Firefox Vulnerability

Elizabeth

If you're using Firefox v 1.x (like me), you might want to see the latest from Secunia

BuzzLY

I can vouch for this... fortunately Norton Anti-Virus caught the 3 viruses someone tried to install on my computer. Wanna try it yourself? Do a google search for "honda vespa" (yeah, yeah) and click the first link that shows up.

Don't do this unless you have the latest NAV installed!

Pissed me off when I clicked the link.

However, I hate the idea of having to turning off Javascript. It really annoys me that I have to cripple a program that otherwise is an awesome product. Am I the only one that feels this way?

Weedpacket

Originally posted by BuzzLY
I can vouch for this... fortunately Norton Anti-Virus caught the 3 viruses someone tried to install on my computer. Wanna try it yourself?

Since mozilla.org's advisory says "There are currently no known active exploits of these vulnerabilities although a 'proof of concept' has been reported", you may want to pass that link on to them.

mfacer

im gutted to hear there is an exploit - in an otherwise perfect browser!!

ps... a google on the terms above produced this site as the number on in the UK http://www.johnsofromford.co.uk/scooters.htm and I doubt they are trying to hijack my browser!!! ;-)

piersk

Thats probably cos google have started sending you to the country version of google. I'm assuming you're in the UK, so you would automatically be sent to http://www.google.co.uk rather than .com

If you want to be sent to .com, use this address: http://www.google.com/ncr

dalecosp

Originally posted by Weedpacket
Since mozilla.org's advisory says "There are currently no known active exploits of these vulnerabilities although a 'proof of concept' has been reported", you may want to pass that link on to them.

Hmm, does look a tad spooky. The page attempts to install a Java-vm plugin/module what-have-ye....

FWIW, the URI is "buy-traffic.net/tds3/index.php" (there's some little redirect magic between google and the end page), and the code in question seems to be:

eval(unescape("%64%6f%63%75%6d%65%6e%74%2e%77%72%69%74%65%28%27%3c%66

%72%61%6d%65 ...

and so on. (I posted the whole thing and then thought better of it. Dunno how many script kiddies we have reading the EL.....

dalecosp

http://news.zdnet.com/2100-1009_22-5700204.html?tag=nl.e589

Sxooter

Originally posted by mfacer
im gutted to hear there is an exploit - in an otherwise perfect browser!!

The real issue is monoculture. As long as the number of viable browsers is > 1 we're all better off.

That and the fact that someone can update the code on their own if they want to with the Moz code base, whereas no one but MS can update IE.

No one makes perfect code, and as my dad used to say, it isn't about whether or not you make mistakes, everybody does. It's about how you make your mistakes right.

pohopo

this is a little scarey as they still do not have a fix for this. here is this story on BBC

http://news.bbc.co.uk/2/hi/technology/4532127.stm

Sxooter

Do these problems affect linux users running as non-root?

pohopo

I think it does effect Linux as some of the problems are in the browser

Danish security firm Secunia said called the flaws "extremely critical" because cookie and history information could be used to get access to personal information or gain access to sites previously visited.

I have my browser set to auto log me into many places (like this one). If I go to the wrong site it will be giving someone all my cookie info.

csn

Additionally it has been confirmed that this exploit does not only affect Microsoft Windows users but, if the code is adapted, can also affect both MacOS and *nix operating systems running vulnerable version of Firefox. The basic problem lies within Firefox's pseudo "Active-X" mechanism designed to dynamically download executable programs. When exploited here, the code uses built-in Mozilla JavaScript extensions to create a local file in a very straightforward way. Patching this particular attack vector may not be an end to this problem; which would appear to be based upon fundamental aspects of the Firefox browser (as opposed to anything isolated which a simple patch could quick fix).

http://www.whitedust.net/newsview.php?NewsID=450

As I understand it, since Mozilla changed their update URL's and if you don't add other sites (like the malicious ones) to "allow sites to install software", then you're safe.

edit - Apparently malicious sites can make installs appear to be from other whitelisted sites - like popular themes, extensions, and plugins sites.

Weedpacket

Originally posted by pohopo
this is a little scarey as they still do not have a fix for this.

Although in the meantime they do list some workarounds.

pohopo

Originally posted by Weedpacket
Although in the meantime they do list some workarounds.

Did you read what it tells you to do? It says to disable javascript on untrustworthy sites. So if I accidently click on an untrustworthy site and forget to turn off javascript I could be screwed. The other option (which is not an option to me) is completely disable javascript.

This is the type of solution I would expect MS to think up, not Mozilla who touts how they are so much more secure then IE.

the irony of it all is I am using firefox to write this, I can't live without my tabbed browsing.

Sxooter

No, the difference is MS would have known of this problem for the five months previous, not told anyone, and only disclosed the problem and workaround when someone threatened to release the information.

There are other subtle but real differences between Mozilla and Mircosoft. But the attitude of full disclosure is the big one. If you can't appreciate that, you might be better served by IE. Eyes wide shut and all that.

pohopo

Sxooter, good point. I am not trying to bash Firefox, it is just this is not a small bug and I feel it is being glossed over because it is from Mozilla. Had IE had a bug like this (and told people right away) people here would of went off on MS.

Well, I am done with this. I still have lots of love for Firefox. 🙂

Sxooter

I Wasn't trying to bash you. I definitely do not feel it is being glossed over.

Let me ask you, what would you have Mozilla do differently, in terms of a work around? They don't have a patch ready, and the only protection is to turn off javascript, so, what else should they do?

IE has bugs like this all the time. And people do go off on them. But i think it's more because they have these kinds of problems all the time.

This problem certainly isn't being glossed over by the tech press, which has had articles on it on the web since day one.

csn

Originally posted by Sxooter
No, the difference is MS would have known of this problem for the five months previous, not told anyone, and only disclosed the problem and workaround when someone threatened to release the information.

...And if there was a threat to their marketshare.

pohopo

Firefox 1.0.4 is now out which fixes the critical bugs. Update ASAP!!!

Weedpacket

Hmmm....Let's see....

CAN-2005-1476
Firefox 1.0.3 allows remote attackers to execute arbitrary Javascript in other domains by using an IFRAME and causing the browser to navigate to a previous javascript: URL, which can lead to arbitrary code execution when combined with CAN-2005-1477.

Vulnerability assigned: 9 May, 2005
Fix deployed: 11 May, 2005

CAN-2005-0555
Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability."

Vulnerability assigned: 26 February, 2005
Fix deployed: 12 April, 2005.