Slashdot Log In
Firefox Zero-Day Code Execution Hoax?
Posted by
kdawson
on Tue Oct 03, 2006 02:05 PM
from the shouting-fire-in-a-crowded-fox dept.
from the shouting-fire-in-a-crowded-fox dept.
Akon writes, "eWeek is running a follow-up story on the claim by two hackers that Firefox's implementation of JavaScript is critically flawed and could result in code-execution attacks. Turns out this is a possible hoax that was overblown for laughs." Mozilla's engineers say the risk is limited to a denial-of-service issue. From the article: "'As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has... I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code,' Spiegelmock said." Spiegelmock also stated that the claim that there were 30 other undisclosed exploits was made solely by his co-presenter, Andrew Wbeelsoi.
Related Stories
[+]
Technology: Hackers claim zero-day flaw in Firefox 398 comments
An anonymous reader writes "The open-source Firefox Web browser is critically flawed in the way it handles JavaScript, two hackers said Saturday afternoon. An attacker could commandeer a computer running the browser simply by crafting a Web page that contains some malicious JavaScript code, Mischa Spiegelmock and Andrew Wbeelsoi said in a presentation at the ToorCon hacker conference here."
[+]
Technology: Another Denial of Service Bug Found in Firefox 2 206 comments
An anonymous reader writes "A second security flaw that could cause the new Firefox 2 browser to crash
has been publicly disclosed.
The vulnerability lies in the way the open-source browser handles
JavaScript code. Viewing a rigged Web page will cause the browser to exit,
a representative for Mozilla, the publisher of the software, said
Wednesday. Contrary to claims on security mailing lists, the bug cannot be
exploited to run arbitrary code on a PC running Firefox 2, the
representative said.
This flaw in the JavaScript Range object is different than the
denial-of-service vulnerability in Firefox 2 that was confirmed by Mozilla
last week. That bug is related to a more serious security hole, which was
fixed in earlier versions of Firefox, the organization has said.
The two 'crashers' are the only publicly released vulnerabilities that
have been confirmed by Mozilla in the week since Firefox 2 was launched.
The issues are only minor, the organization has said."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Great!! (Score:4, Funny)
Re:Great!! (Score:5, Funny)
Parent
...crash and eat up system resources... (Score:5, Funny)
Never believe anything without a second source (Score:4, Insightful)
As long as it fits into their view of the world, it becomes true for them and they perpetuate the lie.
Re:Never believe anything without a second source (Score:5, Funny)
Anyone want to reiterate what he said so we can know that we should believe him?
Parent
Re:Never believe anything without a second source (Score:4, Funny)
Parent
Re:Never believe anything without a second source (Score:4, Funny)
Parent
Re: (Score:3, Insightful)
Does that include the article saying it was a hoax? What are we to believe?!?!?
Microsoft link? (Score:5, Interesting)
This is to be taken with a grain of salt and not as a proof of anything until further inquiries, but since it's going to be posted anyway it may as well be posted with some warnings:
A blog called Geemondo [blogspot.com] also reports that Mischa Spiegelmock seemed to have had dinner with Microsoft guys. [2y.net]
(PS: mods, if you want this post to be seen without me karma whoring, just mod it funny)
Not a funny joke (Score:5, Informative)
If I was Alistapart, I would have gotten rid of this "clown" immediately.
Moo (Score:5, Funny)
In other news, Microsoft has said thet their version of Genuine Internet Explorer has no bugs, and any bugs, must be due to a bad download, or user tampering. As such, all user installs of Internet Explorer will be renamed to "Meshed-Screen Interpolated E-reader" (MSIE for short), and will subsequently be subject to licensing fees.
he hasn't gotten it to do so? (Score:4, Insightful)
Re: (Score:3, Informative)
of course big, complex programs (like a JavaScript VM) have errors, if you want proof, you have to make a hoare calculus http://en.wikipedia.org/wiki/Hoare_logic [wikipedia.org] for the source code and beleive me, this is really really much work! - - - but this alleged error seems to be nothing but posing...
Trust but verify (Score:3, Insightful)
Something deep inside me gives a knee jerk any time a developer or product engineer starts any sentence with "I have not succeeded in making this code do..." or "I cannot reproduce..." (no pun intended).
I think Firefox is pretty good. So far (since the first public betas), I get very few issues at runtime (besides the occasional spin-forever cursor when Firefox encounters a site with some really bad browser-side code.)
He should be fired, prosecuted (Score:5, Insightful)
http://blog.washingtonpost.com/securityfix/2006/1
It actually turns out that Mischa Spiegelmock and Andrew Wbeelsoi are closely related. As we all now know, Misa works for LiveJournal. Andrew Wbeelsoi is part of Bantown, who claimed responsibility for a Javascript attack on LiveJournal (see http://blog.washingtonpost.com/securityfix/2006/0
The two are obviously related, and LiveJournal should consider immediate termination of their employee Mischa, as he is in league with Wbeelsoi, who attacked LiveJournal members themselves.
Here as some nice quotes from the article:
"We do have exploits for all the stuff we're going to show you," the 21-year-old calling himself Wbeelsoi said. "We'll give them away to anyone who proves their actions are going to be politically motivated. We don't care what side you're on as long as you commit yourself to destruction."
"We were just trying to have some fun up there," Spiegelmock said.
Mozilla should really consider civil, if not criminal actions. Damage to the Firefox brand has already been done, regardless if the exploit is real or not.
Re:Moo (Score:5, Interesting)
Actually not, it's trademark violation, and it's only if you release it under the name of "firefox". Call me the day when I can fork Internet Explorer and release my patched version as "Intarweb Implorer" without getting sued though.
Parent
Re:It's all fun and games until someone gets hurt (Score:5, Interesting)
Most of the press got the joke, laughed, and ignored it. It was some tool at CNET's fault for compromising his journalistic integrity and reporting satire as fact that caused the problem.
Parent
Then it wasn't painfully obvious enough (Score:5, Funny)
Any prank like this NOT done on 1 April needs to end with "and for those of you who left your sense of humor at home, the preceeding presentation was 100% pure entertainment and any resemblance to reality was purely to tweak your nose. Please stay for the next panel on novel approaches to perpetual motion. Thank you."
Parent
I don't think it was a "joke". (Score:4, Insightful)
Once they realized that the professionals (who are better programmers than they) were looking into their claims, they fell back on the "it's a joke" claim.
Parent
Re:It's all fun and games until someone gets hurt (Score:5, Insightful)
There was a drama festival that our school attended each year, held at a nearby college. One year, one of our scenes involved prop guns. One of my classmates took one of the fake guns up onto a balcony, stood on the railing, and pretended he was going to shoot himself. Big surprise, campus security showed up, assuming he had a real gun and was really going to blow his brains out. The next year, the festival banned prop weapons. IIRC if you had a scene that needed them, you could sign up to use *their* props, which would be provided for the particular scene.
Had he done the same thing on stage, introduced as a monologue he had written, with people aware the gun was a prop, no one would have freaked out.
Back to the Firefox panel, I don't know how clearly this presentation was labeled as humor. But all it takes is someone who doesn't have the full context to take it seriously -- and security people have to take threats seriously, at least long enough to investigate and find out that the gun is just a prop.
Parent
Re:NoScript (Score:5, Funny)
But...
Web 2.0!
*splutter*
Parent
GMail and JavaScript (Score:3, Interesting)
You can use GMail just fine without JavaScript. It complains and writes you a message at the bottom of every page saying something like 'To take full advantage of Gmail, use a supported browser...'
It does however still work just fine without it.
Re: (Score:3, Informative)
Re: (Score:3, Funny)
Re: (Score:3, Interesting)
[Slashdot requires you to wait between each successful posting of a comment to allow everyone a fair chance at posting a comment.
It's been 4 minutes since you last successfully posted a comment.]