Slashdot Mirror
Mozilla Issues Fix For Firefox Zero-Day Bug
An anonymous reader writes: Thursday night Mozilla released a Firefox security patch after finding a serious vulnerability that allows malicious attackers to upload files from a user's computer. The update was released about 24 hours after Mozilla learned of the flaw. In a blog post, Mozilla said, "a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine. This morning Mozilla released security updates that fix the vulnerability. All Firefox users are urged to update to Firefox 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1."
I thought the consensus here was that open source software was secure? Why do the events of the past year make it appear as if they're as bad or worse?
Since this exploit uses an interaction between javascript and Firefox's built-in PDF viewer, it sounds like this doesn't affect people running NoScript. But what about people who don't use the built-in PDF viewer? e.g., if clicking on a PDF file opens the usual "download/open file" dialog, will the exploit still work?
Use Firefox? lolwut? Why would anyone still use that bloated, insecure crap?
Part One: Driven To Tears
January 17, 2015
I begin here my testimony and testament to that fateful night. A word aside, I’m consulting the bartendress I’ve come to know and trust after witnessing that night’s events. This blog therefore suffers no bias, and the spectacular events have two to confirm. It began a night like any other. I was out at a club in my home town of Liverpool with my girlfriends, and we were feeling a little fruity and looking for fun. That was what we were hoping for. But it was quite the opposite. I was lured into His trap like a starling being lured into a hornet’s nest by the pheramoans and entroncing drone of the hornet. It was the most botched encounter of my life. I feel used, I feel abused, and I am not amused.
Wrapped Around Your Finger
He was my childhood idle. At age fifteen, I saw him in concert. I saw him looking right at me in the crowd. Did he want me? Another glance, yet another glance, and then another! How could he see me so far back in the general stands. I did not know, but I knew if I persisted, I had a chance. It was not until the next year that I was able to see him closely. I’d arranged to find the spot after the show as his band went on tour again. Perfectly, Sting walked by and I tried to get his autograph. I was well made up and easily the prettiest girl in the crowd if not prettier. I’m a tree-like 180cm to begin with and was wearing platforms, so he couldn’t miss me. And that he didn’t. I was standing like a guard in a watch tower, looking down upon all the people, and we made genuine eye contact for at least a minute as he walked down the hall back to the dressing rooms. I tried to get his autograph, but he continued walking. He was going to be harder to get than I wanted to admit.
Bring On The Night
I never again saw Sting until the Fateful Night. My girlfriends and me were wildly into Dub Step and we were dancing on the dance floor. We grinded upon each other and were having a jolly time getting the younger blokes’ attention spans. Some of them were pretending to ignore us and payed attention to the women they were with. The night wound on and on and we got a little squiffy. The world was starting to lighten up and everything everyone said was fun and humourous. This is when I got Stung.
He entered the room wearing a bath robe over tank top and a boxer’s shorts. He had a toothbrush or a cigar in his mouth and walked over to the counter and ordered a drink. I new that look from everywhere. Even at this age, he couldn’t hide it. That cute boyish mischevious look. He looked directly at me. I knew this was finally my chance decades later. I walked up and tried to sound smart and said “Guten Tog”. He laughed and said “That’s Guten Abednego, mine hair, but the pleasure is mine. Sting’s the name. I’m.Sting.. What’s yours, my dear? Franken Zee Doitsch!” I was awestruck! It WAS Sting and he sounded quite educated to correct me on such a foolish attempt at German.
Sting told me that he was in the club for his evening drink, a refined concoction consisting of lapsang soushong tea, stout, scotch, and I think Irish cream. There was some kind of cream in there. And now knowing His tastes, I would not be surprised if he’d ordered that with a side of battery acid and liquid air freshener or even stagnant pond water. Anyway. Sting was very chatty. He bought me a shot. He called it the Sting’s specialty or something like that, but it was a simple neat shot of American whiskey. I was to drink it immediately. Then he ordered me another drink. He told me to drink that more slowly and was just testing my reflexes. We both laughed as we looked into his eyes.
He shared with me the news of his recent accomplishments. He had been working on a new movie about dragnet operations and was supposedly to become the host of a television programme featuring poisonous insects. He explained how he was still the Frank Lloyd Wri
Debian Stretch vunerable
security-tracker.debian.org/tracker/CVE-2015-4495
I told you I told you I told you. Seriously go back to when it was announced on slashdot and i very specifically said this will be nothing but an additional attack vector.
As soon as i updated to the version which had it i immediately set it to never activate knowing this would happen eventually and have never used it since.
Latest version in the esr channel seems to be 31.8.0? My firefox installation shows version 31.8.0 in the About window, says that I am on the esr update channel and that there are no further updates. If the latest release is Firefox ESR 38.1.1, how did I miss all the releases in between?
Without Firefox, I don't think I could actually ENJOY the internet anymore. No other browser allows you to tame the net like Firefox and the world of plugins that have been written.
As mentioned on Hacker News, by the person who discovered this security vulnerability, Mozilla issued a fix in about 16 hours!
If you are exhausted of the struggle and just want to make real money from the comfort of your home look no further because that is exactly what you will be doing once you get started with Automatic Lead Tools. Do you want a Home Based business that is growing every day? I’m looking for people that want to earn an extra income using Automatic Lead Tools, Automatic Lead tools provides products that every marketer and business owner could really benefit from. Learn to be profitable in whatever you do in life. Staying positive and staying away from the negativity will help you in your business & life. Take inbound calls from home. Earn $400 Per Sale Instantly if interested please do call me on (888) 780-9464 or (310) 299-2807 Or visit our website www.LeadToolsGlobal.net
Open source just lowers the bar for others to both contribute to this, and to potentially take advantage of bugs.
You don't need source code to take advantage of bugs. Or even discover them. Almost always you do need source code to fix bugs, though.
So that would be a good argument (one of many!) for why someone would prefer to use open source software. But how much that helps with bug-fixing, depends very much on each project's regular maintainers ("upstream").
So if it's disabled by default, does the bug still occur?
Nice to see firefox giving a big "fuck you" to people still on ESR 31.8 (which is still a supported release according to the ESR roadmap)
They should have fixed the bug that caused the PDF viewer to be in there in the first place. And the bug that caused it to be on by default.
"The exploit leaves no trace it has been run on the local machine. If you use Firefox on Windows or Linux it would be prudent to change any passwords and keys found in the above-mentioned files if you use the associated programs. "
It's taken from the blog about the exploit and doesn't seem to be drawing much attention.
...from the propaganda specialists hired by some big corporation.
It would be much better folks ran Adobe Reader. NOOOT !
Now, what would people then use to view PDFs ? One of these commercialware PDF viewers, bug-ridden and with an infinite supply of zero days ? Or would they use libpoppler, chock-full of nasty C constructs like "void*" instead of proper generic programming ? Besides libpoppler and the commercialware dreck there are very few PDF renderers. Maybe you take the time to research the situation and maybe you will figure Mozilla is actually one of the more secure alternatives when it comes to renderers.
Having said that, generally cyberspace could be made much, much more secure. JavaScript and C, being often used in a shitty-typed way are both major security risks. PHP is even worse, for similar reasons.
The age of Algol, Burroughs, ELBRUS, ICL was probably more secure than the craptastic, marketing-driven IT world we have since Unix and C.
And no, not a mainframe guy, I grew up with C and HP Unix, but my intelligence allowed me to question my upbringing, so to speak.
Can we have "computer system archeology" in order to learn for a better future ???
Because Adobe is a for-profit entity, and they gotta make money somehow...
Just checked, my Firefox says it is versoin 39.0 - no third number (39.0.3), and the application itself says it is "up to date". :/
Would think that they'd include the full version-number in the About box (the place they say to go to check for updates), just so users can be 100% certain they are using the right one
There does appear to be a problem with the manual update set up. I ended up proceeding as if I were doing a fresh install: go to https://www.mozilla.org/en-US/... to download the installer and run it. When you do, and restart Firefox, About will in fact say 39.0,3.