Slashdot Mirror
Mozilla Plans Fix For Critical Firefox Vulnerability In Next Release
Trailrunner7 writes "A month after an advisory was published detailing a new vulnerability in Firefox, Mozilla said it has received exploit code for the flaw and is planning to patch the weakness on March 30 in the next release of Firefox. Mozilla officials said Thursday that the vulnerability, which was disclosed February 18 by Secunia, is a critical flaw that could result in remote code execution on a vulnerable machine. The vulnerability is in version 3.6 of Firefox."
There's a disturbing amount of "Microsoft" in this.
Ok, so, since the summary didn't make this clear and I didn't find any explanation in the article, maybe someone on Slashdot can shed some light on this. What took Mozilla so long? It's a critical vulnerability that allows remote code execution. Why did is it taking over a month to fix?
Please correct me if I got my facts wrong.
It's a critical vulnerability that allows remote code execution. Why did is it taking over a month to fix?
Answer: Further details available in Customer Area
Just because you run Firefox, you can't relax about malware attacks. Not on Windows anyway. Imagine how quickly an exploit of this type could be integrated into a malware kit, already running on countless compromised sites? No one can relax about buffer/stack smashing, dangling pointers, etc..., until there's a bulletproof safeguard against them built into the OS/processor architecture.
Emotions! In your brain!
Why are companies so unwilling to micro-patch their software? If Mozilla has a fix NOW, why are they waiting another ~2 weeks to push it out with the next minor upgrade? Just to avoid making users upgrade too often?
Are you being intentionally ridiculous?
The fix is in the latest beta release already, that binary is slated to be the release candidate, and if testing goes well, it will be the release.
Nerd rage is the funniest rage.
As someone else already quoted:
Mozilla already has released a beta build of Firefox 3.6.2, which contains the fix for the unpatched vulnerability
You can already go and download that 3.6.2 beta if you want, I did.
The 'planning' is about the data of 3.6.2's release, not whether or not it will have this fix included.
Secunia: omfg Firefox has a vulnerability!!! ... ...
Mozilla: ok so what are the specifics?
Secunia:
Mozilla: Hello?
Secunia:
Mozilla: Anyone?
Secunia a few days ago: Right then... here are the details...
Mozilla: *patched beta*
Sigs are too short to say anything truly profound so read the above post instead.
Why isn't this a little easier to find on their site???? Search for 3.6.2 and find nothing!
Because it is a beta. They don't want to support the people who can't find it on their own.
Nerd rage is the funniest rage.
There appears to be a critical vulnerability in your logic and why did you not fix it before you posted? Were you not aware of it? Did you not research the problem and preview before submitting a solution? As a result, you created a second and worse vulnerability.
As others have pointed out, there is already a patch and I have looked at it myself.
Of course. You have to build up the correct suspension first, if you're not going the "surprise proof-of-concept 05.00 in the morning" route. It's just how these things are done.
People just have no respect for good professional showmanship.
Emotions! In your brain!
So you can get the untested version now which may or may not fix the vulnerability and potentially botch-up your system. This is better than waiting until March 30th in what way?
Hiding the patch doesn't really make any sense. I suspect they just didn't want to do the work to make its location more obvious.
They'd rather support people who were exploited because they were running the vulnerable version?
I am TheRaven on Soylent News
Alternatively, users can download Release Candidate builds of Firefox 3.6.2 which contains the fix from here:
https://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/3.6.2-candidates/build3/
s/©//g
Maybe it was more like this:
Secunia: omfg Firefox has a vulnerability!!! ... (puts it on black hat exploit auctions) ... (sells it to the highest bidders)
Mozilla: ok so what are the specifics?
Secunia:
Mozilla: Hello?
Secunia:
Mozilla: Anyone?
Secunia a few days ago: Right then... here are the details... (Milked it enough)
Mozilla: *patched beta*
This space for rent.
I love the way you implicitly assume that exactly the same problems don't apply to Microsoft/IE, or any other browser development team.
Did you realise that you are the guy the grandparent post was mocking?
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
Do you have any evidence of this exploit being used in the wild?
(Of course, I was mostly being a jerk in my previous comment, but it really isn't that shocking that they are following their standard release procedure here)
Nerd rage is the funniest rage.
There are serious pros and cons one has to weigh choosing an implementation language for a project on the scale and the types of requirements that firefox has. I'm pretty sure your only serious contender in the list was Java and it has significant baggage all of its own. I'll take C/C++, I just wish programmers had a passion for better code in all of its aspects including the ever present yet most fundamental buffer overflow bugs.
Selah.ca. Pause, and calmly think on that.
"But, does it run on Linux?"
Hey, if the damned exploit won't run on Linux, then it's not a real exploit, is it? This kind of thing kinda pisses me off. There are all KINDS of neat software out there, that just won't run on Linux. It's definitley not fair. I think it might even be illegal. In today's modern world, no one is supposed to be excluded from anything. Not even nerds!!
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
When I go to mozilla.com, a big green button offers me a .tar.bz2 with a distro-agnostic Firefox binary. Isn't that what you mean?
(I'm not American so I don't have the same 'horror' of the N word BTW, round here it's the C word that's the 'uh-oh' one).
Cracker? Communist?
Here I sit, all broken hearted.
Came to poop, but only farted.
It doesn't count until it's publicly released, Otherwise the majority of the browsers are still not patched...
Mozilla has earned the benefit of the doubt.
Microsoft has a proven track record of ill will, negligence and general contempt for its customers. Therefor it is generally met with suspicion and distrust and has to proof there case every time because of it.
Karma is a bitch.
I dunno I don't think they are as bad as MS but i'm not sure I trust either the firefox codebase or the mozilla guys.
The memory "leak" saga and the fact that afaict they don't treat all crash bugs as high priority becausue they are potential vulnerabilities (until you figure out what causes a crash you don't know if it's exploitable) don't exactly inspire confidence. Neither does delaying an exploit to the next regular release rather than adding the fix to the latest current release and making release ASAP specifically for the security update.
note: i'm known as plugwash most places but i screwd up registering that here somehow in the past and now can't register
I can't believe my first comment got modded down twice as flamebait; slashdot has really descended technically, apparently, to judge so poorly what is a serious technical comment by someone who has been programming for about thirty years (and who even taught C at the university level and has used C++ extensively in the past, including at IBM Research).
So sad to put a little performance (and questionably) these days ahead of security as well as ease of programming, extendability, and maintainability.
While I agree with the wish that more programmers cared about better code, I also wish most programmers had a passion for better tools. :-)
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
I majored in java (and I really do love java) but I now work in perl. So, certainly, it sounds like you'd be in a better spot to judge what would be the best implementation language. Also just noticed your low uid!
You really think firefox should've been developed in java? I would've thought it would be problematic for that type of project that needed portability, minimal footprint (no jvm), and perhaps lack of an environment that might promote over-engineering?
Like I said, you have the experience, you really think it should've been developed in java even with all of its considerations?
Selah.ca. Pause, and calmly think on that.
Fuck I just upgraded too, like a week or so ago. =\
Why is common sense called that if it's not common?
Yeah, these copypasta trolls are tedious and annoying, but this guy is no worse than the tron fanzine guy, the library shit-eater, and the GNAA's broken Markov chain that posts the goatse links. He's just another retard.
Apart from what the SP says, that doesn't mean that hate speech laws are a good thing. Haven't you heard the saying "sticks and stones may break my bones, but words shall never hurt me"? That sort of post isn't libellous, slanderous, or defamatory, because it wouldn't actually harm anyone's opinion of either a specific black person or black people in general (anyone who would take it seriously would already believe that crap), and there is no measurable harm done by it.
Even hate crime laws are pretty silly IMO. I had this discussion with a local GLBTQ-rights activist a couple of years ago[1], in the context of a series of gay-bashings that had taken place not long before and the proper response to it. Her understanding of the problem was essentially as a public relations problem, people hate GLTBQ people so let's encourage them to like us, and if they won't we'll punish them for saying so. I saw the problem as a law and order question, people were committing assault and getting away with it, so let's have some more police in the known trouble spots (which were perfectly well known to the general community), because an arbitrary assault[2] for one reason isn't going to hurt any more or less than an arbitrary assault for a different reason. If beating someone up for fun deserves punishment X, it shouldn't matter why you thought it was fun.
To bring this back to your post, if I vandalise your building, it doesn't matter whether I did it because you are Jewish, because of sexual jealousy, becuase you are short/tall/ugly/good-looking, or just for "teh evulz", and yet hate crime laws say, in effect, that it is more legitimate to victimise someone because they are not from some special category.
[1] I actually support GLBTQ rights and whatnot, I just completely disagree about strategy with the local movement.
[2] By this I mean an assault which is not the result of an argument or motivated by anything practical (such as a mugging or a mob shakedown)
No Linux/x86_64 version is available there...
If you're a zombie and you know it, bite your friend!
A lot of these issues are relative to your priorities and also technical change. What does "minimal footprint" mean these days on eight core Mac Pro with tens of Gigabytes of memory, and where most of the memory is used by cached pages of a web browser, not the application itself? There is a value to Firefox being in C++ from the standpoint of it being embedded somehow in other C++ applications (including embedded software) -- although, on the flip side, it makes it difficult to embed it in Java applications (and there are embedded JVMs with small footprints, and you can even compile Java code to run without a JVM). Years ago, when Java was not free-as-in-freedom, it would have been a problematical issue to use Java (and that would have been a tough choice, to plan for the future, making guesses); there were Java browsers, but they were never developed fully (Sun has a widget with limited functionality as part of the Java SDK, and they also had the "HotJava" browser, though that was slow at the time (1994) due probably mostly to JVM issues and also memory limits on older machines).
http://en.wikipedia.org/wiki/HotJava
Many years ago, Lisp with some domain specific languages on it might have been a better choice back then (compiled Lisp can sometimes even be faster than C is some dynamic applications, and many web pages are very dynamic), or a Smalltalk like VisualWorks (though that was commercial, but there was a moment when it was sold for a song, and there was also a moment when Squeak might have become a popular free system). Still, even years ago there were free-as-in-freedom JVMs from other sources that could have been improved as part of the Mozilla effort.
But that is all rewriting history. Mozilla is in C++, and that's what the people who maintain it are most comfortable with.
The issue is that going forward, does security trump some issue of run-time performance or comfort of the maintainers? I'd say yes, security is more important at this point, especially since something like the JVM can also run multiple languages (like Scala or Jython) which allows a diversity of coding styles for add in modules, and the JVM (as with Android) can be tailored to provide firewalls between different web pages (sort of like Google is doing with Chrome having a different process for ever web page). Is Mozilla going to switch to using the JVM at this point? Unlikely. But this does suggest that Firefox's days are numbered... Maybe in years, but still one can see the train at the end of the tunnel. :-) Ultimately, someone could translate the core algorithms of FireFox to something like Java (perhaps even with a one click tool someday :-), and then for the average desktop user, it would be foolish to use the C++ version because of the security issues. Yes, there would be terrible social issues about forking and so on. Still, Java code can have security issues, as can the JVM, so nothing is going to replace testing and vigilance.
Here is the first Google result right now for a Java Web Browser:
http://lobobrowser.org/java-browser.jsp
"Lobo [download] is an open source web browser that is written completely in Java. Lobo is being actively developed with the aim to fully support HTML 4, Javascript and CSS2. Lobo also supports direct JavaFX rendering. The general goal of the Lobo browser effort is to produce a browser that is fast, complete, easy to extend, feature-rich and secure."
So people are doing it... It's only a matter of time...
As they write there:
"""
Why a Pure Java Browser?
There are a number of advantages to be derived from a browser that is written in Java as opposed to a language compiled into native code, namely:
* Security.- In principle, a Java program is less suceptible to certain types of vulnerabilities such as a buffer overflow attack. Java's security model ca
A 21st century issue: the irony of technologies of abundance in the hands of those still thinking in terms of scarcity.
Include support for foreign resources in ELFs in the kernel, along with VFS directives for presenting the resources, and soft link all the compile time options (probably needs LLVM) in to one binary, just store the diffs, that don't have to be recalculated every time.
I know tobacco is bad for you, so I smoke weed with crack.