Serious Vulnerability In Firefox 2.0.0.12 355
Oh, Not Now writes "Mozilla Firefox 2.0.0.12, mere hours old, is vulnerable by default to a directory traversal trick, via the view-source mechanism. Although mitigated by the NoScript plug-in, this is quite a serious bug — the default installation is vulnerable from the get-go."
Payload (Score:3, Informative)
Re:* Stops download of newest Firefox * (Score:5, Informative)
Re:* Stops download of newest Firefox * (Score:2, Informative)
Re:or just visit sites you trust (Score:5, Informative)
Assuming that the sites you trust haven't been compromised, this still leaves out the serious problem of attack code inserted into advertising.
nifty trick (Score:5, Informative)
While this is a really neat find, and I am glad that it will be patched pretty soon, I don't think it is quite at the level of "sky falling" etc. From what I understand, an attacker that can execute javascript in your browser has the ability to read any file in the targets mozilla directory. This worst that I think an attacker could do would be to grab your stored password file. While this is definitely something to be concerned about, the headline had me pretty worried
Re:Who cares? Use Opera (Score:4, Informative)
What all.js contains (Score:2, Informative)
huh? (Score:5, Informative)
How is this a serious security problem? (Score:3, Informative)
Scare mongering (Score:5, Informative)
Firefox is open source; anyone who wants to view view-source:resource:///greprefs/all.js can just as easily load http://mxr.mozilla.org/mozilla1.8/source/modules/libpref/src/init/all.js?raw=1 [mozilla.org] it has the same content.
all.js is *not* user data, it's *public* app data. Your preferences are stored in prefs.js which are not exposed by greprefs.
Re:Damned it all (Score:5, Informative)
Re:Fixed is hours! (Score:3, Informative)
well in their defence more people still use ie6. so they are talking about current software.
http://www.w3schools.com/browsers/browsers_stats.asp [w3schools.com]
at my job it is split about 90% ie6 v 10% ie7 for internet explorer users. thankfully the number of ie users is dropping as more switch to firefox. ie7 has speeded up that switch as many hate the interface.
but to be on topic firefox has a serious bug. i expect it will be patched in a day or so. firefox is good at that.
> Microsoft products are getting better.
only because they have serious competition from firefox, apache etc.
> Deal with it. Quit living in the past.
i don't live in the past i use linux and mac osx.
Re:* Stops download of newest Firefox * (Score:5, Informative)
What you're describing has nothing to do with Firefox. Even if Firefox frees it's memory, that freed memory doesn't get reflected in the Task Manager until the program is minimized or you wait long enough...
More info: http://www.garagegames.com/blogs/4517/11311 [garagegames.com]
"The Windows OS employs something like a memory cache for each actively running program. This cache may grow as the needs of a particular program require using magical algorithms Microsoft developers have produced for determining the optimal size for that program. For instance a program over the course of it's life time may require 20 megs of memory but occasionally needs to load data requiring allocations of up to 10 additional megs which is released seconds after it is loaded and processed. The Windows OS may determine then, that the memory cache for this program must increase from the base 20 megs to 25 megs instead. Looking at the Windows Task Manager then, you may see that this program is now using 25 megs of memory, even though currently, it may only be using 20 megs.
That is, the Windows Task Manager is reporting the memory cache allotment and not the memory allocated and used by the program. This is not the same as a memory leak. The program has little to no control over the memory cache allotment the OS has given it."
Re:* Stops download of newest Firefox * (Score:5, Informative)
To quote the link itself, where it is written in large bold print right above what was quoted (emphasis mine):
FIXED in Firefox 2.0.0.12
Re:I sure hope it's only this version... (Score:4, Informative)
Re:* Stops download of newest Firefox * (Score:1, Informative)
the Giant 16point header of "Known Vulnerabilities in Mozilla Products" kinda made me think that they were infact "Known Vulnerabilities in Mozilla Products"...lol...
However, depending on what angle you look at it from... *.12 could seems to either have more issues given that so many were fixed, OR... that the Mozilla team just didnt do much for the *.11 release.
This bug is less important than it seems (Score:5, Informative)
If you take a look at what this is doing, there's much less to it than meets the eye.
The way the page works is that it is able to load the file all.js in the greprefs directory inside your firefox installation. However, it is not *reading* this file and making it available to the javascript interpreter, it is *executing* the file. The file is a big list of browser preferences, each set with a call to a function with the signature pref(name, value). There is no code in there other than calls to pref. What the page does is define its own pref(name, value) which gets called, and the names and values are therefore available to the javascript interpreter.
So:
I would additionally point out that the view-source: part of the URI appears to be unnecessary, since at least for me (Ubuntu FF 2.0.0.12) the "exploit" worked just fine without it.
DIRECTORY TRAVERSAL? (Score:5, Informative)
From TFA: "We can trick Firefox itself in traversing directories back".
but then it says:
"we are able to read out all preferences set in Firefox, or just open or include about every file stored in the Mozilla program files directory"
Since TFA is not clear, I have tried it myself and I WAS NOT ABLE TO TRAVERSE a directory back with resource:///../
So the only files someone can read with this vuln are the files inside firefox directory which from what I can see are just default files and no cookies or passwords.
If anyone thinks any different please let me know.
Re:Damned it all (Score:2, Informative)
Re:nifty trick (Score:4, Informative)
Re:Memory Usage / No Script (Score:2, Informative)
On my box it's currently taking around 450MB. I usually kill it when it gets to around 700MB. Maybe it's because I use GMail and Yahoo! Mail open all the time?
Madness.
Mine's sitting at 68MB as I type this.
No tweaking of any sort. Just now hit 70MB
Run NoScript, too.
Re:Memory Usage / No Script (Score:3, Informative)
Well, I do have over 30 tabs open across 5 windows, and I leave it open 24/7.
Re:NoScript (Score:1, Informative)
I mean, short of outright system-compromising code, that's like target #1 for blocking right there.
Re:It must be Microsoft's fault (Score:3, Informative)
Well then, let's see!
Hmm, look pretty similar to me. Maybe that because it makes no sense if normal users cannot read and execute applications and their associated data? Program Files on Windows being readable by everyone has nothing to do with what is a Firefox vulnerability.
On the other hand I guess you're right. No "Program Files" directory on the Linux machine, it must be safe!
Re:Memory Usage / No Script (Score:1, Informative)
The first number is the virtual memory usage. The second number is the resident usage. What that means is that Firefox is in fact using nearly 1 GB of memory. However, about 500 MB of that has been paged out (ie. not stored in physical RAM, but on disk).
That's a clear sign of a pretty serious memory leak. The fact that so much of that data is paged out shows that it's not being used frequently. More specifically, Firefox has lost track of the fact that it had allocated that memory at one point. Thus it's no longer used, but since it hasn't been returned to the OS, it's still taking up swap space, even if it luckily isn't wasting physical RAM.
This bug is NOT CRITICAL (Score:1, Informative)
C:\Program Files\Mozilla Firefox\...
There is almost no data in there other than default settings.
Your private settings and cookies are in the user directory
C:\Documents And Settings\...
Re:Damned it all (Score:2, Informative)
Not exactly.... (Score:5, Informative)
Depends.
Firefox extensions (Like the oh-so-important NoScript [noscript.net] and AdBlock Plus [slashdot.org], or the must-have for every
On the other hand, web-browser plugins (like Adobe Macromedia Flash, Sun Java, etc.) are binary code in dynamically linked libraries (DLL or SO depending on what's standart on your OS). That's why there are really serious portability problems with closed source companies providing plugins compiled only for a handful of operating system (often without 64bits support).
There are two strategies :
- most of the time open-source projects use very light libraries which obtain the parameters from firefox and launch a player in a separate process that get its output embedded inside the page display (mplayer's plugin just luanch a sepparate mplayer session, gnash' plugin runs gtk-gnash to open the flash movie, webgcjplugin compiles and runs the java applet using gcj, moz-plugger is an universal embedder, etc...)
- whereas most of the proprietary project try to cram everything inside a huge DLL that runs inside firefox' own process (macromedia flash, acrobat reader {BTW who does still use that piece of junk}, etc.)
The Javascript extensions play some role because the javascript engine of current Firefox isn't very fast (Hopefully the integration of Tamarin VM in some future version will help). If a user has way too many of them, the firefox experience can become slow. But most of the time quite, the extensions are event-driven : they usually add entries in the main menu and the javascripts are only executed when the user clicks the entry.
The other problems comes with memory leaks.
- Javascript extensions, because they are only ran on demand and because of the garbage collector, aren't subject to many leaks. But anyway really badly written code can actually degrade firefox performance and eat up memory.
- Dynamically linked web browser plugins are a completely different animal : because they run inside the browser process (at least, not the open-source one which only launch an external process) if they leak memory, the whole firefox process will get its memory usage up and will only free the memory when the whole program is exited. Also, firefox isn't heavily multi-threaded and if some plugins freezes the whole program gets unresponsive (I've had some awful experience with acrobat and older versions of flash). Similarly crashes inside a dynamically linked library will bring down the whole process that called the function, and any exploit discovered inside flash can be used against firefox itself.
I strongly suspect that most of the memory leaks reported by users are actually due to browser-plugins, because I haven't experienced any leaks even if a use several extensions, whereas I don't run closed proprietary browser plugins at all (mplayer and gnash only !) because of the awful experience with acrobat and flash.
Re:* Stops download of newest Firefox * (Score:3, Informative)
Linux implements a global working set. This means that when the OS decides that it wants to remove a page from its working set (i.e. swap it to disk), it pulls that page out of all the processes that are using it (since the page might be shared), writes it to disk and marks the page as free.
Windows NT implements a per-process working set. A page is moved out of the working set of a particular process, and when it's been removed from all processes (in case it was shared), it goes into the standby cache, a sort of limbo where the page exists both in memory and disk and can't be written to (this makes it possible for the page to be moved completely to disk or back into use without further disk access). Each process has a soft minimum and maximum working set that the memory manager tries to keep a process within. Memory heavy processes have their max working set automatically expanded. Task Manager reports a process's current working set under the heading of mem usage. More pages allocated to the process may in fact be in memory in the standby list, but they won't show up in this count. Memory cached by the OS (e.g. standby cache, file cache, write cache) is not counted in the working set of any process, even if only one process is really using it. They show up as "System cache" in the performance tab, and some caches are double counted as "Available" because they can be discarded without disk access. When a process calls NtFreeVirtualMemory (the syscall for freeing private memory pages), the OS does not keep it in the process's working set. The working set is always equal or smaller than the sum of shared and private memory allocated to the process. If a process were to free all its private memory, and somehow unload all its modules and free its stack, the working set would go down to zero. A program has full control over what memory is allocated to it. It can't fully control how much of that memory is actually resident in RAM, though, and that's what is reported by Task Manager.
When you minimize a window, the Win32 subsystem sets the process's maximum working set to the system minimum, effectively moving most of its private pages into standby. Those pages will only come back into the working set as they're accessed-- it may take a long time for the working set to get has high as it was previously, and possibly never for memory leaks or unused caches. Firefox definitely implements some hefty caches.
In short: yes Windows implements a memory cache, but not for pages that have been freed.
Godwin's Law for Slashdot (Score:3, Informative)
Slashdot needs an implementation of Godwin's Law that shuts down a thread the first time Microsoft is mentioned and the topic is something that involves neither Microsoft nor any of its products.
Thankfully, that would have put this thread out of our misery almost immediately, with no one any less informed as a result.
Re:* Stops download of newest Firefox * (Score:3, Informative)
I also don't think this is related to extensions. I'm not using anything unusual (popup alt attribute, tabbrowser prefs, flashblock, web developer).