Hackers claim zero-day flaw in Firefox
Results 1 to 7 of 7

Thread: Hackers claim zero-day flaw in Firefox

  1. #1
    Banned
    Join Date
    Aug 2001
    Location
    Yes
    Posts
    4,424

    Hackers claim zero-day flaw in Firefox

    Just got this from BugTraq: http://news.com.com/2100-1002_3-6121...1608&subj=news


    The open-source Firefox Web browser is critically flawed in the way it handles JavaScript, two hackers said Saturday afternoon.

    [...]

    The hackers claim they know of about 30 unpatched Firefox flaws. They don't plan to disclose them, instead holding on to the bugs.
    And as a reply:

    CNet is writing about some 0day vulnerabilities in Firefox that were demonstrated at ToorCon '06 by Mischa Spiegelmock and Andrew Wbeelsoi:

    http://news.zdnet.com/2100-1009_22-6121608.html

    Mischa and Andrew also claim to have found about 30 0day vulnerabilities in Firefox. The article mention that the vulnerabilities from the presentation are specific to Firefox's implementation of Javascript and hints that they are stack overflows. On the other hand, the recent security-related Mozilla commits following the presentation deal with improper validation of scope chain lookups in jsxml.c, jsinterp.c and jsiter.c, which could allow injecting content into the Chrome context.
    We'll probably see a security release of Firefox in the next week, but in the mean time I have put a couple of links to the code diff's that fix these vulnerabilities at

    http://blogs.securiteam.com/index.php/archives/657


    --
    Thor Larholm

  2. #2
    StOrM™
    Join Date
    Aug 2004
    Posts
    1,003
    Greeting's

    Just to add one more link (not much information provided).

    http://www.securityfocus.com/bid/20282/discuss
    Parth Maniar,
    CISSP, CISM, CISA, SSCP

    *Thank you GOD*

    Greater the Difficulty, SWEETER the Victory.

    Believe in yourself.

  3. #3
    Senior Member
    Join Date
    Jan 2003
    Posts
    3,914
    Hey Hey,

    In a shameless self plug I mentioned this in my recent blog posting on Your browser is better than mine -- http://www.computerdefense.org/?p=119 I'll be adding details on it as soon as I get them.

    Peace,
    HT
    IT Blog: .:Computer Defense:.
    PnCHd (Pronounced Pinched): Acronym - Point 'n Click Hacked. As in: "That website was pinched" or "The skiddie pinched my computer because I forgot to patch".

  4. #4
    Senior Member DakX's Avatar
    Join Date
    Jul 2005
    Posts
    128
    As stated in a reply to the zdnet article (here): Wouldn't noscript take care of most of the problems? Unless you offcourse would decide to allow the site.
    [T]he future is now.

  5. #5
    AO's MMA Fanatic! Computernerd22's Avatar
    Join Date
    Mar 2003
    Location
    Miami, FL
    Posts
    795
    The open-source Firefox Web browser is critically flawed in the way it handles JavaScript, two hackers said Saturday afternoon.

    [...]

    The hackers claim they know of about 30 unpatched Firefox flaws. They don't plan to disclose them, instead holding on to the bugs.
    Thanks for the information Negative. I would give you greenies but I get that generic message ' you must spread your points around etc.. so kudos. Now, IMO 30 'unpatched' flaws in any software is a lot. Personally I don't use firefox. IMO, 'I' perfer IE over FireFox. For my own personal reasons.

    You can not secure Mozilla/Firefox through the GPO (Group Policy Object) like you can with IE.

    Second, some sites where strictly *coded* for IE. So viewing a site strictly coded for IE will not look 'proper'/ 'function correctly' in another web browser such as firefox/netscape/opera/konquer etc...


    Just disable Active X, configure Java Permissions, Scripting (Javascript and VBS script, Active Scripting etc...) and my personal favorite user authentication.

    As long as you stay up-to-date with the latest updates for your OS all your software, secure your web browser, then you can avoid about 99% of the junk on the internet. Just my two cents. Computernerd22

  6. #6
    The ******* Shadow dalek's Avatar
    Join Date
    Sep 2005
    Posts
    1,564
    Plot thickens....

    RETIRED: Mozilla Firefox Multiple Unspecified Javascript Vulnerabilities

    Mozilla Firefox is prone to multiple unspecified JavaScript vulnerabilities because the application fails to properly sanitize user-supplied input before using it to create new JavaScript objects.

    Successful exploits may allow an attacker to crash the application or execute arbitrary machine code in the context of the affected application.

    Reportedly, about 30 undisclosed flaws exist.

    Update (October 3, 2006): This BID is being retired because reports indicate that these issues are a hoax. The researchers responsible for disclosing these vulnerabilities have claimed that their original reports were incorrect. A remote denial-of-service vulnerability may possibly affect the browser, but this has not been confirmed. A new BID will be created if subsequent reports confirm the possibility of the potential denial-of-service issue. Please see the references for more information.
    http://www.securityfocus.com/bid/20294/discuss
    PC Registered user # 2,336,789,457...

    "When the water reaches the upper level, follow the rats."
    Claude Swanson

  7. #7
    Senior Member
    Join Date
    Jan 2003
    Posts
    3,914
    Originally posted here by dalek
    Plot thickens....


    http://www.securityfocus.com/bid/20294/discuss
    Hey Hey,

    They had a crash and couldn't get code execution... Now this has been retired... but maybe not rightfully so... Only one of the two individuals has come forward and said he doesn't have the 30 0-days... but it was the other guy that stated it... many feel he does have them..... I've read theories that they were being leaned on to say they didn't exist but as HD Moore pointed out yesterday... there's a plethora of code changes in the mozilla cvs... that could all be 0-days waiting to have code written for them.

    Peace,
    HT
    IT Blog: .:Computer Defense:.
    PnCHd (Pronounced Pinched): Acronym - Point 'n Click Hacked. As in: "That website was pinched" or "The skiddie pinched my computer because I forgot to patch".

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •