Slashdot Log In
Mozilla Firefox 1.0.7 DoS Exploit
Posted by
Hemos
on Mon Oct 17, 2005 08:26 AM
from the to-be-confirmed-or-not-confirmed dept.
from the to-be-confirmed-or-not-confirmed dept.
An anonymous reader writes "Whitedust Security are reporting on a new exploit for Firefox which apparently affects all versions of the browser from 1.0.7 down. From the article: "If this exploit has made it out into, or indeed been retrieved from the wild is unknown at this time. However it is clear that this exploit will indeed need patching as soon as possible.""
This discussion has been archived.
No new comments can be posted.
Mozilla Firefox 1.0.7 DoS Exploit
|
Log In/Create an Account
| Top
| 438 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Re:Brilliant header! (Score:5, Informative)
milw0rm.com have released proof of concept code for a denial of service exploit which apparently affects all versions of the Mozilla Foundations popular Firefox browser from version 1.0.7 downward.
Remember, on Slashdot always read the article, it is generally only a coincidence if the summary has any bearing on the actual linked text.
totally off guard (Score:5, Informative)
Re:totally off guard (Score:5, Informative)
(http://tspiteri.org/)
Re:totally off guard (Score:5, Funny)
(http://www.underachievement.org/ | Last Journal: Sunday January 21 2007, @10:58PM)
Don't worry about it guys. I sent Microsoft an Error Report so I'm sure they'll get right on the problem as well.
Not too big a deal (Score:5, Insightful)
There isn't much incentive for malicious people to crash people's browsers.
The wording from the security company has me thinking they're just trying to make a name for themselves.
Re:Not too big a deal (Score:5, Informative)
Re:Not too big a deal (Score:5, Insightful)
(http://ctrl-alt-date.com/)
Not necessarily.
I reported some DOS bugs against firefox which will kill a browser by essentially saying:
The browser dies. Probably because it attempts to either a) allocate all the system's memory and the kernel kills it, or b) at some point memory allocation fails and the program terminates.
Not all crashes are buffer overflows, or exploitable.
Re:Not too big a deal (Score:5, Informative)
Re:Not too big a deal (Score:4, Informative)
(http://www.nutnr.com/)
Re:Not too big a deal (Score:4, Informative)
(http://stewart.snerk.org/)
If you follow the README [steve.org.uk] URL, you'll notice that the bugs referenced were confirmed agianst 1.0.4 and older, but are all fixed in 1.0.7.
Try to keep the suppositions about Windows bugs to yourself unless you have even some inkling of understanding of the situation. It makes us all look bad.
Re:totally off guard (Score:5, Informative)
(http://www.gavinsharp.com/)
Thunderbird also vunerable (Score:4, Informative)
How come there are so many nice hackers? (Score:5, Funny)
(http://www.milliondollarsweethearts.com/)
Where are the evil hackers, or have they all converted, scared about stiff http://news.bbc.co.uk/1/hi/technology/4249780.stm [bbc.co.uk] penalties?
Re:How come there are so many nice hackers? (Score:5, Insightful)
(http://en.wikipedia.org/wiki/User:Firien)
People who don't want their friends/family affected, people who actually care about the world they live in. I'm surprised that you seem to believe that everyone would be malicious if they could.
Re:How come there are so many nice hackers? (Score:4, Interesting)
(http://www.stevenvansickle.com/)
yeah, WTF? (Score:5, Insightful)
I think the poll at the top of the page should ask, "Do you trust WhiteDust security?"
Oh, wait - that's what the 'Test the exploit' link is for.
Nomenclature... (Score:5, Insightful)
(http://www.justgiving.com/garethowen | Last Journal: Thursday October 31 2002, @02:07PM)
A browser that can be crashed is a very bad thing, but suggesting this is some sort of "Denial Of Service" attack, is just semantics. It doesn't crash the box, and it doesn't flood/break the network. Every other service on your machine runs as normal. That's not a Denial Of Service by the usual definition of the term.
The operative word is "attack". (Score:5, Insightful)
If you crash your car into a tree, did that tree "attack" you?
If you crash your car when driving over ice, did that ice "attack" you?
If you drive your car off a bridge and into a lake, did that lake "attack" you?
Since you cannot use your car immediately after a crashes, are trees considered a DoS exploit?
Re:Nomenclature... (Score:4, Informative)
(http://www.sdonag.plus.com/ | Last Journal: Wednesday June 07 2006, @04:05AM)
Yes it is. If you did exactly the same thing to, say, apache or proftpd or mysql - don't crash the box, don't break the network, every other service runs normal - it would be a DoS. Calling this attack a DoS provides some very important information - it doesn't allow execution of arbitrary code, just locks up the browser. The only thing that's possibly unusual here is applying the term to a client rather than a server program, but a DoS is absolutely the correct term.
Re:Nomenclature... (Score:5, Insightful)
(http://www.justgiving.com/garethowen | Last Journal: Thursday October 31 2002, @02:07PM)
Servers <=> Service <=> Denial Of Service.
See how that works?
Re:Nomenclature... (Score:5, Informative)
(http://www.justgiving.com/garethowen | Last Journal: Thursday October 31 2002, @02:07PM)
ii) You can kill the browser and go to another web page. Hell, you can just start another instance of the web browser. Which must take all of three nanoseconds.
If you prevent login, or send a SYN flood that prevents http connections, you can't just restart the appropriate service. If you really can't see why causing a client to crash is different from preventing a server from functioning, I suggest you look in some elementary computer science textbooks.
I don't have time any more time to explain the basics to fools.
Re:Nomenclature... (Score:5, Insightful)
Worm Code (Score:4, Funny)
(http://www.rememberteh.name/ | Last Journal: Thursday September 29 2005, @10:59PM)
Mozilla
# milw0rm.com [2005-10-16]
I have 1.0.7 and it caused me to crash
So... (Score:5, Insightful)
Wheres the vulnerability? when does the spyware attack? Do I need to reinstall Windows?
Should I buy a virus checker?
Anyone stupid enough to host this "exploit" on their site are just dumb,
"oooooh it makes your firefox freeze" BFD - stay away from dodgy parts of the net
(goatse is a bigger "exploit" and generally leads to complete machine shutdown/restart as you attempt to hide it from your colleagues)
Tested the exploit (Score:4, Informative)
(http://www.hipersonik.com/)
Apparently firfox 1.0.7 on linux is not affected. So not all versions of firefox are affected.
Advisory: Install linux, then restart your browser and have fun.
Re:Tested the exploit (Score:4, Informative)
Exploit (Score:5, Informative)
<html><body><strong>Mozilla<sourcetext></body></h
and it also makes Mozilla suite 1.7.12 hang.
The sourcetext tag is used when a parser error occurs; the Mozilla DOMParser will accept any string and always returns a valid XML DOM object, but in the case that the string was malformed, it returns something like this:
<parsererror xmlns="http://www.w3.org/1999/xhtml">XML Parsing Error: mismatched tag. Expected: </strong>. Location: file:///1253.html Line Number 3, Column 37:<sourcetext> (text here) </sourcetext></parsererror>
which you may have seen formatted before in a nice red-on-yellow page.
OMG, this is bad! (Score:5, Insightful)
I guess I'll just stick with Konqueror.
PoC Code *is* in the wild (Score:5, Informative)
(Last Journal: Thursday February 15 2007, @08:00PM)
Danger Will Robinson test your firefox [thedarkcitadel.com] Danger Will Robinson
Mozilla too.. (Score:3, Interesting)
(http://www.dynamoo.com/)
There's not much to it though:
Ah well, not much harm done. Of course, there's nothing to stop Microsoft putting it into MSN deliberately to break the browser, in much the same way they tried to nobble Opera [slashdot.org] some months back.
Who cares? (Score:5, Informative)
(http://www.keirstead.org/)
So clicking on a link can lock up the browser. So what?
How is this any different from this, which effectively locks up *all* current browsers?
<script>
while(true){
alert('Haha!');
}
<script>
This is hardly important. I don't see any way this can crash my machine or infect me with a trojan.
PS if you want a fix for the above vote for bug 61098] at bugzilla [mozilla.org].
Here is the exploit (the text of the html) (Score:5, Interesting)
(http://www.thebrickt...assacre/jg21_11.html | Last Journal: Tuesday December 20 2005, @06:19AM)
Any ideas as to what is going wrong?
A browser DoS? (Score:4, Funny)
(http://www.hydrous.net/)
<html>
<body onmousemove="while(1) alert('ooooh');">
</body>
</html>
Watch out before you run it! You wouldn't want to lose that Xanga post you've been working on.
crasher bug != news (Score:5, Insightful)
how's this possible (Score:5, Insightful)
(http://assambassador.com/)
And let's suppose it is in the wild and to get infected I don't have to go to some Russian site selling stolen credit cards. Can anyone see how that could be possible? You'd have to go to a site knowingly and maliciously designed to exploit this, right?
Security Bug (Score:5, Insightful)
IMHO "security" bugs are for ones that have an impact on "security". If it doesn't fit that criteria, it's not a security issue.
A JS permissions exploit would be a security bug. So would the IDN issues, and buffer overflows...
but a crasher? I think that's pushing the benchmark. It's not really a DoS... it's a crash/hang.
It would be a security issue if say, it caused 911 to become unavailable, or killed US Radar systems... but not for crashing a web browser.
I think people have been pushing for a while in hopes of getting new security bugs. And that's all products, not just Moz. There are legitimate security bugs, but I don't think this qualifies. IMHO you need to be able to do something that violates security to be a security issue.
Um, DOS is not that serious (Score:3, Insightful)
It's easy to do that to almost any browser. Loading a lot of really big images will crash Firefox when it runs out of memory, and has the side-effect of slowing the rest of the system (or probably crashing it if it's based on windows 9x).
The "exploit's" entire HTML source reads like this:
<html><body><strong>Mozilla<sourcetext></body></h
It's clearly a silly bug, but I feel that saying "it is clear that this exploit will indeed need patching as soon as possible" is excessive hype. This is not a security issue. This is part of the known problem that Firefox is not very tolerant of buggy code, which is a general serious issue that does need fixing.
I wonder if this is a Gecko bug? An email version of this for Thunderbird would be very annoying.
Mo$illa is evil... (Score:5, Funny)
(http://www.fodors.org/)
I will not have any of their software on my computer. I ONLY use Microsoft products.
Hmmm.. security? (Score:5, Interesting)
(Last Journal: Tuesday December 31 2002, @08:24AM)
ctrl+alt+del kill process is a good workaround for this "extremely dangerous" exploit. Again if this is a security vulnerability, then flash is the greatest hacking tool against firefox. Java is probably the greatest hacking tool against IE.
People are just really desparate for Firefox to have more bugs than IE. Thanks for finding some code that should probably be cleaned up, but crashing the browser is not in any way violating the security of the system on which the browser is running.
Whitedust and DoS (Score:3, Informative)
This hardly counts as a DoS [wikipedia.org] attack in its traditional meaning. However it is an annoying bug. I am glad to read that it has been addressed in the latest beta.
What follows is probably an ad hominem [wikipedia.org] attack. Moderate accordingly.
I decided to spend a little time on the Whitedust [whitedust.net] site. The site is advertised as "The Leading Independent Security News Portal".
The site is run by a group of former crackers. Of course one has to wonder about their cracking, security, and business skills when:
In short this web site has no redeeming value.
Re:is this NOT an OLD version (Score:3, Informative)
Re:Blame the hacker culture (-1, opposes groupthin (Score:3, Insightful)
I think you meant "less than," rather than "greater than".
Re:Topic title is confusing (Score:3, Insightful)
(http://www.myspace.com/lykachamp)
Fix (Score:3, Insightful)
(http://icculus.org/~mongoose/)
If you didn't know this I guess the joke is on you. Welcome to russia.