-
October 2nd, 2006, 05:27 PM
#1
Hackers claim zero-day flaw in Firefox
Just got this from BugTraq: http://news.com.com/2100-1002_3-6121...1608&subj=news
The open-source Firefox Web browser is critically flawed in the way it handles JavaScript, two hackers said Saturday afternoon.
[...]
The hackers claim they know of about 30 unpatched Firefox flaws. They don't plan to disclose them, instead holding on to the bugs.
And as a reply:
CNet is writing about some 0day vulnerabilities in Firefox that were demonstrated at ToorCon '06 by Mischa Spiegelmock and Andrew Wbeelsoi:
http://news.zdnet.com/2100-1009_22-6121608.html
Mischa and Andrew also claim to have found about 30 0day vulnerabilities in Firefox. The article mention that the vulnerabilities from the presentation are specific to Firefox's implementation of Javascript and hints that they are stack overflows. On the other hand, the recent security-related Mozilla commits following the presentation deal with improper validation of scope chain lookups in jsxml.c, jsinterp.c and jsiter.c, which could allow injecting content into the Chrome context.
We'll probably see a security release of Firefox in the next week, but in the mean time I have put a couple of links to the code diff's that fix these vulnerabilities at
http://blogs.securiteam.com/index.php/archives/657
--
Thor Larholm
-
October 2nd, 2006, 06:26 PM
#2
Greeting's
Just to add one more link (not much information provided).
http://www.securityfocus.com/bid/20282/discuss
Parth Maniar,
CISSP, CISM, CISA, SSCP
*Thank you GOD*
Greater the Difficulty, SWEETER the Victory.
Believe in yourself.
-
October 2nd, 2006, 07:54 PM
#3
Hey Hey,
In a shameless self plug I mentioned this in my recent blog posting on Your browser is better than mine -- http://www.computerdefense.org/?p=119 I'll be adding details on it as soon as I get them.
Peace,
HT
-
October 2nd, 2006, 11:11 PM
#4
As stated in a reply to the zdnet article (here): Wouldn't noscript take care of most of the problems? Unless you offcourse would decide to allow the site.
-
October 3rd, 2006, 01:53 AM
#5
The open-source Firefox Web browser is critically flawed in the way it handles JavaScript, two hackers said Saturday afternoon.
[...]
The hackers claim they know of about 30 unpatched Firefox flaws. They don't plan to disclose them, instead holding on to the bugs.
Thanks for the information Negative. I would give you greenies but I get that generic message ' you must spread your points around etc.. so kudos. Now, IMO 30 'unpatched' flaws in any software is a lot. Personally I don't use firefox. IMO, 'I' perfer IE over FireFox. For my own personal reasons.
You can not secure Mozilla/Firefox through the GPO (Group Policy Object) like you can with IE.
Second, some sites where strictly *coded* for IE. So viewing a site strictly coded for IE will not look 'proper'/ 'function correctly' in another web browser such as firefox/netscape/opera/konquer etc...
Just disable Active X, configure Java Permissions, Scripting (Javascript and VBS script, Active Scripting etc...) and my personal favorite user authentication.
As long as you stay up-to-date with the latest updates for your OS all your software, secure your web browser, then you can avoid about 99% of the junk on the internet. Just my two cents. Computernerd22
-
October 4th, 2006, 11:23 AM
#6
Plot thickens....
RETIRED: Mozilla Firefox Multiple Unspecified Javascript Vulnerabilities
Mozilla Firefox is prone to multiple unspecified JavaScript vulnerabilities because the application fails to properly sanitize user-supplied input before using it to create new JavaScript objects.
Successful exploits may allow an attacker to crash the application or execute arbitrary machine code in the context of the affected application.
Reportedly, about 30 undisclosed flaws exist.
Update (October 3, 2006): This BID is being retired because reports indicate that these issues are a hoax. The researchers responsible for disclosing these vulnerabilities have claimed that their original reports were incorrect. A remote denial-of-service vulnerability may possibly affect the browser, but this has not been confirmed. A new BID will be created if subsequent reports confirm the possibility of the potential denial-of-service issue. Please see the references for more information.
http://www.securityfocus.com/bid/20294/discuss
PC Registered user # 2,336,789,457...
"When the water reaches the upper level, follow the rats."
Claude Swanson
-
October 4th, 2006, 12:55 PM
#7
Hey Hey,
They had a crash and couldn't get code execution... Now this has been retired... but maybe not rightfully so... Only one of the two individuals has come forward and said he doesn't have the 30 0-days... but it was the other guy that stated it... many feel he does have them..... I've read theories that they were being leaned on to say they didn't exist but as HD Moore pointed out yesterday... there's a plethora of code changes in the mozilla cvs... that could all be 0-days waiting to have code written for them.
Peace,
HT
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|