2 Firefox Security Flaws Lead to Exploit Potential 417
Marthisdil points out a News.com story which reports that "Two vulnerabilities in the popular Firefox browser have been rated "extremely critical" because exploit code is now available to take advantage of them." Security firm Secunia reported the vulnerabilities (and the "extremely critical" rating is theirs), but the News.com story points out that thus far, "no known cases have yet emerged where an attacker took advantage of the public exploit code." Update: 05/09 20:20 GMT by T : Rebron of the Mozilla Foundation sends a correction; this is really the same flaw reported yesterday. He suggests that you glance at the Mozilla security alert on this hole (as well other alerts at the Mozilla Security Center), and says "The Mozilla Foundation has made changes to our update servers that will protect users from this arbitrary code execution exploit."
IE (Score:3, Funny)
sorry.. (Score:2, Insightful)
mod me accordingly if i am.
do we really need to see it posted here, every time
a firefox sploit is found?
gettin me all excited for nothing
Re:sorry.. (Score:5, Insightful)
Re:sorry.. (Score:4, Funny)
Re:sorry.. (Score:4, Funny)
Re:sorry.. (Score:5, Informative)
Firefox bugs get on the front page when they are exploitable in theory (this exploit here also worked only for a couple of hours because Mozilla's servers have been modified so Firefox is redirected to a non-whitelist site) while IE bugs get on the front page only when they cause serious mass infections.
Re:sorry.. (Score:3, Funny)
Because serious IE security holes are popping up every other day. The front page at
Re:sorry.. (Score:2)
Fortunately, this type of posting is actually informative - most people don't follow the mailing lists and wouldn't have known any other way. Unfortunately, it's also a great way to start flamewars.
Win one, lose one, life moves on.
Re:sorry.. (Score:2, Interesting)
...obligatory (Score:4, Funny)
Re:sorry.. (Score:3, Insightful)
The articles here _aren't_ supposed to be impartial and the user comments _aren't_ supposed to be insightful. Slashdot is all about preaching to the choir - if you want something else, I suggest you find a legimate news site.
Re:sorry.. (Score:3, Insightful)
s/Slashdot/Fox News/
Re:sorry.. (Score:4, Informative)
Reposting the story ad nauseum won't make it any more interesting or useful.
Re:sorry.. (Score:4, Informative)
Right back at you.
There's working exploit code in the comments to this very storyI guess you missed the part where Mozilla Foundation has corrected the problem on their servers, and given instructions to take any third party websites off the whitelist? The exploit code simply has no effect if that basic precaution is followed.
While the above mentioned fixes and workarounds aren't perfect, they do eliminate the problem for now. A more thorough comprehensive fix is under development.
This is no worse than that IE exploit that was redirecting people to that scammer site in Russia (forget the name of the exploit). MS issued a "fix" which didn't address the flaw in the software at all - they basically just added that one specific scammer site to the hosts-deny list (Yes I know that's not perfectly accurate, but it's basically what they did)
BTW, nobody here is impressed with your pottymouth language.
TommyRe:sorry.. (Score:3, Insightful)
After enough time has passed, people think making the drumming sound was the point all along.
Re:sorry.. (Score:3, Informative)
I'd rather get a headsup here, or even better yet
Re:sorry.. (Score:5, Informative)
Re:sorry.. (Score:3, Insightful)
Big difference between a plugin notifying us of a security vulnerability, and the update button telling us there's a fix.
Re:sorry.. (Score:2, Informative)
Don't be sorry (Score:2)
News of malicious use of the exploit in the wild may have been worthy, but if anything it says the risk is now lower.
*shakes head and wonders off*
Dupe... (Score:4, Informative)
See! See! (Score:2, Insightful)
Re:See! See! (Score:2, Insightful)
Yes, Firefox will be updated.
No, not everyone who runs Firefox will update.
Yes, the hole will be used to install viruses and spyware.
No, installing Firefox once is not a single solution to surfing the internet safely - you still have to update, just like Windows Update/IE.
Re:See! See! (Score:5, Informative)
One report says as follows:
Because the foundation controls all sites in the default software installation white list, it has been able to take preventative action by placing more checks in the server-side Mozilla Update code and moving the update site to another domain.
The foundation said users who have not added any additional sites to their software installation white list are no longer at risk.
So one down, the other to be fixed shortly.
Re:See! See! (Score:2)
Are you aware that there are quite a few sites out there? I've heard there are even a few which Mozilla doesn't control!
But we'll call it fixed anyway sense who in thier right mind would ever download anything that wasn't on a Mozilla controled site
Re:See! See! (Score:2)
I just had a scary thought!
Are my porn sites Mozilla controlled??????
Re:See! See! (Score:5, Insightful)
Mozilla has done a server-side workaround to mitigate this issue but the Firefox (client-side app) has had nothing done to it. The issue is still 100% there. Again not saying this will effect anyone, but to say the bug has been fixed is just WRONG. The bug is in client-side code and that client-side code will need to be fixed, not just a server-side workaround.
Again, most likely nothing will come of this, but I just thought viewers who saw your original comment would be misled into thinking the client-side bug was been fixed (which is not the case).
asdasd (Score:2, Insightful)
Re:asdasd (Score:3, Insightful)
Sounds familiar (Score:2, Funny)
Seriously, this is getting repetitive. There are always flaws. Just run Windows Update and hope there's a patch for Internet Explorer.
Re:Sounds familiar (Score:2)
With IE, god only knows how long it may take.
And to think... (Score:5, Funny)
Re:And to think... (Score:2)
Re:And to think... (Score:5, Informative)
Overall, I think Firefox is more secure than IE and will just grow to be increasingly more secure with time. That doesn't mean it is flawless.
Re:And to think... (Score:2)
Re:And to think... (Score:4, Informative)
Re:And to think... (Score:2, Informative)
Re:And to think... (Score:2)
Re:And to think... (Score:3, Insightful)
except that IE is tied very tightly (I was going to say "securely," but really, it's not that secure) into Windows, whereas Firefox is not. The more levels of separation you can have between the app and the OS, the better.
the benefit of using Firefox also has to do with response times - the Moz. Foundation has been extremely quick to patch holes once detected, while critical holes in IE, if history is our guide,
Re:And to think... (Score:5, Insightful)
Don't you think this is a bit of a skewed statement? MS has departments, many of them. There is probably an IE department and it's sole purpose is IE. It may not have any conversations with any other departments with the exception of "Will IE still work with the rest of Windows? It does? Great, going back to my cave."
Re:And to think... (Score:3, Informative)
Actually, most IE exploits are discovered by third party security firms, such as F-prot and Secunia. It's often months between the discovery of the flaw and a solution - you just weren't told there was a problem.
Black hat hackers also have debuggers. They can find IE exploits as easily as those third party security firms. It all comes down to who finds it first - white hat or black.
T
Re:And to think... (Score:3, Informative)
Three syllables: ActiveX [google.com]. If a "feature" is so bug infested that it's worse than useless, can you consider it a bug?
Re:And to think... (Score:3, Informative)
Re:And to think... (Score:3, Informative)
Thing is: ActiveX is "broken as designed", whereas alternatives may be "broken due to bugs": in latter case it can be fixed, and exploi
Re:And to think... (Score:3, Interesting)
And San Jose's not safer than Detroit, just less crime.
-Ted
Don't downplay it (Score:4, Insightful)
Bug Details (Score:5, Informative)
Exploitation requires the javascript bug AND a whitelisted site. The only default whitelisted site is the update.mozilla.org, and they have made changes to mitigate the problem on their end.
So unless you've whitelisted a lot of extra sites to install themes or extensions, this is not a huge risk. To be sure, disable install "Allow websites to install software" under options | web features, and if really worried, disable javascript.
Re:Bug Details - Poison DNS (Score:5, Insightful)
Sure, it makes it a little harder to execute then, say, something like Nimda that could run free across the internet, but it's still a valid security issue.
Re:Bug Details (Score:2)
Re:Bug Details (Score:5, Informative)
RTFA. The site that runs the exploit does not have to be on the site you whitelisted. Part of the exploit is that it can pretend to be a site you whitelisted. The other part is that it can sneak in some javascript code where it shouldn't be able to (an icon url).
Contrary to the grandparent post, it is not enough that mozilla has updated their site. That mitigates only part of the problem, and only if you haven't whitelisted other sites.
Until 1.0.4 comes out, disable javascript.
Re:Bug Details (Score:2)
And yet the only way to be infected by a site pretending to be a whitelisted site is to go back to that site.
Which I for one don't do every day - I get my update, then probably will never see the site again. It's not like a I desperately need every new update to every little extension (I only use two or three anyway).
Compared to the worm currently comprising 25% of Internet email which infects Windows, I find it hard to get excited over this little problem, despite the "critical" nature (being that if in
Re:Bug Details (Score:2)
While waiting for 1.0.4, just save the extensions you want to download on your hard disk and use "File / Open File" to install the extension.
Problem solved.
Re:Bug Details (Score:2)
In other words, disabling javascript is the suck for at least one very popular, useful, website.
My recommendation is rather than just disabling javascript, use the Prefbar extension which allows you to turn off javascript, etc just by clicking a box in your toolbars and turn it back on "on the fly."
Of course, this is an extension that, to install easily, you need to instal
Re:Bug Details (Score:4, Informative)
Just unmark Options -> Web Features -> Allow websites in to install software.
Re:Bug Details (Score:3, Informative)
Wrong. There are two parts to this exploit. Your solution covers one half. There is still an exploit where someone can get javascript to run as part of an icon that is loaded. The mozilla.org site itself states this:
"To prevent the script injection exploit from stealing cookies or other sensitive data disable Javascript before visiting untrustworthy sites."
Re:hooray for handwaving (Score:2)
I'd say that when a Microsoft worm consumes 25% of Internet email traffic, that gets my attention.
This little bug (which requires to go to a whitelisted site I may never visit again) really doesn't give me a hardon.
Re:Bug Details (Score:2)
Excuse me, but nothing in the article says that EVERY site offering an extension is a problem. It says that a site CAN be a problem.
So far, NOBODY has reported actually encountering an exploit site.
That makes this bug MUCH less significant than the current Windows worm comprising 25% of all Internet email traffic.
Mozilla's Security? (Score:5, Insightful)
I suspect that Firefox is somewhat more secure on the simple basis that it is not as tightly integrated with the rest of the operating system as IE is. What makes IE exploits so nasty is that they tend to become email and other exploits too.
My concern is that if Firefox gains some more ground and does become a more active target for exploits, that it may become a poster child Microsoft can use to point out that open source software's "many eyes" theory is hogwash. Maybe it is hogwash.
Re:Mozilla's Security? (Score:3, Interesting)
I don't run Firefox because I find it inferior to IE in rendering pages as they were intended (yes, we live in an IE world, deal with it).
As far as "many eyes" being hogwash, I can't agree. Even though these exploits were found recently work has been done to make sure that the exploits are closed quickly. Some of MSFT's holes were left open for MONTHS before anythin
Re:Mozilla's Security? (Score:5, Insightful)
I used to think the same thing, but I stuck it out and just dealt with the incorrectly rendered pages. Of course there have always been / will always be people who think like you, but the fact is many (most) pages now render correctly in FireFox.
As alternate browsers are again being recognized as statistically significant companies and even hobbyist webmasters are starting to realize their value. If you see a site that isn't rendering correctly, contact the site owner and inform them. Your message might not turn the tide, but perhaps combined with the 5-6 they received last week yours will be enough to convince them of the advantage of compliance.
Please, though, don't send a nasty-gram espousing the virtues of open source, criticizing Microsoft (no need to even mention MS/IE) as it destroys all of our credibility.
Re:Mozilla's Security? (Score:5, Insightful)
A few points to consider when you're evaluating the security of software:
Re:Mozilla's Security? (Score:3, Interesting)
-molo
Re:Mozilla's Security? (Score:3, Informative)
Except for the security problems, which they don't allow the public to see.
Re:Mozilla's Security? (Score:4, Insightful)
SO, not to get too wierd on anyone...really, it's all probably hogwash, the whole bloody pursuit of "safety and security". Take the obvious precautions yes(update your software, use a firewall...), but don't get all surprised and indignant when somebody figures out how to break them!
Re:Mozilla's Security? (Score:3, Insightful)
Which would explain why you think writing a sufficiently full-featured, yet secure, web browser shouldn't be hard.
Re:Mozilla's Security? (Score:2)
Is there a patch out yet? (Score:2)
What Firefox needs is... (Score:5, Insightful)
Re:What Firefox needs is... (Score:2)
Hopefully, it is secure as well as convenient
Re:What Firefox needs is... (Score:2)
It was expected (Score:5, Insightful)
It's up to MoFo to fix their software as soon as vulnerabilities are reported now. The play time is over, from now on it's going to be Browser Wars II: The Security Menace.
Balanced? (Score:5, Insightful)
I appreciate this clarification. And I'm sure such a clarification will be included in the next IE bug report posted on Slashdot... Right?
PDHoss
Re:Balanced? (Score:3, Insightful)
Isn't it incumbent upon all readers of all internet media to identify bias and understand what they're reading, and the viewpoint that it's coming from? Even when people do claim to be impartial that's necessary to do.
It's a tech site that's provided for tidbits of information, and to furnish and environment where we can all pick on each other.
Re:Balanced? (Score:2)
"Slashdot -- The Fox News Of Technology"
At least there's no rubbish about "fair and balanced" on the banner.
Re:Balanced? (Score:5, Funny)
Updating/Using only ONE copy of Firefox?? (Score:2, Interesting)
I ask because I have alot of extensions on each of my Firefox installations. I have Firefox on my desktop at work, my laptop, my home computer, my wife's computer, etc etc
updating one computer (and then going into safe mode to find the extension that freaked out) is not that bad. But updating 5 or 10 computers can be a pain in the butt. Can I run ONE Firefox from *some
Re:Updating/Using only ONE copy of Firefox?? (Score:3, Informative)
Note that all of your extensions, bookmarks, themes etc are stored in one directory (on Windows, it's in %appdata%/firefox/, or something - I do't have access to a Windows machine right now) so you just need to carry this directory around with you - no need to manually install extensions etc every time you do a new install.
Does this affect Mozilla also? (Score:5, Interesting)
Re:Does this affect Mozilla also? (Score:3, Informative)
LINUX USERS DON'T GET VIRUSES (Score:4, Funny)
In other news... (Score:2, Funny)
One Vulnerability Already Fixed (Score:5, Informative)
Because the foundation controls all sites in the default software installation white list, it has been able to take preventative action by placing more checks in the server-side Mozilla Update code and moving the update site to another domain.
The foundation said users who have not added any additional sites to their software installation white list are no longer at risk.
So one down, the other to be fixed shortly.
Meanwhile I got a notice this morning that tomorrow's Microsoft security patch will fix one major flaw, but leave others unpatched UNTIL NEXT MONTH.
So much for "days of unpatched vulnerability" supposedly favoring Microsoft.
On behalf of the IE programming team.. (Score:2, Funny)
Re: (Score:2)
Should not be exploitable any more (Score:5, Informative)
Re:Should not be exploitable any more (Score:3, Funny)
Erm, it doesn't happen to end in .cx, does it?
Solution (Score:5, Informative)
This isn't the problem (Score:2)
If Firefox is going to win in the Browser Security Wars, they need to make the "critical update" thingy from the toolbar pop up, raise hell, close the browser, have someone check a disclaimer to skip it, etc. It needs to be ABSOLUTELY clear to the user that ignoring a critical update is a Bad Thing(tm).
They also
The bugtraq post... (Score:5, Informative)
From BT:
Firefox Remote Compromise Technical Details
Before I start, I need to say that this thing has been patched on Mozilla's server. If you take a look at any of the extension install pages on their site, you will see that the install function has a bunch of random letters and numbers after it. Even though this would probably be an easy thing to bypass, I am not going to attempt it because of the uselessness of such a bypass. A patch is already in development and so any more work going into fine-tuning this exploit would be a waist of time.
There are three core vulnerabilities being used in my example. A friend of mine (Michael Krax, http://www.mikx.de/ [www.mikx.de] helped me with the research.
To understand why the example works, one must understand the basics of how Firefox works. Everything you see in firefox is essentially a webpage being rendered by a compiler. This is what the gui is made of, and this is why firefox is so easy to customize. However, it also allows for some security bugs. If one could get one of the chrome pages to request a javascript:[script] url, that individual would be given complete access to the system because chrome urls are given full rights in firefox. My example works by tricking the addon install function into displaying an icon with a javascript url.
However, this would not be enough to compromise the system. By default, the install feature only works when called from a page within update.mozilla.org or addon.mozilla.org. Therefore, another (cross site scripting) vulnerability had to be found to call the install feature from mozilla.org. This vulnerability navigates to a javascript page and displays a link (pointing to a mozilla.org page) within a frame that follows the user's cursor. After the user clicks, the link is navigated to, which fires the onload event. This is a buggy event in Firefox because with it we can now access certain parts of the window object that we shouldnt, such as the history object. After the page loads, we use the history object to navigate backwards to the javascript page. The javascript is executed again, now from update.mozilla.org because when we navigated backwards, we essentially navigated to a javascript:[script] page. Now we call the install addon feature, which displays a dialog with det
ails of the requested addon, including an image with a specified image. This image points to a javascript:[script] url, which gets executed in the context of chrome. Now we have compromised the system
Whew, that was quite a mouthful.
I am still trying to gather all the details as to how my research was leaked, but recent conversations are leading me to believe that it was a misplacement of trust, not a server compromise. However, I do not want to jump to conclusions too quickly, as this will only lead to more problems. That's all I will say about that subject, as I don't want to offend anybody.
Also, I would like to let everyone know that this is not the only vulnerability that Mikx and I have found. We still have a couple of tricks up our sleeves, and you can be sure that we will not make the same mistake twice.
If you want to see the original PoC, here is the url:
http://greyhatsecurity.org/vulntests/ffrc.htm [greyhatsecurity.org]
Paul
Greyhats Security
http://greyhatsecurity.org/ [greyhatsecurity.org]
In other news (Score:3, Insightful)
The only way to make it 100% secure is to make sure nothing can be done to the system, and that's powered off with no automated way of powering on (i.e. it's unplugged). Once we accept that it MUST be plugged in to be usable, we need to accept the possibility of exploits. Given that, however, we can't accept defeatism, and must strive to fix it.
The typical rhetoric of "There see? product y is just as insecure as product x", and "Well at least the exploit count is 2, not 50!", only serves to distract us from the real goal of getting better and MORE secure software. Like the saying goes, "SHIT HAPPENS". Let's just learn from it and move on.
Security through obscurity is theoretically plausible, but not very practical. What may be firefox's saving grace is that it's open source and is not held as proprietary IP, controlled by a corporation out for profit, thus the evolution of the product is driven by its need to simply be better.
Perhaps microsoft will see these flaws as proof that open source doesn't work and will lower their own standards, making IE7 less secure or shipping earlier with less stability, or maybe they will take this opportunity to make IE7 that much better in the hopes of regaining popularity and claiming vindication. As long as firefox advances and closes those holes, we still have one extra viable choice. This would only result in a fundamentally more secure web surfing experience.
Hey! (Score:4, Insightful)
Sure, Firefox had two security flaws. Okay. HOW were those vulnerabilites found? Were they found because Firefox is an open-source program, and has the 'many eyes' advantage? Were the people who found them going through the code, evaluating and auditing it function-by-function is search of flaws?
Or were they testing against it in the traditional way, the way IE vulnerabilities were found? Or maybe a combination of the two?
The article doesn't say, but I believe this is more important to know than the current count on a Firefox/IE vulnerability pissing match. It's the best example (or counter-example) of open-source security in action that we have. If anyone can supply this information, I (and others, perhaps) will be most grateful.
Uh huh (Score:5, Insightful)
Re:News for Nerds? (Score:3, Funny)
Re:Safar! (Score:2)
Re:Market Share (Score:2)
Re:Market Share (Score:2)
I guess that's all I was really getting it.
Re:SANS Institute declares Firefox 'Unsafe' (Score:2)
What are you talking about? That's what emerge is for.
Oh, I forgot. Not everyone compiles Firefox themselves. I often have the new Firefox built on my Gentoo systems before the windows version tells me a new version is available.
Re:SANS Institute declares Firefox 'Unsafe' (Score:2, Insightful)
Re:The many eyes theory does not hold true (Score:4, Interesting)
Red herring.
Nobody has ever said that EVERY OSS project has "many eyes" ON the project.
What has been said is that to the extent that the source code is included, and is available for perusal by those who KNOW how to do so, this is an extra safeguard since SOME people OTHER than the developers will examine the code - possibly for precisely such reason as security.
And that is exactly what is proved by such incidents. Somebody examined the source code and determined there was a problem.
They didn't have to wait on someone at Microsoft to do so.
If anything in OSS can be complained about, it's the relatively poor amount of testing that seems to get done. Things like the dual-boot bug in Fedora last year should not happen.
Re:You Don't Want to Click on That Link...Trust Me (Score:2)