unpatched vulnerability
  You can already go and download that 3.6.2 beta if you want, I did.
  The 'planning' is about the data of 3.6.2's release, not whether or not it will have this fix included.
4. Re:Planning? It's not enough! by DutchUncle · 2010-03-20 05:16 · Score: 1
  
  Why isn't this a little easier to find on their site???? Search for 3.6.2 and find nothing!
5. Re:Planning? It's not enough! by thetoadwarrior · 2010-03-20 05:33 · Score: 0
  
  It may already be released. I've had an update pushed through to all my instances of Firefox this week. If not, just over a month is better than some company's records for getting a fix out.
6. Re:Planning? It's not enough! by maxume · 2010-03-20 05:42 · Score: 1
  
  Because it is a beta. They don't want to support the people who can't find it on their own.
  
  --
  Nerd rage is the funniest rage.
7. Re:Planning? It's not enough! by moteyalpha · 2010-03-20 05:47 · Score: 1
  
  There appears to be a critical vulnerability in your logic and why did you not fix it before you posted? Were you not aware of it? Did you not research the problem and preview before submitting a solution? As a result, you created a second and worse vulnerability.
  As others have pointed out, there is already a patch and I have looked at it myself.
8. Re:Planning? It's not enough! by ClosedSource · 2010-03-20 05:59 · Score: 1
  
  Hiding the patch doesn't really make any sense. I suspect they just didn't want to do the work to make its location more obvious.
9. Re:Planning? It's not enough! by TheRaven64 · 2010-03-20 06:02 · Score: 1
  
  They'd rather support people who were exploited because they were running the vulnerable version?
  
  --
  I am TheRaven on Soylent News
10. Re:Planning? It's not enough! by maxume · 2010-03-20 06:16 · Score: 1
  
  Do you have any evidence of this exploit being used in the wild?
  (Of course, I was mostly being a jerk in my previous comment, but it really isn't that shocking that they are following their standard release procedure here)
  
  --
  Nerd rage is the funniest rage.
11. Re:Planning? It's not enough! by Anonymous Coward · 2010-03-20 07:58 · Score: 0
  
  How was they going to support them, anyway? Send flowers as a "sorry" gift?
12. Re:Planning? It's not enough! by powerspike · 2010-03-20 10:12 · Score: 1
  
  The fix is in the latest beta release already, that binary is slated to be the release candidate, and if testing goes well, it will be the release.
  It doesn't count until it's publicly released, Otherwise the majority of the browsers are still not patched...
13. Re:Planning? It's not enough! by innocent_white_lamb · 2010-03-20 20:08 · Score: 1
  
  No Linux/x86_64 version is available there...
  
  --
  If you're a zombie and you know it, bite your friend!
Someone enlighten me by mrsteveman1 · 2010-03-20 04:36 · Score: 3, Insightful

Why are companies so unwilling to micro-patch their software? If Mozilla has a fix NOW, why are they waiting another ~2 weeks to push it out with the next minor upgrade? Just to avoid making users upgrade too often?
1. Re:Someone enlighten me by marcansoft · 2010-03-20 04:39 · Score: 2, Informative
  
  QA. New releases need to go through QA anyway to make sure they haven't botched anything up.
  Usually the release process for a large piece of software requires a certain degree of human interaction (anywhere from light to extreme), and there's always the possibility that something will mess up, even if the bugfix itself is perfectly trivial or safe.
2. Re:Someone enlighten me by oldhack · 2010-03-20 04:40 · Score: 1
  
  Uhh... cuz it takes time to write and test patches and not add more (security) bugs?
  
  --
  Fuck systemd. Fuck Redhat. Fuck Soylent, too. Wait, scratch the last one.
3. Re:Someone enlighten me by thetoadwarrior · 2010-03-20 05:36 · Score: 1
  
  When a flaw is found they have to find how to fix it, write the code to fix it and the test it (so they're not left with a flaw due to the fix) and that isn't just a case of opening Firefox on one computer. They have numerous versions to test for.
  
  I'm not sur eif the fix was pushed out already because this week I've have updates cropping up for all my instances of Firefox at home and work. So either they're early or I'll get another one on the 30th. Either way, they're clearly doing their best.
4. Re:Someone enlighten me by eulernet · 2010-03-20 05:46 · Score: 1
  
  I guess that it's because it costs a ton of bandwidth (and thus money) to make a patch available.
  Mozilla's patch system is pretty ugly, since it needs to download 3 megabytes for a few bytes changed.
  And NO, it doesn't have anything to do with validating the patch, since it's very easy to check that the behaviour doesn't change, especially when the impact is very small.
  Microsoft uses the "we need some time to check the patch" because they have to maintain a lot of differents versions of their OS.
5. Re:Someone enlighten me by Anonymous Coward · 2010-03-20 05:49 · Score: 0
  
  QA. New releases need to go through QA anyway to make sure they haven't botched anything up.
  QA? WTF is that? Nobody does QA any more... if it compiles, ship it!
6. Re:Someone enlighten me by TheRealSlimShady · 2010-03-20 05:52 · Score: 1
  
  But surely a 3MB patch is still less than the entire browser download - so therefore less bandwidth?
7. Re:Someone enlighten me by Anonymous Coward · 2010-03-20 05:53 · Score: 0
  
  This is one of the funniest things about Firefox. A minor update, from say 3.6.1 to 3.6.2, is still significantly larger in size than a full download of the latest version of Opera. And what's funnier is that Opera is still more capable than Firefox, runs faster, and uses significantly less memory.
8. Re:Someone enlighten me by The+MAZZTer · 2010-03-20 06:12 · Score: 2, Insightful
  
  Because the fix could break other things, or even not actually fix anything or fix the security vulnerability completely, or even cause a different security vulnerability (possibly worse).
  Testing is important, especially when you want to attract users, not drive them away. Unstable software will do that.
9. Re:Someone enlighten me by bunratty · 2010-03-20 06:44 · Score: 2, Informative
  
  If the vulnerability were publicly (fully) disclosed, perhaps Mozilla would rush a fix out the door. As far as I know, there has been limited disclosure of the vulnerability to only a few parties, and I haven't heard that the vulnerability is being exploited.
  
  --
  What a fool believes, he sees, no wise man has the power to reason away.
10. Re:Someone enlighten me by Hurricane78 · 2010-03-20 06:59 · Score: 1
  
  In Linux world, it’s normal that the packages you get via your package manager have custom patches in them. So we get the fixes ASAP anyway. (Of course Windows, being the Playmobil OS that is is, lacks a general package manager.)
  But I also wonder why they don’t just shove the minor updates in patch form trough their update functionality. Just like addons can get updated every time you start Firefox. It would be what? A a couple of bytes?
  
  --
  Any sufficiently advanced intelligence is indistinguishable from stupidity.
11. Re:Someone enlighten me by mrsteveman1 · 2010-03-20 07:08 · Score: 1
  
  Yes, i know.
  I'm asking why companies insist on patching 20-30 things all at the same time, surely it is easier to test for regressions when you're only including a single patch? Why can't you patch, test, release, and move on to the next problem?
  Isn't this what MS does with their micro-patch KB fixes?
12. Re:Someone enlighten me by wampus · 2010-03-20 07:44 · Score: 0, Flamebait
  
  And what's funnier still is that no one likes Opera or really gives a fuck about it.
13. Re:Someone enlighten me by Anonymous Coward · 2010-03-20 11:15 · Score: 0
  
  The 200 million Europeans who use Opera prove you wrong. The 300 million Asians who use Opera prove you wrong. Yeah, that's right. There are more Opera users than there are Americans.
14. Re:Someone enlighten me by fluffy99 · 2010-03-20 12:36 · Score: 1
  
  If the vulnerability were publicly (fully) disclosed, perhaps Mozilla would rush a fix out the door. As far as I know, there has been limited disclosure of the vulnerability to only a few parties, and I haven't heard that the vulnerability is being exploited.
  You mean like having an automated exploit tool published 1-1/2 months ago? https://forum.immunityinc.com/board/thread/1161/vulndisco-9-0/
15. Re:Someone enlighten me by Anonymous Coward · 2010-03-20 18:38 · Score: 0
  
  665KB (http://releases.mozilla.org/pub/mozilla.org/firefox/releases/3.5.8/update/linux-i686/en-US/) is significantly larger than 9MB? Does Opera have a reality distortion field built in or something?
16. Re:Someone enlighten me by breser · 2010-03-21 00:05 · Score: 1
  
  I interviewed with Mozilla a few years back when they were looking for a Release Engineer. I think you underestimate the amount of work that goes into producing a release. Firefox is released in 70+ languages for 3 platforms. On top of this they release upgrade versions and not just full binaries, which of course is different for each platform. So you're looking at around 420+ different versions. There are also branded versions as well, which adds even more versions.
  This was a few years ago and they were looking to bring in another Release Engineer, do more automation with the goal of reducing their release turn around time. So I don't think it's as easy as "Why don't they just do more releases."
17. Re:Someone enlighten me by mrsteveman1 · 2010-03-21 02:54 · Score: 1
  
  Right, but isn't the end result of the way they do things right now, an increase in the time between disclosure and patching of critical security vulnerabilities?
18. Re:Someone enlighten me by wampus · 2010-03-21 04:02 · Score: 0, Offtopic
  
  There are more beetles grubbing in shit, too. Do you have a point?
19. Re:Someone enlighten me by breser · 2010-03-21 13:05 · Score: 1
  
  First of all I think you need a timeline to help you understand how this vulnerability was handled:
  Feb 1st, 2010: VulnDisco is updated with a zero day exploit for Firefox 3.6. No details on how the exploit works are provided. The exploit is only available in binary form when you buy a copy of VulnDisco. Some people buy VulnDisco and have difficulty in making the exploit work. https://forum.immunityinc.com/board/thread/1161/vulndisco-9-0/
  March 16th, 2010: First 3.6.2 nightly builds that contain a fix are made available: https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/3.6.2-candidates/build3/
  March 18th, 2010: Mozilla announces that the original discoverer of the problem provided them sufficient details to find and fix the vulnerability. They also link to the nightlies linked to above on the March 16th entry. http://blog.mozilla.com/security/2010/03/18/update-on-secunia-advisory-sa38608/
  March 30th, 2010: Scheduled release date.
  Assuming that they got the details on the 16th and actually came up with the fix the same day (which is probable), that's a 2 week turnaround. Given that there have been no further nightlies posted for 3.6.2 since the March 16th it seems pretty clear they're in the release stages of getting 3.6.2 out of the door.
  I'm not really sure how you expect them to get it out sooner. The largest delay here is them getting the information they needed to fix it. Which accounted for a month and a half worth of time.
  Should they work at reducing the lag between having the fix done and putting out releases. Yes and based on my interview there serveral years ago they were committed to doing just that. But there's still an awful lot of work that has to go into actually doing those releases. They don't just magically appear.
20. Re:Someone enlighten me by tlhIngan · 2010-03-22 02:50 · Score: 1
  
  Yes, i know.
  I'm asking why companies insist on patching 20-30 things all at the same time, surely it is easier to test for regressions when you're only including a single patch? Why can't you patch, test, release, and move on to the next problem?
  Isn't this what MS does with their micro-patch KB fixes?
  Because you'd be running the test case 20-30 times? And people really, really, really hate updating their software hourly?
  That means for each patch they have to go through a whole release test of the software, which even though there's lots of volunteers, still takes a long time and a lot of effort to do. Do it 20-30 patches at a time, and you only really have to do the testing once. If you find a regression, a binary search of the patches applied will get you the problematic patch.
  There's a lot more to releasing a product than "it compiles, ship it!"
21. Re:Someone enlighten me by AmiMoJo · 2010-03-22 05:28 · Score: 1
  
  Surely the QA should not take that long though. There are plenty of people willing to test the code.
  Microsoft uses the excuse that they need to test every language on every OS version in every configuration but what is worse - breaking the Hungarian version on Windows XP SP2 or leaving everyone with an unpatched critical vulnerability for weeks?
  
  --
  const int one = 65536; (Silvermoon, Texture.cs)
  SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
22. Re:Someone enlighten me by Anonymous Coward · 2010-03-22 06:10 · Score: 0
  
  Yes, i know.
  I'm asking why companies insist on patching 20-30 things all at the same time, surely it is easier to test for regressions when you're only including a single patch? Why can't you patch, test, release, and move on to the next problem?
  Isn't this what MS does with their micro-patch KB fixes?
  Reason one: Because 20 regression tests for one patch each is much more expensive than one regression test for 20 patches. Even if the tests are mostly automated.
  You need to test everything in a regression test, even if it isn't obviously affected. (Because no one knows how to code large systems correctly the first time, every time.)
  Reason two: Users don't want a new patch every day.
23. Re:Someone enlighten me by BZ · 2010-03-24 17:27 · Score: 1
  
  > Just to avoid making users upgrade too often?
  Yes. The typical monthly Firefox minor update ships on the order of 30-100 fixes depending on the month (security problems, stability problems, compat problems, etc). Micro-patching would involve 1-3 upgrades a day.
  If the upgrade could happen silently and without any user notification (which is what Chrome is working and and what Mozilla would like to get to), that may be acceptable. But even just telling the user three times a day "hey, I just updated" is a deal-breaker.
24. Re:Someone enlighten me by BZ · 2010-03-24 17:29 · Score: 1
  
  > There are plenty of people willing to test the code.
  Are there? The number of people testing your typical Firefox minor release is about an order of magnitude lower than the number of people testing bleeding-edge Firefox trunk last I checked. And it's at least two orders of magnitude lower than the number of people testing a major release beta.
  If you talk to the Mozilla QA and release folks, one of their big problems is in fact the lack of minor release testers...
OMFG by Anonymous Coward · 2010-03-20 04:39 · Score: 0, Flamebait

OMFG, it's a critical vulnerability and it takes ONE month for them to fix. Those dogs of redmond... That's the advantage of OS. An open source project would have issued a fix in one day....oh wait...
1. Re:OMFG by wizardforce · 2010-03-20 04:58 · Score: 4, Insightful
  
  Mozilla is aware of the claim of a zero-day in Firefox as posted here: http://secunia.com/advisories/38608/. We cannot confirm the report as we have received no details regarding the reported vulnerability, such as a proof-of-concept or steps to reproduce. We’ve attempted to contact the researcher who discovered the issue but have not received a response.
  Secunia: omfg Firefox has a vulnerability!!!
  Mozilla: ok so what are the specifics?
  Secunia: ...
  Mozilla: Hello?
  Secunia: ...
  Mozilla: Anyone?
  Secunia a few days ago: Right then... here are the details...
  Mozilla: *patched beta*
  
  --
  Sigs are too short to say anything truly profound so read the above post instead.
2. Re:OMFG by Securityemo · 2010-03-20 05:48 · Score: 1
  
  Of course. You have to build up the correct suspension first, if you're not going the "surprise proof-of-concept 05.00 in the morning" route. It's just how these things are done.
  People just have no respect for good professional showmanship.
  
  --
  Emotions! In your brain!
3. Re:OMFG by recoiledsnake · 2010-03-20 06:08 · Score: 2, Insightful
  
  Maybe it was more like this:
  Secunia: omfg Firefox has a vulnerability!!!
  Mozilla: ok so what are the specifics?
  Secunia: ... (puts it on black hat exploit auctions)
  Mozilla: Hello?
  Secunia: ... (sells it to the highest bidders)
  Mozilla: Anyone?
  Secunia a few days ago: Right then... here are the details... (Milked it enough)
  Mozilla: *patched beta*
  
  --
  This space for rent.
4. Re:OMFG by Anonymous+Brave+Guy · 2010-03-20 06:09 · Score: 1
  
  I love the way you implicitly assume that exactly the same problems don't apply to Microsoft/IE, or any other browser development team.
  Did you realise that you are the guy the grandparent post was mocking?
  
  --
  If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
5. Re:OMFG by Anonymous Coward · 2010-03-20 09:09 · Score: 0
  
  Mozilla has earned the benefit of the doubt.
  Microsoft has a proven track record of ill will, negligence and general contempt for its customers. Therefor it is generally met with suspicion and distrust and has to proof there case every time because of it.
  Karma is a bitch.
6. Re:OMFG by petermgreen · 2010-03-20 12:32 · Score: 1
  
  Mozilla has earned the benefit of the doubt.
  Microsoft has a proven track record of ill will, negligence and general contempt for its customers. Therefor it is generally met with suspicion and distrust and has to proof there case every time because of it.
  Karma is a bitch.
  I dunno I don't think they are as bad as MS but i'm not sure I trust either the firefox codebase or the mozilla guys.
  The memory "leak" saga and the fact that afaict they don't treat all crash bugs as high priority becausue they are potential vulnerabilities (until you figure out what causes a crash you don't know if it's exploitable) don't exactly inspire confidence. Neither does delaying an exploit to the next regular release rather than adding the fix to the latest current release and making release ASAP specifically for the security update.
  
  --
  note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
Right by Anonymous Coward · 2010-03-20 04:59 · Score: 0

Because if this was IE, the bug would already be patched in what is a beta release... oh no. IE takes months if not years to patch holes in production releases.
MS fanboy's, always miss those tiny details for some reason.
Updating... how to? by Anonymous Coward · 2010-03-20 05:50 · Score: 0

Which distro would make it easier to update FFox and other apps?
I've used the rpm ones and rpm Uvh is somewhat easy; repositories are not that immediate though and dependence is not always simple to solve.
Ubuntu has well-maintained repositories and apt-search/apt-get makes ones life so easy -- except when you find you can't get the last FF. I installed the last one once, only to see it returned to the version present in the official repositories.
And there's always the problem of binary availability... not that compiling is that frightening -- but regarding binaries, it's either Fedora or Debian/Ubuntu.
To further complicate matters, I don't want Gnome...
And what happened to distro-agnostic packaging?
1. Re:Updating... how to? by Bambi+Dee · 2010-03-20 08:20 · Score: 3, Informative
  
  When I go to mozilla.com, a big green button offers me a .tar.bz2 with a distro-agnostic Firefox binary. Isn't that what you mean?
2. Re:Updating... how to? by Anonymous Coward · 2010-03-20 13:35 · Score: 0
  
  > When I go to mozilla.com, a big green button offers me a .tar.bz2 with a distro-agnostic Firefox binary. Isn't that what you mean?
  Thanks for the info. Maybe I'm a little dense and was looking for rpms or debs -- the fact of matter is that I didn't see that... Nice heads-up, btw.
  Now, my question was a little more far reaching; I know it's asking much but I suppose autopackage and alien are tools which would help us all...
  
  What would be really cool would be having a distro-independent format which could be adapted on-the-fly by distro-specific installers during the installation process.
  So any developer would have an easy path to offer a binary version of an application.
  Easy as in nobrainer.
3. Re:Updating... how to? by badkarmadayaccount · 2010-03-21 10:33 · Score: 1
  
  Include support for foreign resources in ELFs in the kernel, along with VFS directives for presenting the resources, and soft link all the compile time options (probably needs LLVM) in to one binary, just store the diffs, that don't have to be recalculated every time.
  
  --
  I know tobacco is bad for you, so I smoke weed with crack.
It's not fixed until it's QA'd by ClosedSource · 2010-03-20 05:53 · Score: 1

So you can get the untested version now which may or may not fix the vulnerability and potentially botch-up your system. This is better than waiting until March 30th in what way?
1. Re:It's not fixed until it's QA'd by CyberDragon777 · 2010-03-20 08:02 · Score: 1
  
  Supporting Firefox by beta testing it?
  
  --
  We both said a lot of things that you are going to regret.
Why Mozilla should be implemented in Java or... by Paul+Fernhout · 2010-03-20 06:00 · Score: -1, Flamebait

This is why Mozilla should be implemented in Java, Smalltalk, Lisp, OCaml or a similar system. I don't know enough about this particular vulnerability to say if it would make a difference, but in general any garbage-collected language without obvious pointer indexing and with built-in array index checking is going to have a lot fewer low level security problems like buffer overruns or duplicate deallocations and so on that can lead to malicious code execution... Is the slight speed boost from a language like C++ worth all the extra security issues at this point, now that we have such fast computers? And with manual memory allocation and deallocation, sometimes code written in C++ can be slower than a language that takes care of it for the programmer in an optimal way... As a reminder:
http://en.wikipedia.org/wiki/Greenspun's_Tenth_Rule
"Any sufficiently complicated C or Fortran program contains an ad hoc, informally-specified, bug-ridden, slow implementation of half of Common Lisp." (or Smalltalk or some other languages...)

--
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
1. Re:Why Mozilla should be implemented in Java or... by Anonymous Coward · 2010-03-20 06:17 · Score: 0
  
  And why they should use crayons instead of pencils.
2. Re:Why Mozilla should be implemented in Java or... by shovas · 2010-03-20 06:37 · Score: 1
  
  There are serious pros and cons one has to weigh choosing an implementation language for a project on the scale and the types of requirements that firefox has. I'm pretty sure your only serious contender in the list was Java and it has significant baggage all of its own. I'll take C/C++, I just wish programmers had a passion for better code in all of its aspects including the ever present yet most fundamental buffer overflow bugs.
  
  --
  Selah.ca. Pause, and calmly think on that.
3. Re:Why Mozilla should be implemented in Java or... by Paul+Fernhout · 2010-03-20 14:07 · Score: 1
  
  I can't believe my first comment got modded down twice as flamebait; slashdot has really descended technically, apparently, to judge so poorly what is a serious technical comment by someone who has been programming for about thirty years (and who even taught C at the university level and has used C++ extensively in the past, including at IBM Research).
  So sad to put a little performance (and questionably) these days ahead of security as well as ease of programming, extendability, and maintainability.
  While I agree with the wish that more programmers cared about better code, I also wish most programmers had a passion for better tools. :-)
  
  --
  A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
4. Re:Why Mozilla should be implemented in Java or... by shovas · 2010-03-20 15:36 · Score: 1
  
  I majored in java (and I really do love java) but I now work in perl. So, certainly, it sounds like you'd be in a better spot to judge what would be the best implementation language. Also just noticed your low uid!
  You really think firefox should've been developed in java? I would've thought it would be problematic for that type of project that needed portability, minimal footprint (no jvm), and perhaps lack of an environment that might promote over-engineering?
  Like I said, you have the experience, you really think it should've been developed in java even with all of its considerations?
  
  --
  Selah.ca. Pause, and calmly think on that.
5. Re:Why Mozilla should be implemented in Java or... by Paul+Fernhout · 2010-03-21 07:09 · Score: 1
  
  A lot of these issues are relative to your priorities and also technical change. What does "minimal footprint" mean these days on eight core Mac Pro with tens of Gigabytes of memory, and where most of the memory is used by cached pages of a web browser, not the application itself? There is a value to Firefox being in C++ from the standpoint of it being embedded somehow in other C++ applications (including embedded software) -- although, on the flip side, it makes it difficult to embed it in Java applications (and there are embedded JVMs with small footprints, and you can even compile Java code to run without a JVM). Years ago, when Java was not free-as-in-freedom, it would have been a problematical issue to use Java (and that would have been a tough choice, to plan for the future, making guesses); there were Java browsers, but they were never developed fully (Sun has a widget with limited functionality as part of the Java SDK, and they also had the "HotJava" browser, though that was slow at the time (1994) due probably mostly to JVM issues and also memory limits on older machines).
  http://en.wikipedia.org/wiki/HotJava
  Many years ago, Lisp with some domain specific languages on it might have been a better choice back then (compiled Lisp can sometimes even be faster than C is some dynamic applications, and many web pages are very dynamic), or a Smalltalk like VisualWorks (though that was commercial, but there was a moment when it was sold for a song, and there was also a moment when Squeak might have become a popular free system). Still, even years ago there were free-as-in-freedom JVMs from other sources that could have been improved as part of the Mozilla effort.
  But that is all rewriting history. Mozilla is in C++, and that's what the people who maintain it are most comfortable with.
  The issue is that going forward, does security trump some issue of run-time performance or comfort of the maintainers? I'd say yes, security is more important at this point, especially since something like the JVM can also run multiple languages (like Scala or Jython) which allows a diversity of coding styles for add in modules, and the JVM (as with Android) can be tailored to provide firewalls between different web pages (sort of like Google is doing with Chrome having a different process for ever web page). Is Mozilla going to switch to using the JVM at this point? Unlikely. But this does suggest that Firefox's days are numbered... Maybe in years, but still one can see the train at the end of the tunnel. :-) Ultimately, someone could translate the core algorithms of FireFox to something like Java (perhaps even with a one click tool someday :-), and then for the average desktop user, it would be foolish to use the C++ version because of the security issues. Yes, there would be terrible social issues about forking and so on. Still, Java code can have security issues, as can the JVM, so nothing is going to replace testing and vigilance.
  Here is the first Google result right now for a Java Web Browser:
  http://lobobrowser.org/java-browser.jsp
  "Lobo [download] is an open source web browser that is written completely in Java. Lobo is being actively developed with the aim to fully support HTML 4, Javascript and CSS2. Lobo also supports direct JavaFX rendering. The general goal of the Lobo browser effort is to produce a browser that is fast, complete, easy to extend, feature-rich and secure."
  So people are doing it... It's only a matter of time...
  As they write there:
  """
  Why a Pure Java Browser?
  There are a number of advantages to be derived from a browser that is written in Java as opposed to a language compiled into native code, namely:
  * Security.- In principle, a Java program is less suceptible to certain types of vulnerabilities such as a buffer overflow attack. Java's security model ca
  
  --
  A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
fixed... by uolamer · 2010-03-20 06:07 · Score: 1

Alternatively, users can download Release Candidate builds of Firefox 3.6.2 which contains the fix from here:
https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/3.6.2-candidates/build3/

--
s/©//g
1. Re:fixed... by camperslo · 2010-03-20 07:01 · Score: 2, Informative
  
  The 3.6.2 beta has worked fine for me, but those uncomfortable with that and not willing to wait can avoid the bug by using a 3.5x version. The vulnerability is only in 3.6 series releases.
2. Re:fixed... by jonadab · 2010-03-20 12:07 · Score: 1
  
  > The vulnerability is only in 3.6 series releases.
  
  I should be fine, then. I downgraded to Firefox 2 after I got tired of losing data (specifically, open tabs) to two different bugs that were introduced in 3.0 and are still present in 3.6.
  
  Maybe Firefox 4 will be better...
  
  --
  Cut that out, or I will ship you to Norilsk in a box.
Something's already botched... by Anonymous Coward · 2010-03-20 06:49 · Score: 0

Seeing as how something's already botched up, QA seems like a moot point...
Rediculous Memory Consumption by CranberryKing · 2010-03-20 07:22 · Score: 0, Offtopic

I thought rats got in my computer and ate my sdram module, then I discovered it was just FF 3.6. Seriously, anyone one else having a huge memory gobbling problem with this?
The REAL question is, by Runaway1956 · 2010-03-20 07:27 · Score: 1

"But, does it run on Linux?"
Hey, if the damned exploit won't run on Linux, then it's not a real exploit, is it? This kind of thing kinda pisses me off. There are all KINDS of neat software out there, that just won't run on Linux. It's definitley not fair. I think it might even be illegal. In today's modern world, no one is supposed to be excluded from anything. Not even nerds!!

--
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
Recommendation by iPhr0stByt3 · 2010-03-20 09:30 · Score: 0, Redundant

In other news, several security bigwigs have recommended using IE or Opera until 3.6.2 is released... wait, no... as the faulty product is not from MS, we don't care... keep using FireFox.
IE6 by Anonymous Coward · 2010-03-20 10:09 · Score: 0

Luckily I'm still using IE6.
Though it wasn't presented to me in EU's browser choice, I was able to prevent any other browser to infect my system with their buggy code.
Whew!!! by Anonymous Coward · 2010-03-20 12:07 · Score: 0

Good thing I'm using IE6.
Damn youtube made me upgrade. by ImYourVirus · 2010-03-20 17:10 · Score: 1

Fuck I just upgraded too, like a week or so ago. =\

--
Why is common sense called that if it's not common?
See the problem? by Anonymous Coward · 2010-03-21 01:07 · Score: 0

This post is one serious candidate for removal.
And the least offending part is the word nigger; people should not be enraged by the use of such a word.
The real problem is using common words for racial slur.
Funny thing, one can read the entire post replace the word nigger with "car" or "cellphone". It works the same, because all the text is made-up anyway...