Unpatched Firefox Flaw May Expose Users

Corrado writes "CNET is reporting on a new Firefox flaw." From the article: "The problem lies in the way Firefox handles Web links that are overly long and contain dashes, security researcher Tom Ferris said in an interview via instant messaging late Thursday. He posted an advisory and a proof of concept to the Full Disclosure security mailing list and to his Security Protocols Web site...The public bug disclosure comes just as Mozilla released the first beta of Firefox 1.5. The final release of the next Firefox update, which includes security enhancements, is due by year's end, according to the Firefox road map."

This is impossible!

[pdpTrojan]

Firefox is open source... how can it have a bug in it? Lol, they must have meant Internet Explorer!

Everybody knows that security flaws are only available in Microsoft products. I read it on Slashdot!!! It has to be true!!!

Expose users?

[jdray]

Did anyone else have a sudden concern that using Firefox would cause you to be "pants'ed"?

Patent infringement

[confusion]

I thought MS had a patent on unpatched browser flaws?!?!?

Jerry
http://www.cyvin.org/ [cyvin.org]

more info at

[jbeaupre]

more information on the bug at: www.youissostupid.ru/scriptyuiopuioqwhjklfashuiopy uiopuiopuiopuouihjklasd-2789789-hfsjadkhuiof

Re:Flaws

[Anonymous Coward]

How on earth can the first post be redundant?

Year's end?

[Swamii]

This is why open source is better! M$ expects me to wait until year's end for a patch?! What am I supposed to do until then, hide in a cave?

What's that you say? This isn't an article about Microsoft?

Oh, nevermind then.

Re:Expose users?

[.sig]

I'm counting on it, I'm passing out copies of firefox to all the women I know....

Re:not crashing

[kryten_nl]

Clippy: 'If you would like to see the BSOD: create a new Word document, make it 50 pages long and try to save.'

Similar Bug

[MobileMrX]

I saw a similar bug IRL.

This guy was driving and navigated to a bunch of yellow dashes in succession.

This method of action caused his car to crash.

I've only been able to replicate this bug on roads with > 2 cars.

Anyone experience this?

/waiting for roads v1.5

Firefox is the fix for Internet Explorer problems.

[CyricZ]

Indeed. The main update/fix for Internet Explorer-related problems is Firefox. So that should always be the first solution proposed. That in turn directly leads to my proposal: always keep your non-technical friends' Firefox installations up to date.

Patch available

[Frankie70]

You can download a fix here [microsoft.com]

Re:Expose users?

[Anonymous Coward]

So that's one person (including your mom) then?

Re:Expose users?

[iceborer]

Since you're a /. member, I would have thought you'd installed Firefox for your mom and little sister already.

Re:It should be noted

[Delphiki]

So if person P is skeptical of claim C about entity E, then it logically follows that P thinks that E "can do no wrong"? That sounds a like a fringe-whacko line of thought to me.

You don't really want to get into the business of pointing out wackos on slashdot. It's easily a full time job and it doesn't pay.

Re:exploits?

[sbrown123]

I take that back. I did find one of his recent exploits (actually its a DoS) that Microsoft actually made a patch for:

http://www.microsoft.com/technet/security/bulletin /MS05-041.mspx [microsoft.com]

The funny thing is his note: "As I previously reported, there is a remote kernel denial of serivce vulnerability with the Remote Desktop Services protocol which affects every verison of Microsoft Windows. "

Last time I check, RDP is not on older versions of Windows. Again, blown out of porportion for such a minor bug.

Re:Expose users?

[sootman]

No worries, the patch is here: http://www.mozilla.org/patch-to-fix-the-problem-wi th-firefox-where-long-URLs-with-lots-of-hypohens-c an-cause-bad-things-to-happen-like-the-browser-wil l-crash-and-stuff.html [mozilla.org]

Re:This is impossible!

[Wontsomebodypleaseth]

You Sir are an idiot

Re:This is impossible!

[Anonymous Coward]

No, he's a Windows troll. They are rare, we should put him in a cage for everyone to see.

Re:Expose users?

[Anonymous Coward]

Damn you, I clicked on that link!

Re:Expose users?

[Jerry]

Sorry, that URL didn't work. :-)

404: File Not Found /patch-to-fix-the-problem-with-firefox-where-long- URLs-with-lots-of-hypohens-can-cause-bad-things-to -happen-like-the-browser-will-crash-and-stuff.html

We are sorry, the file you requested could not be found.

Referring page:

http://it.slashdot.org/article.pl?sid=05/09/09/133 6253&threshold=0&tid=128&tid=154 [slashdot.org]

The link you clicked to get here is either misspelled, outdated, or may just never have existed. You can use the links on this page or the search Mozilla feature at the top to find the document to find what you were looking for. You may want to notify the webmaster of the referring page of the dead link.