Firefox.. whoops

[TheEnforcer]

http://news.yahoo.com/s/pcworld/120756

ritical Flaw Found in Firefox Matthew Broersma, Techworld.com
Mon May 9,11:00 AM ET



Firefox has unpatched "extremely critical" security holes and exploit code is already circulating on the Net, security researchers have warned.

ADVERTISEMENT

The two unpatched flaws in the Mozilla browser could allow an attacker to take control of your system.

A patch is expected shortly, but in the meantime users can protect themselves by switching off JavaScript. In addition, the Mozilla Foundation has now made the flaws effectively impossible to exploit by changes to the server-side download mechanism on the update.mozilla.org and addons.mozilla.org sites, according to security experts.

The flaws were confidentially reported to the Foundation on May 2, but by Saturday details had been leaked and were reported by several security organizations, including the French Security Incident Response Team (FrSIRT). Danish security firm Secunia marked the exploit as "extremely critical", its most serious rating, the first time it has given a Firefox flaw this rating.

In recent months Firefox has gained significant market share from Microsoft's Internet Explorer, partly because it is considered less vulnerable to attacks. However, industry observers have long warned that the browser is more secure partly because of its relatively small user base. As Firefox's profile grows, attackers will increasingly target the browser.

Two Vulnerabilities Found
The exploit, discovered by Paul of Greyhats Security Group and Michael "mikx" Krax, makes use of two separate vulnerabilities. An attacker could create a malicious page using frames and a JavaScript history flaw to make software installations appear to be coming from a "trusted" site. By default, Firefox allows software installations from update.mozilla.org and addons.mozilla.org, but users can add their own sites to this whitelist.

The second part of the exploit triggers software installation using an input verification bug in the "IconURL" parameter in the install mechanism. The effect is that a user could click on an icon and trigger the execution of malicious JavaScript code. Because the code is executed from the browser's user interface, it has the same privileges as the user running Firefox, according to researchers.

Mozilla Foundation said it has protected most users from the exploit by altering the software installation mechanism on its two whitelisted sites. However, users may be vulnerable if they have added other sites to the whitelist, it warned.

"We believe this means that users who have not added any additional sites to their software installation whitelist are no longer at risk," Mozilla Foundation said in a statement published on Mozillazine.org.

[Inabon]

i have told a lot of people just because it isn't MS it doesn't mean its good. i rather have MS and know they fuck up than wonder around with something that should not fuck up and it does

besides from what i gather their patch up time is like mega slow jajaja

bill is an expert patching.

[Trev]

Originally posted by Inabon@May 9 2005, 09:37 PM
i have told a lot of people just because it isn't MS it doesn't mean its good. i rather have MS and know they fuck up than wonder around with something that should not fuck up and it does

besides from what i gather their patch up time is like mega slow jajaja

bill is an expert patching.

I'll take knowing it's got leaks, over thinking it's bulletproof...

At least it prompts me to cover my ass (Pushpills don't say a mother fucking word!)

[TheEnforcer]

Yeah.. I know what I am getting with IE and Bill.

[raymor]

The timeline on this bug is intersting to me.
A patch to fix it was avaliable within 6 hours
after the exploit was posted and within 18
hours people who had not patched were protected
by changes to the mozilla.org update server.
This shows the power of open source when compared
to the months or even years a certain proprietary
browser maker has taken to release security updates
after the exploits were public.

2005-05-07 16:26 PDT Original posting of vulnerability
2005-05-07 22:32 PDT Patch to fix it available through bugzilla
2005-05-08 09:57 PDT or earlier Mozilla.org adjusted to protect even users who had not patched Firefox.

[Newton]

open source everytime

[Inabon]

LOL this is a dead point.

ok opensource is good.

hell it is free


MS sucks hell but everyfucking body in this world has it.

and dont even mention mac cause that will really make me

so yes cool firefox is fixed. i still don't use it.

and so does a big percentage of the world.

[Trev]

Originally posted by raymor@May 9 2005, 11:04 PM
The timeline on this bug is intersting to me.
A patch to fix it was avaliable within 6 hours
after the exploit was posted and within 18
hours people who had not patched were protected
by changes to the mozilla.org update server.
This shows the power of open source when compared
to the months or even years a certain proprietary
browser maker has taken to release security updates
after the exploits were public.

2005-05-07 16:26 PDT Original posting of vulnerability
2005-05-07 22:32 PDT Patch to fix it available through bugzilla
2005-05-08 09:57 PDT or earlier Mozilla.org adjusted to protect even users who had not patched Firefox.

The way you post makes me not want to use open source :P



I'll stay with the devil I know!

[Newton]

Trev I havent used windows for anything longer than 10 minutes in the last month I dont think? You should try putting linux on one of your machines to test out man, it truly rocks with multiple desktops and all free check out http://www.mandrakelinux.com and http://linux-laptop.net/

[Trev]

Originally posted by Newton@May 9 2005, 11:47 PM
Trev I havent used windows for anything longer than 10 minutes in the last month I dont think? You should try putting linux on one of your machines to test out man, it truly rocks with multiple desktops and all free check out http://www.mandrakelinux.com and http://linux-laptop.net/

You are joking me right..

I struggle with my love beads



I've tried linux (Technick your fault ) I did like it a lot. More like trying to learn all over again though, I've not got time for that


I need something I know, damn man it took 2 years to get me off Win95, and alot longer to get me off Win98SE

[Inabon]

Originally posted by Trev+May 9 2005, 05:33 PM-->