Unpatched Firefox Flaw May Expose Users 390
Corrado writes "CNET is reporting on a new Firefox flaw." From the article: "The problem lies in the way Firefox handles Web links that are overly long and contain dashes, security researcher Tom Ferris said in an interview via instant messaging late Thursday. He posted an advisory and a proof of concept to the Full Disclosure security mailing list and to his Security Protocols Web site...The public bug disclosure comes just as Mozilla released the first beta of Firefox 1.5. The final release of the next Firefox update, which includes security enhancements, is due by year's end, according to the Firefox road map."
This is impossible! (Score:2, Funny)
Everybody knows that security flaws are only available in Microsoft products. I read it on Slashdot!!! It has to be true!!!
Expose users? (Score:5, Funny)
Re:Expose users? (Score:5, Funny)
Re:Expose users? (Score:5, Funny)
Re:Expose users? (Score:5, Funny)
Re:Expose users? (Score:3, Funny)
404: File Not Found
We are sorry, the file you requested could not be found.
Referring page:
http://it.slashdot.org/article.pl?sid=05/09/09/133 6253&threshold=0&tid=128&tid=154 [slashdot.org]
The link you clicked to get here is either misspelled, outdated, or may just never have existed. You can use the links on this page or the se
Tell all your friends! (Score:5, Insightful)
Re:Tell all your friends! (Score:4, Interesting)
I've seen several computers now where the red arrow icon is always displayed and the update wizard never successfully downloads anything.
Reinstalling doesn't seem to help fix it.
Re:Tell all your friends! (Score:5, Insightful)
"If you have gotten your non-techie friends to switch to Firefox, be sure to tell them about this problem and the possible fixes. Indeed, it is very important that Firefox be kept up to date on as many computers as possible"
Not trying to troll here, but...
Couldn't the same be said for IE or any other browser? If you have non-techie friends that could be vulnerable on any platform, wouldn't letting them know how to check for security updates be the right thing to do?
Should you let them flounder and possibly become zombies for some nefarious spam network because they don't use your "preferred" browser?
Personally, I use Mozilla at home because I like it much better, and encourage all my friends to do the same, but I'm not above recommending security updates to those who choose not to use Mozilla/Firefox.
Firefox is the fix for Internet Explorer problems. (Score:3, Funny)
Re:Firefox is the fix for Internet Explorer proble (Score:5, Insightful)
I deployed Firefox on the corporate network to improve security. Five updates later, I'm explaining to my manager that Firefox, just like IE, is full of security holes that need to be patched.
Unlike IE, Firefox can't be updated through Windows Update and it doesn't have a patch release cycle. That makes it harder to plan for and harder to deploy Firefox patches.
Having "fewer" vulnerabilities than IE isn't good enough - particularly when your patching system sucks. Open source can do better.
Re:Firefox is the fix for Internet Explorer proble (Score:3, Informative)
P(Vi) = Probability of being pwned by single vulnerability Vi = (chance of vulnerability being exploited)*(chance of user replicating vulnerability conditions).
Probability of being pwned by multiple vulnerabilities = 1 - PROD over all vulnerabilities(1 - P(Vi)).
Aren't firefox users heading back to IE over this? (Score:5, Insightful)
Re:Tell all your friends! (Score:5, Insightful)
The ridiculous part, though, is that software doesn't *have* to be vulnerable to buffer overflows! We've had languages for more than 20 years that are completely invulnerable to such a simplistic attack. Even C/C++ have large numbers of libraries available to make such overflows a thing of the past. Yet here we are in 2005 and the number one exploit across systems is still...
(wait for it)
Buffer overflows.
Am I the only one who's getting just a smidge annoyed by this? No wonder we don't have any flying cars! We can't debug the darn things worth a damn!
Well, just another bug (Score:2, Insightful)
Re:Well, just another bug (Score:2, Interesting)
Re:Well, just another bug (Score:5, Informative)
According to Secunia, during 2005 IE6 has had 11 advisories while Firefox 1.x has had 18.
Unfortunately I can't get the links to work properly (graphs come up blank), so take a look at the URL's yourself:
IE6: http://secunia.com/graph/?type=adv&period=2005&pr
Firefox 1.x: http://secunia.com/graph/?type=adv&period=2005&pr
(you will have to copy and paste these URL's to make them work it seems)
Re:Well, just another bug (Score:4, Insightful)
Re:Well, just another bug (Score:3, Insightful)
Every few weeks there's evidence that I was correct
Anyway, I use both IE and Mozilla (which appears to crash more often than IE and worse of all you can't easily launch multiple independent Mozilla processes).
For security, my normal IE has active scripting off - which seems to prevent most security bugs from working. For sites which require javascript and IE, I use IE in a virtual mach
Re:Well, just another bug (Score:4, Informative)
0 extremely critical of 22 vulnerabilities and 4 still unpatched for Firefox
versus
10 extremely critical of 69 vulnerabilities and 19 still unpatched for IE 6.
I'm not saying Firefox doesn't have its issues, but be careful with statistics.
Re:Well, just another bug (Score:5, Interesting)
Re:Well, just another bug (Score:3, Informative)
A better argument is that "In firefox, the bugs are trivial enough to be fixed with a script until it gets fixed in the main program, a matter of weeks, instead of fixing it in a script in IE, and waiting years for it do get fixed."
It should be noted (Score:5, Interesting)
Re:It should be noted (Score:2)
With a proxy I get squids error page, without I get a google search.
Re:It should be noted (Score:2)
In many cases, a bug which causes a crash when triggered with inappropriately long data turns out to be a bug which can be exploited to execute arbitrary code if the data is carefully crafted to do so. Your test merely reconfirms the basics of this bug. In all likelyhood, the guy can run arbitrary code via this bug if he's claiming he's done it.
Re:It should be noted (Score:2)
Re:It should be noted (Score:5, Interesting)
<mao|zZz> mscmurf, dveditz: bug 307259 has been slashdotted - maybe it would be politically good to disclose the bug, at least to counteract this statement at the end of the advisory: "Mozilla was notified, and im guessing they are working on a patch. Who knows though?"
<mcsmurf_> well, if there is a comment in it which should not be public
<mcsmurf_> then the bug remains private
<dveditz> mao|zZz: the potential issue is that his advisory is incorrect, and I'd rather not release the real crashing testcase (though people might discover it soon enough)
<CTho> mao|zZz: it was nice of them to wait til we shipped to make sure the world hears
<biesi> it was public before we shipped
<mcsmurf_> one day?
<dveditz> CTho: that was probably our fault, I should have pushed the fix in
<mao|zZz> biesi: but the slashdot sequence is pretty suspect...
<CTho> dveditz: i heard the patch on teh bug doesnt work
<dveditz> It was nominated, but after the point where triage was being done -- needed to be more actively pushed
<mao|zZz> looks like an easy move to eclipse the beta release wow effect, or worse make it a boomerang
***Toba wonders if the bug is patched yet
<Toba> anyone got the bug link?
<biesi> it's not publically visible
<dveditz> Toba: it's still a private bug
<biesi> (https://bugzilla.mozilla.org/show_bug.cgi?id=307
<dveditz> see scrollback a few lines
<Toba> dveditz: eh, I guess it would be nice to know
<Toba> but oh well
<biesi> dveditz, it was your comment that said the patch didn't work?
<dveditz> we have *a* patch, we're not convinced it's the right patch
<mao|zZz> dveditz: would you cc me?
<Toba> I guess it's better if the world doesn't know how to exploit yet
<mcsmurf_> dveditz: do you know why or if SeaMonkey is not vulnerable? it doesn't crash when using the exploit
<dveditz> mcsmurf_: that's part of why I'm not opening the bug... the released testcase is not the testcase from the bug
<mcsmurf_> ah-hah
<dveditz> seamonkey is vulnerable, this is core networking stuff
<mcsmurf_>
<mcsmurf_> well i assumed so
<mcsmurf_> but i only have the public testcase
Re: (Score:3, Insightful)
Re:It should be noted (Score:2)
I realize it came out as a troll, and I didn't intend that, I just wanted to use an analogy to make a counterpoint about blind faith in engineering
Re:It should be noted (Score:5, Funny)
You don't really want to get into the business of pointing out wackos on slashdot. It's easily a full time job and it doesn't pay.
Any Way To Stop This? (Score:2)
Anyone know of any stable extension(s) that would?
Patent infringement (Score:5, Funny)
Jerry
http://www.cyvin.org/ [cyvin.org]
Re:Patent infringement (Score:2)
They do. Everyone else's flaws are automagically patched the instant they're found. Since 12 hours have gone by, you can be sure that not only has this been patched already, but your version of firefox updated itself and you're now safe.
</sarcasm>Actually, if you're using a nightly, that probably will happen in a few hours. The new patching system is awesome. Binary diffs, so no downloading huge files, it downloads in the background so it doesn't disturb you, and installs when you restart firefox. It
Re:Patent infringement (Score:5, Insightful)
Yes, but would you have said the same thing if you had replaced the word firefox with the word windows in that sentence? I say that only because that's what WAU does these days, though I forget for how long it has been doing the binary diffs. I think that came along with the latest BITS update sometime in early summer this year, but can't be sure. Just FYI.
The response is the key (Score:2)
Derek
Hmm... (Score:2)
Anyone got an experiences on other platforms?
Anyone know if this can do anything other than crash the browser?
Re:Hmm... (Score:2)
I opened the local html file in firefox, and... nothing happened.
?
Also, I wonder what happened between him and the firefox developers that made him go public so soon after reporting it to them.
more info at (Score:2, Funny)
Re:more info at - Bogus FUD bug (Score:2)
Re:more info at (Score:2)
and this was with Firefox 1.0.6...
exploits? (Score:5, Interesting)
It will be hard to craft some exploit code using only the - character.
It may DOS and cause instability; as for those "but, open source should be proof against this" nay-sayers, I'm pretty certain from the advisory [security-protocols.com] that this could only be properly discovered because the source was available.
hmmmm, maybe if you can trick users to click on bad links a few times it might cause heap corruption and crashing; maybe if you get them to download the right page a few times to pre-load the heap, and then a few ----- might cause the browser to execute from the heap,
A look at the soucre will show the consequences of this and show what sort of pathway there is to arbitrary code execution. I guess it could be exploitable...
Sam
Re:exploits? (Score:2)
Re:exploits? (Score:2)
Sam
Re:exploits? (Score:3, Interesting)
Oddly, I have yet to see one of his found exploits actually work. At most, I have
Re:exploits? (Score:3, Funny)
http://www.microsoft.com/technet/security/bulletin
The funny thing is his note: "As I previously reported, there is a remote kernel denial of serivce vulnerability with the Remote Desktop Services protocol which affects every verison of Microsoft Windows. "
Last time I check, RDP is not on older versions of Windows. Again, blown out of porportion for such a minor bug.
buffer overflows (Score:4, Interesting)
Just for curiosity, can be Firefox compiled with the compiler parameter which adds code to detect a wide variety of such bugs? It's what Microsoft did at IE in the XP SP2; does it have "sense" to do the same for firefox?
Re:buffer overflows (Score:3, Interesting)
Unacceptable (Score:3, Insightful)
We rightly criticize Microsoft for not responding to security concerns in a timely manner. I hope the Mozilla Foundation will be held to the same standard.
Re:Unacceptable (Score:3, Informative)
mconnor: we're in security firedrill mode. probably not meeting on beta2 today.
They're all busy dealing with this issue... everything else is on hold.
So, the question is ... (Score:3, Interesting)
A. before you release a version (Firefox);
or
B. years after you release a version (IE).
Well? Which is better? If you choose option B, you can deny there's a problem for 1-2 years, start working on a fix in 2-3 years, nay-say press rumors about the bug in 3-4 years, and fix it and release the bug fix in 4-5 years.
I choose option A.
Uhm, your point? (Score:2, Interesting)
Does CNET really think that Mozilla group is going to ignore it? I don't really see the point of the article. It seems like they were more interested in saying, "Oh, hey. Look, we're cool too because we found a flaw in Firefox."
I'm sure it'll be fixed in a couple day in the nightly builds. The new auto-update mechanism in 1.5 wasn't impleme
Re:Uhm, your point? (Score:2)
Does CNET really think that Mozilla group is going to ignore it?
Maybe the Mozilla group already knows about it for many many months but because the bug is tagged as "Security-Sensitive", nobody else knows about it. Didn't that happen with a few security bugs in Mozilla?
He sounds like a self-promoting twit (Score:4, Insightful)
Re:He sounds like a self-promoting twit (Score:5, Insightful)
Buffer overflow (Score:3, Interesting)
"The security vulnerability is a buffer overflow"
Buffer overflows aren't very easy to catch, but I thank the guy who discovered it. This way we can make Firefox a more secure browser everytime.
But frankly, I don't know how to feel. Embarrassed because buffer overflows are the result of sloppy buffer programming, or proud because Firefox has much fewer buffer overflows than windows products?
Re:Buffer overflow (Score:3, Insightful)
"Security is a process."
Being open source programmers doesn't make them perfect programmers. Not working at Microsoft doesn't make them perfect programmers.
The phrase never never said, "given enough eyes, there are no bugs." It said "given enough eyes, all bugs are shallow." That phrase even admits there will be bugs. Security is a process, not an accumulated number of crash bugs.
I would hope Firefox has fewer overflows than IE, only because that would mean less headaches for me, and
Year's end? (Score:3, Funny)
What's that you say? This isn't an article about Microsoft?
Oh, nevermind then.
workaround (Score:3, Informative)
be happy!
Nope - not on my v1.06 Firefox (Score:3, Informative)
This seems to be a dud exploit...
Re:Nope - not on my v1.06 Firefox (Score:2)
Re:Nope - not on my v1.06 Firefox (Score:3, Informative)
Re:Nope - not on my v1.06 Firefox (Score:3, Informative)
$ GET www.security-protocols.com/firefox-death.html | xxd
0000000: 3c41 2048 5245 463d 6874 7470 733a adad <A HREF=https:..
0000010: adad adad adad adad adad adad adad adad
0000020: adad adad adad adad adad adad adad adad
0000030: adad adad adad adad adad 203e 0a
Assuming the document is UTF-8 (no way of telling for sure), we can look up 0xa
Re:Nope - not on my v1.06 Firefox (Score:3, Interesting)
40,000 dashes: No crash, it does a Google search, but Google displays a Bad Request message.
130,000 dashes: No crash. Same results as above.
275,000 dashes: Same as above.
At this point Kate is very slow and gedit seems to hang. All these dashes are on a single line so as not to modify the POC too much and text editors don't like that. I wrote a script to add more dashes for the next test.
1.5 million dashes: No crash.
Re:Nope - not on my v1.06 Firefox (Score:3, Interesting)
not crashing (Score:3)
Won't fix - Bogus FUD Bug (Score:2)
Oh well, what the hell - Yosarian, Catch 22.
Similar Bug (Score:3, Funny)
This guy was driving and navigated to a bunch of yellow dashes in succession.
This method of action caused his car to crash.
I've only been able to replicate this bug on roads with > 2 cars.
Anyone experience this?
/waiting for roads v1.5
Patch available (Score:3, Funny)
possible bugzilla bugs (Score:5, Insightful)
https://bugzilla.mozilla.org/show_bug.cgi?id=3069
https://bugzilla.mozilla.org/show_bug.cgi?id=3069
https://bugzilla.mozilla.org/show_bug.cgi?id=3070
https://bugzilla.mozilla.org/show_bug.cgi?id=3070
https://bugzilla.mozilla.org/show_bug.cgi?id=3070
https://bugzilla.mozilla.org/show_bug.cgi?id=3070
BTW, why is it necessary that so many bug reports be hidden? They can't all be valid security bugs, can they? Besides, full disclosure and an open development model go hand-in-hand.
-molo
MS vs Firefox is irrelevant (Score:5, Insightful)
Honestly, who cares? Why does this have to be compared to a Microsoft response? Why can't this just be viewed as an event in its own right and not constantly looked at as some insult which might be handing Microsoft an edge?
Objectively, if I use Firefox I have no interest in how Microsoft might have responded to a similar situation. I am purely interested in the Mozilla response (which I'm explicitly not passing judgement on in this post). Can people give it a rest with the constant defensiveness against Microsoft?
Cheers,
Ian
what a whiny runt. (Score:3, Insightful)
and basically he acts like 4 days is all he needs to wait.. and apparently Mozilla isn't doing enough for this?
Mozilla isn't Microsoft or Cisco in two catagories.
A. They arn't ultra large coporatitions that can fix stuff in an instant.
B. They don't ignore problems, especially like this. They're likely working as fast as they can and they are willing to admit fuckups, but they want to have a fix for the fuck up first.
We don't need everyone running around thinking that EVERY company conducts business the same way that Cisco does... How all of them are part of a conspiracy. Firefox is getting known in the industry to be basically good at avoiding problems other browsers have and fixing major bugs.
By having a guy run around like this only 4 days (notice the dates in that link) it can only cause a higher likelyhood that someone will use that find maliciously and Firefox will get blamed for it when it's really the disclosure that's the problem.
The fact is those of us who find these bugs need to give the company time to react, we don't need to act like they don't care. 4 days is hardly enough unless he got back a letter that said screw you, which it doesn't sound like he did. Giving Full Disclosure the first time you hear about a problem, just creates a bigger problem because now more people will learn of the problem.
And there's a definate difference between waiting a couple monthes like the Cisco incident where the company was being forced into an uncomfortable positions and waiting less then a full week with apparently no provacation.
For all those that can't reproduce (Score:5, Informative)
http://www.security-protocols.com/firefox-death.h
WARNING: Clicking the above link will crash firefox. It will do nothing else. The hyphens are not normal minus hyphen (the - symbol on your american keyboard will translate to 0x2d) but a soft hyphen (0xad).
Re:For all those that can't reproduce (Score:3, Informative)
Your link crashed my browser.
Re:For all those that can't reproduce (Score:3, Informative)
Only for some people. It needs to specify a character set, too; the "exploit" appears only to crash Firefox when the character set is ISO-8859-1, so if your browser is set to use anything else by default, the link will not do anything at all.
Re:For all those that can't reproduce (Score:4, Informative)
no problem if set to false in about:config
Re:For all those that can't reproduce (Score:3, Informative)
MOD PARENT UP
It's true - if you leave network.enableIDN set to 'true' then the browser will demonstrate the problem. Toggle it to 'false' and the problem doesn't appear.
Wow, I thought only.... (Score:3, Insightful)
Were the people championing these other browser lying to me, or just ignorant in the fact that all software when given mass distribution will exhibit growing pains and exploits will be found no matter how good the programmers think they are.
Hm... (Ok, mark this as Flamebait - even though what I say is factually correct.)
Important note to all... (Score:4, Informative)
For those testing on their own, *please realize* that it is not simply a dash (0x2D), but the character 0xAD.
incorrect information (Score:4, Informative)
The bug report is now open and you can see that he reported it to Mozilla on the afternoon of the 6th. There was quite a bit of activity from top Mozilla developers and then the reporter posted the exploit publicly on the 8th.
We've determined that disabling IDN is a safe workaround and are working on supplying a small download that will take care of that configuration for the user.
- A
Re:incorrect information (Score:4, Informative)
I'd also note that Ferris's bug report (bug 307259) originally claimed that the vulnerability was a format string vulnerability, not a buffer overrun, and that the testcase he showed us was a huge testcase probably generated by a tool for generating mangled HTML (like MangleMe). What he published in his advisory wasn't analysis he gave to us when he reported the bug, but looks like it was copied from:
Re:Oh Crap! (Score:2, Informative)
Re:Oh Crap! (Score:2)
I hear they make FireFox for Windows, too
Re:Proof of concept (Score:2)
Re:Proof of concept (Score:2)
Thats what I get for repeating a security bulletin without testing it, I suppose.
Re:Proof of concept (Score:2)
No crash here: Firefox 1.0.6 on NetBSD 2.0.2.
Re:Proof of concept (Score:2)
Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.7) Gecko/20050414
-molo
Re:Proof of concept (Score:2, Informative)
So kind of pointless exploit in this case ?
So, to protect yourself
go to about:config and change keyword.URL to http://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8 &q= [google.com]
and keyword.enabled to true
Re:Proof of concept (Score:2)
Re:Proof of concept (Score:5, Informative)
Here's an xxd dump of the offending HTML:
Re:Flaws (Score:4, Insightful)
A browser is a complex piece of software, of course there are going to be subtle bugs that turn up now and then. Nobody is perfect, and visualizing every possible execution path through a billion SLOC application is impossible. Please stop making a fuss about "OMG BROWSER DoS!!".
Re:Flaws (Score:3, Interesting)
Re:Flaws (Score:3, Informative)
The point that the person was trying to make (for which you rather unjustifiably called them a moron) is that you can't encode a nop or a jmp with just 0x78 bytes. That means that you can't push exploit code over into the browser to execute using this hole. That doesn't mean that it's impossible to cause a problem with this -- there is a very slim possibility that something crucial could be overwritten while keeping the progr
Re:1.5 safe? (Score:2)
You didn't download 1.5, you dowloaded the 1.5 beta 1 release candidate . That's triply qualified as not 1.5.
It's not fixed yet, but when it is, you'll get it automatically when firefox updates itself (the new update system is awesome).
Re:1.5 safe? (Score:2, Informative)
I'd say RTFA, but this is Slashdot after all...
If you had read the article you would have found a link to the advisory [security-protocols.com] which clearly states the following:
Re:This doesn't work for me... (Score:2)
Re:This doesn't work for me... (Score:2)
The only extensions that I have in your list are adblock and flashblock, neither of which I can imagine being the random fix.
I'm guessing the guy who found the problem didn't bother checking this out very well before he published.
using extensions against explits (Score:2)
The Mozilla codebase quality is questionable. (Score:3, Insightful)
It doesn't help that a lot of the documentation is out of date, often by several years. Nothing is worse than incorrect or outdated documentatio
Re:The Mozilla codebase quality is questionable. (Score:3, Insightful)
Just so people don't think that means the upcoming SeaMonkey [mozilla.org] release will be using shoddy code, I'd like to point out that code review for firefox-only code is significantly less thorough than review for suite-only code. In many cases, large Firefox patches have been checked in with no code review at all! On multiple occasions when porting features from Firefox to SeaMonkey, the patches were initially rejected due to code
Re:Interesting... (Score:3, Insightful)
But the opposite is also true...it's a proof that it's much easier to debug open sourced applications.