Slashdot Log In
Another Denial of Service Bug Found in Firefox 2
Posted by
samzenpus
on Thu Nov 02, 2006 02:05 AM
from the be-more-secure dept.
from the be-more-secure dept.
An anonymous reader writes "A second security flaw that could cause the new Firefox 2 browser to crash
has been publicly disclosed.
The vulnerability lies in the way the open-source browser handles
JavaScript code. Viewing a rigged Web page will cause the browser to exit,
a representative for Mozilla, the publisher of the software, said
Wednesday. Contrary to claims on security mailing lists, the bug cannot be
exploited to run arbitrary code on a PC running Firefox 2, the
representative said.
This flaw in the JavaScript Range object is different than the
denial-of-service vulnerability in Firefox 2 that was confirmed by Mozilla
last week. That bug is related to a more serious security hole, which was
fixed in earlier versions of Firefox, the organization has said.
The two 'crashers' are the only publicly released vulnerabilities that
have been confirmed by Mozilla in the week since Firefox 2 was launched.
The issues are only minor, the organization has said."
Related Stories
[+]
Firefox Zero-Day Code Execution Hoax? 215 comments
Akon writes, "eWeek is running a follow-up story on the claim by two hackers that Firefox's implementation of JavaScript is critically flawed and could result in code-execution attacks. Turns out this is a possible hoax that was overblown for laughs." Mozilla's engineers say the risk is limited to a denial-of-service issue. From the article: "'As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has... I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code,' Spiegelmock said." Spiegelmock also stated that the claim that there were 30 other undisclosed exploits was made solely by his co-presenter, Andrew Wbeelsoi.
[+]
Nine Reasons To Skip Firefox 2.0 606 comments
grandgator writes, "Hyped by a good deal of fanfare, outfitted with some new features, and now available for download, Firefox 2.0 has already passed 2 million downloads in less than 24 hours. However, a growing number of users are reporting bugs, widening memory leaks, unexpected instability, poor compatibility, and an overall experience that is inferior to that offered by prior versions of the browser. Expanding on these ideas, this list compiles nine reasons why it might be a good idea to stick with 1.5 until the debut of 3.0, skipping the "poorly badged" 2.0 release completely." OK, maybe it's 10 reasons. An anonymous reader writes, "SecurityFocus reports an unpatched highly critical vulnerability in Firefox 2.0. This defect has been known since June 2006 but no patch has yet been made available. The developers claimed to have fixed the problem in 1.5.0.5 according to Secunia, but the problem still exists in 2.0 according to SecurityFocus (and I have witnessed the crash personally). If security is the main reason users should switch to Firefox, how do we explain known vulnerabilities remaining unpatched across major releases?"
Update: 10/30 12:57 GMT by KD : Jesse Ruderman wrote in with this correction. "The article claims that Firefox 2 shipped with a known security hole This is incorrect; the hole is fixed in both Firefox 1.5.0.7 and Firefox 2. The source of the confusion is that the original version of this report demonstrated two crash bugs, one of which was a security hole and the other of which was just a too-much-recursion crash. The security hole has been fixed but we're still trying to figure out the best way to fix the too-much-recursion crash. The report has been updated to clear up the confusion."
Update: 10/30 12:57 GMT by KD : Jesse Ruderman wrote in with this correction. "The article claims that Firefox 2 shipped with a known security hole This is incorrect; the hole is fixed in both Firefox 1.5.0.7 and Firefox 2. The source of the confusion is that the original version of this report demonstrated two crash bugs, one of which was a security hole and the other of which was just a too-much-recursion crash. The security hole has been fixed but we're still trying to figure out the best way to fix the too-much-recursion crash. The report has been updated to clear up the confusion."
This discussion has been archived.
No new comments can be posted.
Another Denial of Service Bug Found in Firefox 2
|
Log In/Create an Account
| Top
| 206 comments
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Old times (Score:5, Insightful)
(http://www.slashdot.org/)
We present "DOS reloaded"!
Re:Old times (Score:5, Insightful)
(http://www.daemonology.net/)
Not necessarily. Application-crashing bugs are Denial of Service bugs if they can be triggered remotely.
There's a fundamental difference between "I can make my copy of FireFox crash" and "I can make your copy of FireFox crash".
Re:Old times (Score:4, Insightful)
(http://www.squarefree.com/ | Last Journal: Saturday August 09 2003, @09:27PM)
Crash bugs in client software such as web browsers are "crashes", not "DoS vulnerabilities".
firefox 2 (Score:1)
It also has newbie's privacy bug (Score:1)
In short: Ctrl-Shift-Del doesn't delete everything you expect it to delete, your browse history can still be recovered.
I want a refund! (Score:1)
(http://www.barbieslapp.com/)
Install (Score:2, Informative)
And... (Score:2, Funny)
Yahoo! mail (Score:1)
Oo (Score:1, Offtopic)
So funny (Score:2, Informative)
When it's about Firefox, they immediatly relativate it and minimalize it. "Oh, just install noscript", "tis just a small exploit", "well, why not restart your browser? If it crashes, so what? Why don't you click the icon again? You lazy bastard!"...
I even read some comments, in reply that there's said IE 7 feels better then FF 2.0, that the faults in FF are acceptable. It's a complete double standard.
For me, Firefox 2.0 is worthless; bloathed, crashes constantly, and is just not workable anymore. I've been using Firefox from the very start, but Firefox 2.0 make me switch to Opera.
Denial of Service, my ASS! (Score:1)
(http://www.vandeenensupport.com/)
Bart
There's a browser safer than Firefox... (Score:4, Interesting)
(http://maone.net/)
... it is Firefox with NoScript [noscript.net] :)
I wrote this Firefox add-on just after one of these disclosures, because the majority of the browser vulnerabilities was JavaScript related, and the suggested work-around was always "turn off JavaScript".
Disabling JavaScript as a whole seemed quite an impractical advice to me in this AJAXified Web 2.0: I thought that maintaining a white-list of trusted sites allowed to run JavaScript and keeping all the unknown web content "static" until I decided otherwise was a still safe but more convenient approach.
Since then I've been browsing the web with my shields up (NoScript can block also Java, Flash and other plugins [noscript.net]), but I allow on the fly with one click, either temporarily or permanently, those sites which I trust and which do need dynamic client side technologies to work properly. To my surprise in 1 year and half I found few sites belonging to this category, because most places I usually browse are well designed enough to work with plain XHTML/CSS and nothing else (like Slashdot itself).
Notice: Firefox is a very safe browser because its vulnerabilities gets patched very quickly, once they're found by developers. I'm a Firefox contributor myself, and I'm very proud of the quality of the Mozilla developers community. NoScript [noscript.net], though, provides some extra protection even against those JavaScript/Java related vulnerabilities which have not been found yet...
Who needs a DOS bug... (Score:1)
2.0 Good reasons to switch to Opera (Score:1)
Talk about hypocrisy.
I'm confused... (Score:2)
So which do I trust? There's no way in hell I'm gonna actually read the article!
Third d.o.s. attack affects ALL BROWSERS! (Score:4, Funny)
IE
Firefox
Safari
Konqueror
A new denial of service attack was discovered floating in the cyberspace, that can render any browser inoperable, and it has to be forcefully crashed and reopened. The signature of the exploit was reported to be:
while(true) alert('Hahaha, suckers!');
People are advised to immediately move to Lynx: the only browser known to be immune to this attack.
Issue shrinking (TM) technology (Score:3, Funny)
They also added, that the reason the issues are minor, is because Firefox 1.5x and later releases of the popular Mozilla browser feature a special "issue shrinking" technology, patent pending, where no matter what happens, the issue becomes small.
This is opposition to Microsoft, which appears to ship all their products with "issue expanding" FUD generator technology, now considered by many specialists as obsolete, where never mind what's the trouble, it's blown out of proportions, and brings chaos and despair among geeky web users.
Why is this news? (Score:2)
(http://www.squarefree.com/ | Last Journal: Saturday August 09 2003, @09:27PM)
Why are CNet and Slashdot so interested in these particular two crash bugs? They aren't crashes that can be exploited to run arbitrary code.
Its no surprise... (Score:2)
Javascript, eh? (Score:2)
(http://www.cloudmaster.com/cloudmaster | Last Journal: Sunday May 07 2006, @10:01PM)
This is not new (Score:1)
Optionsxpress (Score:1)
How exactly is this is a security flaw? (Score:1)
This brings a question to mind... (Score:2)
(http://angrynick.googlepages.com/ | Last Journal: Saturday February 18 2006, @08:58PM)
Forgive me if this is a stupid question...I don't know much about the Mozilla org, or for that matter, how open source collaboration works in real life.
Some points (Score:2)
A non-exploitable bug is not a security flaw , it is a bug.
If there were pages with the intention to crash firefox other than those proof of concept ones. I would worry
It is not only a rule for firefox: When the initial Opera 9 had DoS exploits, nobody really abused them
It Is mostly because a good hacker would like to have the biggest odds so they target IE
In fact, no matter how vulnerable the alternatives are they are simply not targetted
I will just stick to Firefox+NoScript , I consider executing code in my computer a privilege that I would only give to certain webpages, it also saves me from the new kind of annoying popups, those that use pure html and no windows.I would say that if opera had a noscript plugin I would switch, but that's not true, I simply don't like opera mostly for interface reasons (for example the mouse doesn't become a I when you are over text, hoo) And it doesn't even allow plugins.
Crashing Browsers (Score:2)
(http://foo.ewu.edu/ | Last Journal: Monday June 18, @12:43PM)
Just crashing browsers is easy enough. Even just with HTML. Remember this story? [slashdot.org]
(A bit of self promotion.) I took his idea and incorporated it into a genetic programming system that manages to crash most browsers. It also finds HTML source that causes browsers to work for a looooonnnggg time to render a single page (in one case 19 hours for a page). The HTML is not particularly legal, but then there is no guarantee that any web page you load into a browser will follow any particular standard. Source (Java) is available at sourceforge [sourceforge.net] - unpack and look for subdirectory "html". (Warning: As this is an evolving program subject to random hackery to "enhance" things, it is commented sketchily, way underdocumented and far from pretty in most places.)
Service Denial (Score:1)
This news is for Digg not Slashdot (Score:2)
Here [mozilla.org] is an easy example, a segmentation violation by not specifying the namespace in xbl.
This is simple way to make people keep away from your site. OTOH I think I just had an idea for browser based minesweeper.
Denial of Cervix (Score:1)
Oh wait... denial of service! I need a better screen reader.
Toyota (Score:1)
DoS with JavaScript is obvious (Score:1)
JavaScript is a programming language. It is turing complete [wikipedia.org]. The halting problem for it, then, is undecidable [wikipedia.org], making it impossible for any browser to detect all infinite loops / large amounts of memory/cpu consumption.
If theory makes you gag, check out this thread [ckers.org] on JavaScript Denial of Service for a list of concrete examples. All of the samples are extremely effective at taking out all browsers (IE, Firefox and Opera alike).
I am more concerned about pages that can crash browsers without the intervention of JavaScript. This includes imagecrash (may crash you!) [ckers.org], mailto crash [ckers.org], and an huge XML file crash. [coredump.cx] They should be preventable.
Anyway, the reason why DoS's aren't actively pursued by the black-hat community is that it's very difficult to put them to good use. Sure, it will annoy someone, but it's hard to monetize, etc.
Re:LOL IE Users! (Score:4, Insightful)
(http://www.fiveeightforums.com/)
Re:See? (Score:1)
(http://shortcircuit.us/ | Last Journal: Sunday October 14, @02:01AM)
79%...78%...77%...76%...
Re:LOL IE Users, if you're stupid (Score:2)
Back when mozilla was young, certain sites would make it regularly crash. I just didn't go back to those sites. The browser was still far superior to IE, which drives me nuts if I have to use it.
Re:LOL IE Users! (Score:2)
Nobody sane ever said Firefox has no bugs and no security holes.
However, those said holes tend to be fewer than IE, less severe and patched faster.
I've got to say, that was a truly terrible troll.
Re:Ah, browsers... (Score:1)
[1] From the glossary of an Apple ][ manual.