5221489
story
Comments: 156 +- Technology: Firefox 3.5's First Vulnerability "Self-Inflicted" on Thursday July 16, @09:25AM
background: url(//a.fsdn.com/sd/topics/topicmozilla.gif); width:80px; height:64px;
mozilla
background: url(//a.fsdn.com/sd/topics/topicinternet.gif); width:70px; height:73px;
internet
background: url(//a.fsdn.com/sd/topics/topicsecurity.gif); width:59px; height:78px;
security
CWmike writes "Mozilla has confirmed the first security vulnerability in Firefox 3.5, saying that the bug could be used to hijack a machine running the company's newest browser. A noted Firefox contributor called the situation 'self-inflicted' and said it was likely that the hacker who posted public exploit code Monday became aware of the flaw by rooting through Bugzilla, Mozilla's bug- and change-tracking database. The vulnerability is in the TraceMonkey JavaScript engine that debuted with Firefox 3.5, said Mozilla. '[It] can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code,' Mozilla's security blog reported Tuesday."
Related Stories
"This generation may be the one that will face Armageddon."
-- Ronald Reagan, "People" magazine, December 26, 1985
All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.
Foundation, Not a Company (Score:3, Informative)
Mozilla has confirmed the first security vulnerability in Firefox 3.5, saying that the bug could be used to hijack a machine running the company's newest browser.
Just a note, I think Mozilla tries to shirk any idea of "company" or "corporation" from the open source development side of things. Instead, they are a non-profit foundation [mozilla.org] and recently created a separate taxable corporation [mozilla.org] with the intent of distribution and productizing Firefox & Thunderbird.
I think the word 'company' implies commercial interests and the developing part of Mozilla--the Foundation--does not have any commercial interests. While this may seem unimportant to you, I believe it to be a pretty important concept to clarify when you're talking about open source from a non-profit and open source from a company.
Re:Foundation, Not a Company (Score:5, Interesting)
Your issue isn't with the technical use of the word, but diction, its implied meaning and associations. That being said, the use is technically incorrect but not artistically apt.
Where the Hitchhiker's Guide is in error, it is definitively so. This means that Reality is the one who got things wrong. So when the publishers of the Hitchhiker's Guide got sued by the families of tourists who took literally the sentence 'Vicious Bugblatter beasts often make a good meal for visiting tourists' which should have been rendered 'Vicious Bugblatter beasts often make a good meal of visiting tourists', the publishers brought in a poet to testify under oath that the second sentence is the more aesthetically pleasing of the two, and that Beauty is Truth and Truth, Beauty. They argued then that Life itself was the culprit for being neither beautiful nor true. In a startling decision, the judges agreed, holding Life in contempt of court and confiscated it from everyone present before going out for a round of Ultra-golf.
Parent
Re:Foundation, Not a Company (Score:4, Funny)
Right_Here [youtube.com]
Parent
Re: (Score:3, Interesting)
The Mozilla Foundation's about page says:
The Mozilla Foundation is a California non-profit corporation exempt from Federal income taxation under IRC 501(c)(3). It is governed by its Board of Directors.
I am not sure about US usage, but in the UK and many other countries a corporation created by registration (with the registrar of companies - Companies House in the UK) is correctly referred to as a company, regardless of whether it is a profit making or non-profit company.
Re: (Score:3, Funny)
Re: (Score:3, Insightful)
Re:Foundation, Not a Company (Score:4, Insightful)
Geezus....I should probably stop reading this site, it seems that everyone is so sure of themselves and are ALWAYS in the right that you actually have time to quabble over insignificant details. yeah he may have been incorrect (doubtful!) but do really think that the point was lost to anyone that read it? or caused ANY confusion? Why bother then?
get over yourselves, we aren't all born perfect, and may make mistakes. There is absolutely no reason to jump all over somebody for such a piddly mistake, EXCEPT TO BOOST YOUR OWN EGO!
rant off....
Parent
Right! Quick! (Score:2)
Everyone download NoScript Pronto!
Re:Right! Quick! (Score:5, Interesting)
Ended up going back to noscript recently but it really is an ugly solution, yesscript is only helps against tracking. What is really needed is a good guide for using controldescripts (or a similar extention) allowing all sites to access a list of known safe fucntions (to let you browse the web without it getting in the way), some to be blacklisted (to protect you from tracking), an easy GUI way to allow a greater subset of functions to be accessed (for trusted site) and an security workarounds to stop any vulnerabilities working in the wild.
Parent
Re: (Score:3, Informative)
NoScript: http://noscript.net (Score:5, Informative)
The official NoScript site is http://noscript.net/ [noscript.net].
To anyone who doesn't already know: NoScript prevents Javascript scripts from running unless they are chosen from a menu. That even protects against vulnerabilities that haven't been discovered yet.
Parent
Re: (Score:3, Insightful)
Right, now where do we find something to protect us against NoScript and its attempts to take control over our browsers?
Re: (Score:3, Informative)
And how are readers to know that your link is any more valid than mine?
Actually, the safest way to link to extensions would be through Mozilla's Own Site [mozilla.org]. That page should have the actual category.
Maybe off topic but... (Score:3, Informative)
Has anyone notice performance degradation in 3.5? Opening a slew of bookmarked pages into tabs tends to make it feel like my internet connection has slowed down. Yet when all the tabs load, they all respond snappily.
And sometimes certain sites act sluggish when opening the same exact site works fine in Safari.
It wasn't like this in 3.01
Re: (Score:2, Interesting)
Yes, but a single Slashdot article with comments loads at least 30% faster, and I do that a lot more often than opening a ton of bookmarks in tabs. I think on the whole it saves me a lot more time than it costs.
Unacceptable (Score:4, Funny)
What do you mean there is a security exploit in a brand new version of a web browser? This is crazy, new versions of software should always be more secure then the previous versions.
Personally I'll be sticking with IE6, I never bought into this whole "Firefox" thing.
Wimp! (Score:3, Funny)
I only use IE 5.5!
Re:Wimp! (Score:4, Funny)
Pshaw. I use telnet, and read the native code. I don't even see the code anymore... Blonde, Brunette, Red-Head...
Reading sites that use SSL is a bit tricky, though.
Parent
Yeah, right (Score:5, Funny)
'[It] can be exploited by an attacker who tricks a victim into viewing a malicious Web page containing the exploit code,' Mozilla's security blog reported [mozilla.com] Tuesday."
Oh sure, I'm definitely going to follow that link now.
Re:Yeah, right (Score:5, Informative)
http://www.cutekittens.com/ [milw0rm.com] how about that one? :D
Oh man, that site is AWESOME!!! I can't believe what those women were doing. I can't believe it's a free site. Thanks!
Parent
WTF (Score:3, Interesting)
Nice attitude, guys...
Re:WTF (Score:5, Insightful)
Parent
Re:WTF (Score:5, Insightful)
So when they know about and are actively working on fixing a bug that is an exploit vulnerability, you think they should do it in public?
I get the argument that telling your users about it means that they can protect themselves (say, by running noscript), but for a consumer facing organization like Mozilla, the majority of users aren't going to notice or do anything.
Parent
Full disclosure (Score:2, Insightful)
Go on and mod me troll but, IMNSHO, this is just a display of the expertise of the full disclosure movement: Just post a test-case from an open bugtracker as your own exploit and enjoy your 15 minutes of fame amongst all the other skript-kiddies.
Well done, hacker!
Re: (Score:3, Interesting)
Mozilla doesn't even practice full disclosure. They normally hide security bugs from the public, but they missed this one, as well as not fixing it before 3.5's release.
Unless you're seriously suggesting that all bugs should be hidden from the public on the off chance they'll be exploitable, meaning a lot more duplicate bug reports, no independent confirmation of a bug's existence, and an inability for anyone else to fix the problem, except those granted permissions to read bugs.
Temporary fix (Score:5, Informative)
According to TFA, the temporary fix is to disable TraceMonkey (JavaScript will still work). Set 'javascript.options.jit.content' in about:config to false until the patch is released.
MOD PARENT UP (Score:5, Insightful)
Mod Parent Up "this should have been in the summary, Taco".
Parent
Re: (Score:3, Insightful)
Except then the bug is patched, and all of a sudden you aren't running the default settings for FF and things get weird.
I've got at least a dozen non-default settings I've set in about:config. What's one more?
Re:MOD PARENT UP (Score:5, Funny)
at least a baker's dozen?
Parent
Why didn't you post the (simple) fix??? (Score:3, Informative)
Why not post in the summary the simple fix?
In lieu of a patch, users can protect themselves by disabling the "just-in-time" component of the TraceMonkey engine.
To do that, users should enter "about:config" in Firefox's address bar, type "jit" in the filter box, then double-click
the "javascript.options.jit.content" entry to set the value to "false." The popular NoScript add-on will also ward off attacks.
Re: (Score:3, Interesting)
It basically just puts you back to 3.0 mode.
Glad I didn't rush to upgrade (Score:3, Interesting)
Sometimes it's better to just hold back and wait until my distro decides it is time to update my versions.
Why do we trust Javascript all of a sudden (Score:4, Insightful)
Is it just me who remembers the days when the only way to browse safely was to turn off Javascript? Now we're all drinking the web 2.0 kool aid it seems we've forgotten how many browser vulns are Javascript-related. Websites should never depend on Javascript to function properly but now we have point 'n click JQuery, Dojo etc. it seems websites are built on Javascript foundations with all the security issues that implies.
Re: (Score:3, Insightful)
But there have been many browser exploits recently, and they've been in virtually every component of the browser. This flaw has nothing to do with JavaScript itself, just the implementation. Flaws have been found in XML and HTML rendering engines, third-party components, URL handlers and many other pieces of the browser. If we're going to disable every feature that's potentially vulnerable, we might as well stay off the Web.
Re: (Score:3, Informative)
They already had a standing policy of hiding security related bugs (I.e. those that they figured were exploitable; It is even discussed in the log linked in the summary!).
Re: (Score:2)
Re: (Score:2)
Re:Nice test for the open source community (Score:5, Informative)
If you had read the bugzilla thread (I know, I know) you'd know it's already fixed ;)
Parent
Re: (Score:3, Interesting)
They haven't released an update yet though, which is probably the more interesting event.
Re: (Score:3, Insightful)
They haven't released an update yet though, which is probably the more interesting event.
That's true of course. And I don't want to split hairs but point out the open source nature of the Firefox browser:
The patch is already available.
Re:Nice test for the open source community (Score:5, Insightful)
But, the majority of users only update firefox when it pops up a "hey, there's an update. Click here!" prompt.
The issue is unfixed for 90% of users until that occurs.
Parent
Re: (Score:3, Funny)
It's called fdisk
Re: (Score:2)
Just remember to start counting from the day the bug was reported and not from today.
Re: (Score:2)
Re: (Score:2)
Re:the only browser with 0 vulnerabilities (Score:4, Informative)
is Google Chrome...
Nope:
http://chromekb.com/vulnerabilities/ [chromekb.com]
The attitude that some platforms are simply immune to attacks is foolish and counterproductive.
Parent
Re: (Score:3, Informative)
fixed, but not pushed out yet. For the 'days to a fix' count, you need to count all days from the time the hole was discovered to the day a fixed version / patch is pushed out to users. (if I have to go looking for it, it's not 'fixed' yet) Most people are trained to only respond to Firefox's Update popups.
Re:This is why NoScript should be a core feature (Score:5, Informative)
NoScript got buried after the incident with it fucking around with AdBlock's settings, then once that was discovered and pointed out, them adding an AdBlock filter set to bypass blocking on NoScript's author's site.
As far as I know, it does neither any more, but it pissed off a lot of users, myself included, and its author's reputation went through the floor.
Parent
Re: (Score:3, Insightful)
Of course, NoScript can also be configured as opt out. It might make a lot of sense to incorporate it defaulted to opt-out and let the user make it opt-in if they like.
The browser's job is to do what the user wants it to do as it relates to browsing.
Re: (Score:3, Insightful)
323 // 0: no restrictions - divert everything // 1: don't divert window.open at all // 2: don't divert window.open with features
324
325
326 pref("browser.link.open_newwindow.restriction", 2);
See http://hg.mozilla.org/mozilla-central/annotate/94909af358c4/browser/app/profile/firefox.js [mozilla.org]