May 11th, 2006, 03:04 PM
SANS ISC Update: Firefox 220.127.116.11 Vulnerability Update (NEW)
Wheee! I have also bolded their proposed solution.
The story so far:
Annnd... from securityview.org:
Last Updated: 2006-05-11 11:50:09 UTC by Johannes Ullrich (Version: 1)
Ronald sent us a PoC DoS exploit, which uses the recently discussed Firefox 18.104.22.168 image issue.
One possible workaround is to turn off automatic startup of your e-mai application in Firefox. To do so, enter in the URL bar: about:config . This will show a long list of configuration options. Search for 'warn-external.mailto' (e.g. use the 'Filter' option). By default, this value should be set to "false". Click on the line to toggle it to "true" (it will be bold if it is not set to the default).
Now, whenever you click on a mailto: link, you will first be asked if you would like to start your e-mail application. In the case of the exploit this will keep your system responsive, even though you may still have to click on all the dialogs.
For more details and a link to a PoC, see securityview.org
Annnd, their story so far - but you will see at the end, it's all a circle:
As many of us already know, as platforms or OS/OEs gain popularity, so too, do they become more likely targets of attack; so we just apapt our approach, and hopefully be a proactive as possible to head off any potential disaster events. As I stated before, *ahem-ahem, "Wheee!"
Confirmed bug in Firefox 22.214.171.124
We have confirmed a bug in Firefox 126.96.36.199 with DoS possibilities. When you download the source of the following page you will see what it does. It will open 100 mailforms, so be cautions when you open the link!
One way to mitigate this: set
“network.protocol-handler.warn-external.mailto’ to ‘true’ (its false by
default). This will show a popup dialog whenever a mailto link is
clicked (or opened in your case) instead of launching the mail
application right away. You still need to click the button 100 times,
but at least the system stays responsive.
Thanks to the guys at isc.sans.org for this workaround!
\"We\'re the middle children of history.... no purpose or place. We have no Great War, no Great Depression. Our great war is a spiritual war. Our great depression is our lives. We\'ve all been raised by television to believe that one day we\'ll all be millionaires and movie gods and rock stars -- but we won\'t. And we\'re learning slowly that fact. And we\'re very, very pissed off.\" - Tyler (Brad Pitt) Fight Club