New Vulnerabilities Discovered in Firefox 1.0 406
jflint writes "Today, the security firm Secunia has released 8 more security vulnerabilities it has discovered in Mozilla products, including Firefox and Thunderbird. The exploits "could be used by criminals to spoof, or fake, various aspects of a Web site, ranging from its SSL secure site icon to the contents of an inactive tab.""
First (Score:4, Funny)
Re:First (Score:4, Funny)
Re:First (Score:3, Funny)
Re:First (Score:5, Informative)
If you have firefox 1.01 installed you have nothing to worry about.
Fixed days ago. Now thats speedy service.
Re:First (Score:5, Informative)
No, there are security advisories for firefox 1.01, like this one [secunia.com].
And the story didn't even link the vulnerability report on Mozilla Firefox 1.x [secunia.com] from Secunia. Anyway, just stay tuned and have your FF always updated.
Re:First (Score:3, Informative)
Re:First (Score:5, Insightful)
Re:First (Score:3, Insightful)
Re:First (Score:3, Insightful)
Don't forget, you also have a choice to go back to IE and OE if you feel they are more secure. The existence of choice is another important factor of OSS.
Re:First (Score:3, Funny)
New Discovery? (Score:5, Interesting)
Firefox 1.0.1 update was out before today, so did Secunia just look at what 1.0.1 update fixes and release its "bug" report, or did they discover something new to 1.0.1?
Re:New Discovery? (Score:5, Insightful)
I guess this is trumpet-blowing from Secunia, together with an advisory as to how important it is to upgrade to 1.0.1.
Re:New Discovery? (Score:5, Informative)
1) The vulnerability is caused due to the temporary plugin directory being created insecurely. This can be exploited via symlink attacks to delete arbitrary directories with the privileges of the user running Mozilla or Firefox.
2) The problem is that an inactive tab can launch an HTTP authentication prompt, which appears to be displayed by a website in another tab. This may be exploited to trick a user into entering some sensitive information (e.g. user credentials).
This is similar to:
SA12712
3) An error in the handling of shortcut files (.lnk) can be exploited to overwrite arbitrary files by tricking a user into downloading a shortcut file twice.
4) The problem is that a XML document can include XSLT stylesheets from arbitrary sites, which may be exploited to disclose some sensitive information.
5) An error in the form fill feature (autocomplete) allows reading suggested values before they are chosen. This can be exploited to disclose some potentially sensitive input by tricking a user into arrowing through some autocompleted values.
6) A memory handling error in Mozilla string classes may allow overwriting of memory if the browser runs out of memory during string growth. This can potentially be exploited to execute arbitrary code.
7) The problem is that the hostname can be obfuscated in the installation confirmation dialog by including an overly long username and password. This can be exploited to trick users into accepting installations from untrusted sources.
Successful exploitation requires that the malicious website is allowed to request installations.
8) It is possible to cause a heap overflow due to an error when converting malformed UTF8 character sequences to Unicode. This may be exploited to cause a heap overflow and execute arbitrary code, however, general web content is not converted using the vulnerable code.
9) Various errors make it possible to show the "secure site" lock icon with certificate information belonging to a different site.
Provided and/or discovered by:
1) Tavis Ormandy
2) Christian Schmidt
3) Masayuki Nakano
4) Georgi Guninski
5) Matt Brubeck
6) Independently discovered by:
* Daniel de Wildt
* Gaël Delalleau
7) Phil Ringnalda
8) wind li
9) Mook, Doug Turner, Kohei Yoshino, M. Deaudelin
Re:New Discovery? (Score:5, Informative)
i always wanted that modal dialog to be made non- and only appear for that tab (when it's in focus).
i doubt this would've prevented the bug. but the page it was appearing for would be obvious. a possible hack to that could be...have a javascript window which is already open make the connection. in that case, even if the js window is shown, with the browser most likely behind it, it wouldn't be obvious. could fix that too
Re:New Discovery? (Score:3, Interesting)
Regards,
Steve
Re:New Discovery? (Score:3, Insightful)
As another poster has pointed out, this could break timing-based stuff ..... for instance, you could not simply background a tab until the enforced-view adverts disappeared :)
Nonetheless, it'd be a good idea to allow as an option.
I thought of this too ..... if a tab wants to bring up any kind
SOP for Secunia... (Score:5, Interesting)
They're just glory whores.
Re:SOP for Secunia... (Score:5, Insightful)
And I know Secunia didn't come up with the list because
Re:New Discovery? (Score:3, Insightful)
Re:New Discovery? (Score:5, Informative)
Re:New Discovery? (Score:5, Informative)
http://weblogs.mozillazine.org/asa/ [mozillazine.org]
Re:New Discovery? (Score:2, Informative)
It looks like [mozillazine.org] they are aware of these problems and are working on them.
Re:New Discovery? (Score:5, Informative)
Asa mentioned something about server problems and activating the update for 1.0.1 later, and indeed it did show up today. Granted, it's a week since the release and that's a long time for security update... And windows-only apparently, though Linux users probably update trough their native package systems anyway.
His blog [mozillazine.org] has more.
Re:New Discovery? (Score:5, Insightful)
Like it or not, we need these sorts finding vulnerabilities before the bad guys. No software is 100% secure. But any software has a security record better than IE.
Re:New Discovery? (Score:2, Insightful)
What about Windows proper?
Re:New Discovery? (Score:5, Interesting)
Regards,
Steve
Re:New Discovery? (Score:5, Funny)
Maybe if it had comments.....
Re:New Discovery? (Score:5, Insightful)
Mozilla/Firefox has another-- XUL display. XUL is a great technology, but it is difficult to handle because the main UI rendering is too closely tied to the rendering of the web site. There is a security barrier which is designed to keep one from harming the system but it is not designed to prevent spoofing of apps. Hopefully a defence barrier can be built in.
Don't believe me? pasting this into your address bar: chrome://navigator/content/navigator.xul (only works in Mozilla)
For example, something simple like "Components in Chrome are locked by default and only unlocked components can be modified outside of Chrome" would be a nice start.
Re:New Discovery? (Score:5, Informative)
Sure, you can copy-and-paste anything you want into your URL bar, and hit enter. This takes time, and thought, and you have to look at the string in two different places, so it's reasonably secure based on that.
The only security problems that could arise would be if there were links that you could click on, or bookmark them. Try it here [68k.org] (slashdot won't let you write chrome:// URLs unfortunately). It doesn't work.
There are tons of security measures related to XPI/XUL, the Firefox team has IMHO taken an OVERLY aggressive approach to XUL/XPI issues. You know why there are several extra steps required in Firefox to install an XPI plugin [mozdev.org]? Because there were some theoretical exploits where someone might ask a user to click on a place on the screen over and over (eg. hit the monkey), and then display the XPI dialog there, and the user might end up clicking "yes, please install" before they realized that they were running potentially suspicious code. So now users have to wait a few seconds before being able to click.
Users CAN actually configure their browser to let remote sites do just about anything [mozilla.org], include read/write files, change the clipboard, etc., because this is sometimes something that's useful that users might want from a few special sites. But it's a pain in the butt to get the several security configuration settings set properly, and again, as a developer, I think they might have overdone it.
Re:New Discovery? (Score:3, Insightful)
Your see, the security barriers exist because you want to provide some functionality which is more trusted than others. This is part of the reason why IE is so darned insecure: It has too many of these security barriers.
Instead, the problem is that you have the problem that the security barriers are fundamentally permeabl
What the hell? (Score:5, Informative)
Re:What the hell? (Score:5, Funny)
Re:What the hell? (Score:2)
...only affects v1.0 (Score:2, Informative)
No worries, just keep your browser updated.
Re:...only affects v1.0 (Score:2)
They greeted this security update better than Microsoft usually does...but not much better.
Re:...only affects v1.0 (Score:2)
Re:...only affects v1.0 (Score:2)
Re:...only affects v1.0 (Score:4, Informative)
Supposedly. By my reading of Asa's blog [mozillazine.org], if you use the en-US version (most of Slashdot), then you should be able to get an update. Specifically, check out the entries localized 1.0.1 updates [mozillazine.org] and another try at update [mozillazine.org].
However, I use the en-US version, and my Firefox refuses to auto-update. So it doesn't appear to be working for everyone. (I'm behind a firewall, if that matters.)
Re:...only affects v1.0 (Score:2)
Go ahead. We don't mind. Really.
patch here (Score:5, Funny)
Re:patch here (Score:4, Informative)
oh forget it, some of you mods are dumber than a deck of cards.
Re:patch here (Score:2, Funny)
I am a deck of cards, you insensitve clod!
bizzt! (Score:3, Insightful)
Emergency! (Score:5, Funny)
Re:Emergency! (Score:3, Funny)
Re:Emergency! (Score:5, Funny)
Re:Emergency! (Score:2, Informative)
The others won't be long.
from the article:
If you have downloaded the Firefox 1.0.1 update, you have nothing to worry about. The Mozilla 1.7.6 and Thunderbird 1.0.1 released should be out this week as well.
And yet... (Score:5, Funny)
That's how the FUD engine works (Score:5, Insightful)
If you encounter bugs while using IE, it is not your fault, it is Microsoft's fault.
If you encounter bugs while using Firefox,, it is your fault - you should have been using IE. You screwed up.
That's unfortunately the mentality that will keep MS in business for a long time yet.
Re:That's how the FUD engine works (Score:5, Funny)
Given that it's a free download, if you bought Internet Explorer, you *should* be fired.
Re:That's how the FUD engine works (Score:5, Insightful)
This is funny, but very true. The same goes for MS Office documents. If you open a Word document in a different version of MS Word and it gets fragged, it's not your fault, it is Microsoft's fault.
If, however, you open that same document in OpenOffice and it renders it wrong because of some crazy layout (think table cells that span multiple pages...), then YOU are to blame. You should have "just used normal programs"...
This stuff drives me mad...
Re:..the worst infestation ever... (Score:2)
For you to become infested with spyware by viewing a web site, you either added that site to the whitelist, or you were a victim of an unreported security problem. Did you report the site that infected you to bugzilla.mozilla.org?
The downside of popularity (Score:5, Insightful)
Jerry
http://www.syslog.org/ [syslog.org]
Re:The downside of popularity (Score:2)
Re:The downside of popularity (Score:2)
Converse to your arguement, now that we have everyone completely committed to writing secure & quality code, we can stop code audits, QA, and pen testing, because hey, we have a committment to quality.
Give me a break man, it's not nearly as clearly defined as you're maki
The most important part of TFA (Score:5, Insightful)
Why this wasn't in the write up is beyond^W entirely to be expected given the recent track record of Slashdot editors... :P
It's obvious (Score:2, Insightful)
Re:The most important part of TFA (Score:2, Informative)
The vulnerabilities have been corrected in Mozilla, but the patched edition, 1.7.6, has not yet been officially released. The same goes for Thunderbird, the Mozilla Foundation's free e-mail client, which is also susceptible to the bugs. Both Mozilla 1.7.6 and Thunderbird 1.0.1 should roll out this week, Mozi
Re:The most important part of TFA (Score:5, Insightful)
Re:The most important part of TFA (Score:2)
Recent? If by recent you meant 1997 to 2012.
Security (Score:2, Informative)
The bugs have already been fixed (Score:4, Informative)
remember people (Score:5, Funny)
If in doubt about who sent the email, click on the link they provide in the email to get to your bank's website to make sure it's them.
And remember, even banks sometimes forget to get their ssl certificates in order. No worries though, MS has been focusing on security for the last couple of years and IE is almost as solid as Firefox is....
Hah! (Score:4, Funny)
Firefox bugs (Score:4, Insightful)
Every day is insecure (Score:5, Insightful)
Firewall, virus scanner, frequent updates to all software. Maybe a change in OS.
I really ignore all of these endless warnings any more and just trust that frequent updates and scans, and a reasonable amount of common sense and skepticism will protect me pretty much fully.
Re:Every day is insecure (Score:3, Insightful)
Re:Every day is insecure (Score:2)
So is Billy counting bugs to go to sleep (Score:2)
Re:So is Billy counting bugs to go to sleep (Score:2, Interesting)
Welcome to the real world. You can't have your cake and eat it.
Why doesn't Firefox 1.0 update to 1.0.1? (Score:3, Interesting)
Re:Why doesn't Firefox 1.0 update to 1.0.1? (Score:4, Insightful)
Where's the update? (Score:2, Redundant)
Food for thought... (Score:3, Interesting)
Re:Food for thought... (Score:2)
Phishing "vulnerabilities" need a special category (Score:5, Insightful)
I really have recieved real, legitimate mail from Microsoft asking me to download and apply a patch... and nobody at Microsoft I spoke to saw anything strange about it... and the IT people where I work have done the same kind of thing even after I asked them not to and they agreed they wouldn't.
The term "Security vulnerabilities" needs to be restricted to things like remote execution attacks, watering it down doesn't help anyone.
This just in... (Score:5, Funny)
More at 11.
i'll take it! (Score:2, Insightful)
Phew, I'm safe!! (Score:3, Funny)
the real difference (Score:4, Interesting)
The choice for me is not a lot different than choosing to live in the Soviet Union or the United States. I'd rather not eat the gruel (or browser) someone else thinks is all I deserve.
I find it interesting (Score:3, Interesting)
Re:Here we go... (Score:5, Funny)
Re:Here we go... (Score:4, Funny)
Re:Here we go... (Score:5, Insightful)
Try this one: How long does it take for Linux people to jump all over Windows vulnerabilities that have already been patched as a reason not to use Microsoft products?
Re:Here we go... (Score:2, Interesting)
Once found, if people want to be malicious about it, they'll release the vulnerability information to black hats, then the public, then the company(if at all). If bugs cause people to switch browsers, all that needs to be done is make su
Re:I frequently talk up (Score:5, Insightful)
Re:I frequently talk up (Score:5, Informative)
been out for atleast 2 weeks..... just because the media does not cover something does not mean it doesn't exist.
Re:I frequently talk up (Score:2)
whatever you recommend them to use, anything that fondles with data that's downloaded from random sites should be updated frequently.
i'm not entirely sure, but doesn't firefox's default start page mention if there's a new version available?
Re:I frequently talk up (Score:5, Insightful)
I disagree, though I wouldn't call your post a troll. But since I can't post and untroll you, I'll post and hope someone else might ...
You shouldn't change your tune when security holes are discovered. Security holes exist in any application. Some are discovered, and some aren't. Your defense against security holes is two fold. The first part is that you want security holes to be discovered. The second part is that you want them fixed. The FOSS ideology helps with discovering them. And Mozilla's diligence helps with fixing them ... in fact, these holes have already been fixed.
Compare this with not being able to discover security holes and not being able to fix them, and you start to see why FOSS is good and why Firefox is brilliant.
Re:Internet Commerce On Its Way Out (Score:5, Insightful)
Prediction: In 10 years, if there is no fundamental fix for these sorts of spoofs, or if the underlying model of the web is not changed, web-based commerce will be all but dead.
Are you on crack? People don't hesitate to hand their credit cards over to be carbon copied by pimply faced 17 year olds to make purchases at The Gap, why would they worry about SSL not being perfectly secure?
Re:Internet Commerce On Its Way Out (Score:4, Insightful)
Bugs aside things are just starting to look reasonable as far as SSL in browsers is concerned.
Firefox puts the "padlock" where someone will actually stand a chance of seeing it (in the urlbar) and also color codes the URL.
Opera does something similar in it's recent beta but also displays the organisational name of the certificate owner aside the padlock.
The spoofing problem isn't a fundamental flaw that is going to doom the future of browser based commerce. The reinvigoration of browser competition has started making things better for the end user.
What's the problem with credit cards? (Score:3, Insightful)
I just have to inform the card company that the transaction was not good. And I don't have to pay for it. And since it's not MY money, it's someone else's problem.
At worst, I can't use the affected card and the card company issues me a new card.
That's OK - I have more than one credit card.
I'm far more puzzled by the popularity of debit cards. If stuff happens it's YOUR money that's gone, so YOU have to be the one working your butt of
Re:THANK YOU SLASHDOT!!! (Score:2, Funny)
I only have this problem is only with the
Comment removed (Score:4, Informative)
Re:THANK YOU SLASHDOT!!! (Score:2)
What?
I never had a problem with slashdot. What exactly makes it "unreadable"?
Re:THANK YOU SLASHDOT!!! (Score:2, Interesting)
I never had a problem with slashdot. What exactly makes it "unreadable"?
Sometimes the stories or comments get shoved into the left nav. Sometimes the tables don't render at all leaving a largely blank page. This has been a problem since Netscape 7.0 came out (whatever version of mozilla that was.) In fact, when Slashdot put up the story about NS7 being release, I immediately downloaded it and just as quickly found the problem. I don't use windows much, but under linux, this has been a problem for
Re:THANK YOU SLASHDOT!!! (Score:4, Informative)
Re:Firefox ad hack! (Score:3, Informative)
I ran into that when I had IIS installed and a hosts file with many ad servers sent to 127.0.0.1.
I fixed it by turning off the Web Publishing Service.
Re:Firefox 1.0 doesn't tell you about 1.01 (Score:5, Interesting)
Interestingly, when I went through the update process, it downloaded and installed the full 1.01 package. Does anyone know if this is how updates will be done in the future, or if Mozilla will migrate to a patch system?
Re:gentlemen, start your engines (Score:2)