Slashdot Mirror
Mozilla Issues Fix For Firefox Zero-Day Bug
An anonymous reader writes: Thursday night Mozilla released a Firefox security patch after finding a serious vulnerability that allows malicious attackers to upload files from a user's computer. The update was released about 24 hours after Mozilla learned of the flaw. In a blog post, Mozilla said, "a Firefox user informed us that an advertisement on a news site in Russia was serving a Firefox exploit that searched for sensitive files and uploaded them to a server that appears to be in Ukraine. This morning Mozilla released security updates that fix the vulnerability. All Firefox users are urged to update to Firefox 39.0.3. The fix has also been shipped in Firefox ESR 38.1.1."
Since this exploit uses an interaction between javascript and Firefox's built-in PDF viewer, it sounds like this doesn't affect people running NoScript. But what about people who don't use the built-in PDF viewer? e.g., if clicking on a PDF file opens the usual "download/open file" dialog, will the exploit still work?
Nothing is perfect. Open or closed source. What you should focus on is the manner and speed of a company's efforts to rectify any issues.
"I thought the consensus here was that open source software was secure?"
Fundamentally it is more secure, but it depends on how secure the user makes it.
You can buy the best locks for your house and bullet proof windows, but if you don't lock the door, leave the windows open and leave the spare key in plain view on the patio it really doesn't matter how secure the components are. If they are not installed or configured properly then security will be lax or non-existent.
Political correctness is really just herd psychology pushed by insecure people who desperately seek social conformity.
Because everything, across the board, is being slammed hard, be it BIOS/EFI firmware, holes like F0 0F in the CPU, open source items, closed source items, IoT devices, you name it... the amount of attacks have risen in number and sophistication by an extreme.
On Windows, your choices are:
edit: Slashdot lets us use HTML in our posts but makes bullets invisible... way to go, guys.
Not anymore.
Those people have moved on to soylentnews.org
This list isn't even exhaustive and it's far more than the 4 choices you claim are all that exist.
Care to expand on that?
It's disabled by default.
Integrated PDF reader. The code for this is still included for emergencies (i.e. when you need to read a PDF but don't have access to a reader) but disabled by default - you are always recommended to use a separate, up-to-date document reader for PDF files (as an external program, not as a browser plugin) for your own security, and to have documents displayed in their fully intended format instead of a stripped-down display in an in-browser reader.
https://www.palemoon.org/techn...
cool, .php3
I'm really going to trust that list
Cool story, brah.
I told you I told you I told you. Seriously go back to when it was announced on slashdot and i very specifically said this will be nothing but an additional attack vector.
As soon as i updated to the version which had it i immediately set it to never activate knowing this would happen eventually and have never used it since.
Links, lynx, w3m still work on cygwin.
http://validator.w3.org/check?uri=http%3A%2F%2Fwww.slashdot.org Errors found while checking this document as HTML5!
Without Firefox, I don't think I could actually ENJOY the internet anymore. No other browser allows you to tame the net like Firefox and the world of plugins that have been written.
Firefox actually uses less memory than the others
Well, open source code is no more secure than closed source. That isn't a function of the source being open or closed. You can have poorly written open source software and excellent closed source stuff.
The value of open source is the assumption that more eyes on an issue allows inevitable bugs to be found, and for potential users to inspect what they are running. Closed source would have to rely on the number of people authorized to view the code, and the customer will not be able to view the code, just the resulting functionality to evaluate its security.
In reality, however, there is no guarantee that just because there is open source, that anyone will actually *look* at that code and even less assurance that someone who is qualified to read the code will have done so. So, a distinction needs to be made between open source software with a large and active community, and open sourced software that does not have an active community. You still get a *potential* advantage from having the source to look at, but it is only a potential advantage without the community. A closed source application could overcome those potential advantages by ensuring that they have excellent customer support, and are able to insure or indemnify customers against bad results.
In any event, that is why you should never say open sourced software is simply "more secure". It isn't. And some of it is complete shit. What it does provide is the ability for a user/customer to be able to discover any issues for themselves, but *someone* has to go that extra step.
Open source just lowers the bar for others to both contribute to this, and to potentially take advantage of bugs.
You don't need source code to take advantage of bugs. Or even discover them. Almost always you do need source code to fix bugs, though.
So that would be a good argument (one of many!) for why someone would prefer to use open source software. But how much that helps with bug-fixing, depends very much on each project's regular maintainers ("upstream").
As long as the PDF reader is disabled, no.
Firefox, the bloated browser with memory leaks
Note: the memory leaks are mostly fixed by now.
"First they came for the slanderers and i said nothing."
Agreed. And this goes especially for browsers, since they're hitting a moving target.
That said, this exploit highlights the fact that Mozilla still hasn't gotten their act together on layered security. Firefox remains the only browser not to run in low integrity mode (i.e. protected mode) on Windows, so while certain plugins like Flash are sandboxed, the greater browser is not. This goes hand in hand with the fact that Firefox currently does not have the ability to run each tab/window in its own process, making it harder to sandbox malicious content, and is why a bad tab can still take down the whole browser. Heck, the UI and the content still run in the same process, making it all the easier for bad content to reach out and touch the rest of the browser and the system.
This vulnerability is an unfortunate reminder that Firefox is badly behind the curve on browser security. For the most part Mozilla is putting out fires by patching exploits, but the work on fixing the underlying issues has been much slower. The fact that in 2015 they still can't match the process isolation abilities of 2009's IE8 is a little embarrassing, and very frustrating.
Mozilla means well, and while no one is perfect they are sadly about the farthest browser vendor from it at the moment.
Yes, that's why there are no few years old bugs, right?, Sadly, the reality is other, whether you like it or not.
Is this the real person that divulged it? I ask because I can't quite figure out why we have this blog post https://blog.mozilla.org/secur... .
It backs up the version you report.
However, if you go to this page https://www.mozilla.org/en-US/... you will find that they are giving credit to an entirely different person. A security researcher named Cody Crews.
It's interesting because everyone is giving Mozilla a big slap on the back for acting so fast, yet the fact of the matter is if MSFA 2015-78 is to be believed, we actually don't have the timeline between when it was first reported until it was patched. In this scenario, all we have is the timeline between the time it was found in the wild until it was patched. That would leave me asking this; Did Mozilla put off the patch until they discovered it was in the wild already?
I have the same question - I wonder if the post should have read 31.8.1, and being ESR, the QA is just taking longer
"The exploit leaves no trace it has been run on the local machine. If you use Firefox on Windows or Linux it would be prudent to change any passwords and keys found in the above-mentioned files if you use the associated programs. "
It's taken from the blog about the exploit and doesn't seem to be drawing much attention.
You left out Safari, built by the same team that brought you iTunes for Windows so you know it's quality!
I use Macs for work, Linux for education, and Windows for cardplaying.
...from the propaganda specialists hired by some big corporation.
It would be much better folks ran Adobe Reader. NOOOT !
Now, what would people then use to view PDFs ? One of these commercialware PDF viewers, bug-ridden and with an infinite supply of zero days ? Or would they use libpoppler, chock-full of nasty C constructs like "void*" instead of proper generic programming ? Besides libpoppler and the commercialware dreck there are very few PDF renderers. Maybe you take the time to research the situation and maybe you will figure Mozilla is actually one of the more secure alternatives when it comes to renderers.
Having said that, generally cyberspace could be made much, much more secure. JavaScript and C, being often used in a shitty-typed way are both major security risks. PHP is even worse, for similar reasons.
The age of Algol, Burroughs, ELBRUS, ICL was probably more secure than the craptastic, marketing-driven IT world we have since Unix and C.
And no, not a mainframe guy, I grew up with C and HP Unix, but my intelligence allowed me to question my upbringing, so to speak.
Can we have "computer system archeology" in order to learn for a better future ???
Actually Safari and iTunes on OS X work fine, thank you very much.
I didn't think so.
Just checked, my Firefox says it is versoin 39.0 - no third number (39.0.3), and the application itself says it is "up to date". :/
Would think that they'd include the full version-number in the About box (the place they say to go to check for updates), just so users can be 100% certain they are using the right one
Free Software does tend to be based on more secure designs.
Yes, I'd say that's generally the case. I was responding more to his flat, blanket claim that "open source software was secure", which implies that open source software has no vulnerabilities, period. His comment was just a bit too trollish in my opinion.
On the other hand, pretty much everything is better than the market leader monopoly-ware product. This pretty much the way it's always been.
Some is, some isn't. Some OS applications are so much better than the commercial offerings that I often wonder how the commercial companies manage to stay in business. At the same time, there are a fair number of large OS projects that can only be described as blobs of poorly-written crap that simply don't work.
Just cruising through this digital world at 33 1/3 rpm...
There does appear to be a problem with the manual update set up. I ended up proceeding as if I were doing a fresh install: go to https://www.mozilla.org/en-US/... to download the installer and run it. When you do, and restart Firefox, About will in fact say 39.0,3.
Unless you're one of the users running into those mysterious "memory leaks" that nobody can replicate once they file an actual bug
I stopped using Firefox a couple of years ago because of this. They're not mysterious, they were real. Try opening a reasonable amount of tabs (50-100), and leave the browser open for a day or two, and you'll probably be able to reproduce it.
Counter-point: Google Chrome managed multiple processes and isolation on multiple platforms, including Windows XP, something not even Microsoft did.
Are you sure that 50 to 100 is actually a reasonable number of tabs to open? I have some blisteringly fast computers with absolutely retarded amounts of RAM and I still would find that many tabs unreasonable.
"So long and thanks for all the fish."
I actually have currently probably > 200 tabs open in my 4 or 5 Chrome windows on a 2-year old i7 with 8GB of RAM without any major issues. The fact that I only had problems with Firefox is also a good clue it's not the number of tabs (had also used Opera with the same kind of load without major issues)
Personally, I can not fathom having that many tabs open. I can think of no case where that would help me. Also, I am an Opera user almost exclusively. I have been since it was pay-ware. I did use and donated (I seem to recall they put my name in a newspaper but I forget which one) Firefox but they have gone downhill. Now, when I install Linux, I use Firefox like I would use IE. I use it just long enough to download another browser. I could just grab one out of the repo but I really prefer my Opera and I have yet to find one with the current Opera builds in them.
"So long and thanks for all the fish."