Slashdot Log In
Firefox 3.0.1 Fixes 'Carpet Bombing' Issue
Posted by
CmdrTaco
on Thu Jul 17, 2008 11:29 AM
from the break-out-the-bug-spray dept.
from the break-out-the-bug-spray dept.
An anonymous reader writes "Firefox 3.0.1 was released today. It fixes 3 security vulnerabilities, including a critical issue reported by Billy Rios, Ben Turner, and Dan Veditz. The issue could be combined with an issue in Apple's Safari browser to read data from the user's disk or to execute arbitrary code. This issue was previously discussed on Slashdot.
The release also fixes a remote code execution bug involving the CSS reference counter, reported by the Zero-Day Initiative (previously discussed on Slashdot here), as well as a Mac-only potential code execution bug involving GIF image rendering, reported by Drew Yao of Apple Product Security."
Related Stories
[+]
A Few Firefox 3 Followups 407 comments
An anonymous reader writes "Using data generated by the Mozilla Firefox download pledge page, the map on this blog post ranks countries, not by absolute number of pledges made, but rather on a per capita basis. This analysis yields some interesting conclusions about where open source is strongest and weakest."
Anonymous Warthog writes "That didn't take long. In a blog posting from the TippingPoint DVLabs security team (of Kraken and CanSecWest hacking contest fame), they confirmed that they reported a vulnerability in Firefox 3.0 to Mozilla a mere five hours after it was released. Additionally, there was a posting on the Full Disclosure security mailing list from someone that purports to have another vulnerability in the works as well. In the grand scheme of things, this probably means nothing to the general security of Firefox, but you can be sure the browser zealots on all sides will be watching carefully."
Finally, from reader Toreo asesino: "Microsoft have congratulated the Mozilla team by sending them their second cake (minus recipe) to Mozilla's Mountain View headquarters to congratulate them on shipping FireFox 3, which went live right on time last night." Congratulations are indeed due on both the browser and the release process — looks like the Firefox fever (despite some seriously taxed servers) resulted in more than 8 million downloads in 24 hours.
[+]
IT: Safari "Carpet Bomb" Attack Still a Risk 117 comments
SecureThroughObscure writes "Just a short time after Apple's recent acknowledgment of and patch for the Safari Carpet Bomb 'blended' IE flaw, Microsoft researcher Billy Rios shows that Safari is still useful in a blended attack, this time with Firefox 2/3. (ZDNet's Nate McFeters also spread the word.) Rios claimed that he is able to use Carpet Bomb, despite the recent patch, to steal arbitrary files from victims who also have Firefox 2/3 installed. Both Rios and McFeters pointed out that Apple, which took some heat for not originally patching, actually did a good job of addressing the issue, as the code execution angle was not originally understood (the details came out later). Rios is withholding details of the new attack vector until Apple has had time to patch or respond to this issue."
Submission: Firefox 3.0.1 fixes 'carpet bombing' issue by Anonymous Coward
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
no crashes yet (Score:3, Interesting)
crash crashing or? (Score:5, Informative)
For anyone on a slow connection or with an old machine (like me) that was almost a showstopper. Thankfully, *seems* to be fixed now.Haven't seen any real crashes to the desktop even with the betas...
A workaround is to go Tools->Options-> Security and turn off the attack site and forgery options.
Andy
Parent
Re: (Score:2)
Mine crashes every time I run it, but that's due to either no libpangocairo or no GTK+ 2.10 or someone deciding I shouldn't have permissions to be able to run X applications on that machine. But then that's probably not considered crashing as it never got running properly in the first place. So I'm running 2.0.0.16.
At least I solved one of the crashes I used to get with it: a very long Javascript bookmark in the toolbar to open a Javascript console would crash the browser if it tried to display as a tooltip
And this is why... (Score:2, Insightful)
... I didn't download Firefox 3 when it came out. In fact, I'm still on Firefox 2, and I'm sure a good percentage of fellow /.ers are as well.
Remember: if there aren't any patches for it, chances are that the reason is not that it's bug-free, but that it's still buggy.
Re: (Score:2, Insightful)
I finally upgraded last night. So far, so good - it's certainly faster, and the most important mods to me (CSL and NoScript) seem to be working just fine.
Of course, if it isn't all good then I'm screwed now, but c'est la vie.
Re: (Score:2)
Re: (Score:3, Insightful)
Chances are that the reason is not that it's bug-free, but that it's still buggy.
Chances are that you are not a developer.
"He who is without a sin throw the first stone."
Re:And this is why... (Score:5, Informative)
... I didn't download Firefox 3 when it came out. In fact, I'm still on Firefox 2, and I'm sure a good percentage of fellow /.ers are as well.
Um... the carpet bombing vulnerability also affects Firefox 2. It looks like someone is in trouble :)
Parent
"awesome bar" (Score:2, Interesting)
Re:"awesome bar" (Score:5, Informative)
1. Type about:config into the location bar and change the value browser.urlbar.matchOnlyTyped to true. After this, you need to restart Firefox. All this does is make it so that Firefox only searches the URLs you have typed and not the titles of pages.
2. Install the Old Location Bar extension. This changes the location bar so that it looks like how it looked in Firefox 2. As of me writing this post, it is an experimental addon so you will need to register to the Firefox addon service to install it.
Parent
Re: (Score:2)
Re: (Score:2, Funny)
I kinda like the so called awesome bar. What's wrong with it?
The oldies want their URL bars to match URLs and those pesky kids to GET OFF THEIR LAWNS!
Re: (Score:3, Insightful)
I've used it once to date, when going back to a walkthrough page on gamefaqs. 99% of the time, I know the address I'm going to, or I have it bookmarked, so the "awesomeness" is wasted on me.
Re: (Score:2)
Matching co to .com is obviously a bug. As for those that remembers URLs, it is admittedly not too useful.
That being said, if you are someone with a lot of bookmarks, it can really speed up looking for something in your bookmarks. It also brings this search ability to every page in your history, which is great for the unwashed masses that either don't understand bookmarks (really!) or just don't use them for whatever reason.
Re: (Score:3, Informative)
Lifehacker [lifehacker.com] has instructions on how to restore the yellow for SSL sites, among other nice UI changes (such as removing the Go and Search buttons from the Address and Search bars, respectively). It does require an extension (either Stylish or Greasemonkey), but it definitely works, I've been using this at home for a few weeks now.
Re: (Score:3, Insightful)
Re: (Score:2)
Re: (Score:3, Insightful)
Yeah, well, the FF2 bar wasn't all that hot either. The only thing more annoying than waiting for the list of sites to never come up because you started typing while another tab was still loading, is having the list of sites popup while you're typing and since you had the mouse in the wrong location when you hit enter you went to some completely different place than you had expected.
I don't care whether it's awesome or not, give me an option to make it not appear unless I press down or alt-down or tab or s
A brief future history of the awesome bar (Score:3, Insightful)
Let me save you some time and map out your journey to acceptance of the awesome bar.
First you hate it, because it's new and different to what you expect. You are trained to use it as an address bar and nothing else, so it acting like a search bar is confusing and suboptimal to you.
At this point many people decide to trial the new bar, but you are the kind of person who tends to think he (forgive me, but he) knows what's good and what's not, and even quite enjoy the idea of customizing your Firefox. So you l
To to prevent the issue I need to use Firefox? (Score:5, Funny)
I had to giggle at the workaround. To prevent a firefox flaw from biting you, you need to have firefox open. Phew, I'm so glad I'm safe.
When will Microsoft fix IE? (Score:3, Interesting)
So far as I know, the only application that normally runs with its current directory on the desktop (and is thus a potential target for any successful exploit of this issue) is Internet Explorer.
Re: (Score:2, Interesting)
maybe I'm misunderstanding you, but I know a lot of people that change their download directory default in Firefox to the desktop.
Re: (Score:3, Informative)
Re:When will Microsoft fix IE? (Score:4, Informative)
When you run an application from Windows Explorer, it is normally run with its current directory set to the directory that the executable is located in. The vulnerability exposed by the "carpet bombing" attack involved attacking Internet Explorer, because Internet Explorer runs with its current directory set to the desktop... not the directory containing the IE executable. There is no obvious reason why IE does this, nor any reason I can come up with for Microsoft not to change it.
Parent
Workaround (Score:4, Informative)
This attack only works if the user is using another internet-connected application with Firefox not running. Using Firefox, or making sure it is at least running, prevents this attack.
So as long as you use Firefox all day long, you will not be affected.
Re: (Score:2)
As more and more applications are becoming Web Based. Developers having 1 browser open is stupid, as they need to test different environments.
Re: (Score:2)
Or use the IE tab extension...switches rendering in a heartbeat. That takes care of two of the browser.
Re: (Score:2)
Re: (Score:3, Funny)
"But boss, I have to browse the Web all day."
Another software release post? (Score:3, Interesting)
Re: (Score:2)
Slashdot needs a "important software updates" section.
In addition, or as a replacement for, the "stuff that matters" section?
I didn't even know there was a problem. (Score:2, Informative)
Re: (Score:2)
Ok, seriously: what are these memory issues everyone keeps bitching about? I keep open a considerable selection of tabs myself with low memory usage...and I haven't even made the optimizations for lower memory usage. I'm yet to see any evidence of these "memory issues".
Re: (Score:3, Informative)
Ubuntu Repos (Score:3, Interesting)
Re: (Score:3, Interesting)
I would guess you have the 'proposed' repository enabled.
Re:Who Cares... (Score:5, Informative)
Actually, it's a .0.1 release. Firefox 3.1 (alpha due this summer) has a lot of new features that didn't make it in time for 3.0.
Parent
Re:Who Cares... (Score:4, Interesting)
I for one, welcome our browser caring overlords.
My issue is that "No one cares when Opera or Safari have a similar release. [or Internet Explorer, or Konqueror...]" but they do when its Firefox.
Opera 9.51 went through a few RC's and a final and is on 9.52RC/Snapshot, Safari has gone through a couple *.*# and a whole #.0 in the last few months for Mac, Win and Mobile...
But no, Firefox 3.1 Sub-Alpha-Hypothetical-Possibility-Beta-RC Build 3219 hits front page and we're supposed to eat a cracker drink some wine and pray to it, but oh wait, we're all for competition and innovation, as long as its Firefox Vs. Firefox.
(stomps off)
Parent
Re: (Score:3, Interesting)
Your post is sorta worded as flamebait to some, but it does have truth. It doesn't take a statistician or a complex algo to add up how many postings have been about FireFox in the past 6
Re:Who Cares... (Score:4, Funny)
And Internet Explorer is still going through lots of *&^%$#@!
Parent
Re: (Score:3, Informative)
And Safari and Opera are both non-free so they are more reluctant to give detailed fix reports.
http://my.opera.com/desktopteam/blog/ [opera.com]
Re: (Score:3)
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox. I don't recall paying to download either Opera or Safari for my desktop and laptop. Yes, I do know opera charges now for the Wii browser, but I don't have a Wii.
Re: (Score:3, Informative)
Non free? I believe you mean they have a proprietary source code, as opposed to open source like firefox.
Safari is Open Source. Head over to WebKit.org [webkit.org] and you can get the source via Subversion or browse it via Trac. It's licensed under a mix of LGPL and BSD licenses.
Re:Who Cares... (Score:5, Informative)
Safari is closed source. WebKit (the layout engine Safari uses) is open source, but the builds used by Safari rely on a binary closed source blob from Apple. If you value software freedom, you shouldn't use Safari.
Parent
Re:Who Cares... (Score:5, Informative)
no, Safari isn't open source, WebKit is open source, because it is based on khtml.
Parent
Re: (Score:3, Informative)
Re:Who Cares... (Score:5, Funny)
It seems you haven't run Windows Update for a long time then...
Parent
You may find this useful (Score:3, Informative)
http://dictionary.reference.com/search?q=irony [reference.com]
Re: (Score:2)
The Firebug version [mozilla.org] from July 14 seems to work fine on Firefox 3.0.1 for me.
Re:Addons? (Score:4, Informative)
when the authors update them?
of course, you could google for a couple of seconds and fix it yourself (hint: you can force it to ignore the version)
Parent