Simple DoS for Firefox 1.5

I saw this while browsing zone-h.org's security news and I figured since most AO'ers are Firefox users, that this might be of some importance.

Quote:

---

Simple DoS for Firefox 1.5
Published: 2005-12-07

An exploit for the new Firefox 1.5 browser was released today that causes a denial of service condition using a simple web page as a trigger.

The heart of the problem lies with the history.dat file that Firefox creates, according to a posting on Packet Storm. The exploit creates a very large entry which Firefox then saves into the history.dat file. This causes the browser to crash the next time it is opened, and each time after that until the history.dat file is deleted from the system.

The author of the exploit points out that average users may have difficulty figuring out this fix, preventing browser use and effectively creating a denial of service condition. In the past there have been debates over browser bugs and if they are truly denial of service attacks - today’s bug is sure to rekindle these arguments.

The final line of the exploit description warns that code execution is a possibility with some modifications to the sample exploit.

---

Sounds like a simple way to execute a DoS by merely creating an extensively large file from what I gathered. Read the full article at securityfocus here.

Wow, I'm a bit surprised that the folks at Mozilla didn't catch that one. I mean, it doesn't seem like an obscure attack vector. Still, 1.5 has only been out in its final form for a few days, so I suppose a few "doh" moments are expected ;)

how could you modify that script for code execution? not seeing it, maybe i dont understand buffer overflow, which is quite possible. i thought the buffer was a limited cache for that program in RAM which would later be processed, if it was exceeded the program crashed. how can you get code execution out of that? the overflow bumps existing commands to the processor? other than the possibility of code execution it just sounds like a pain in the butt.

WolfRune: totally agree, not that complex an exploit to notice, but then again i do stuff like that with the little scripts i write all the time:)

Wolfrune: Perhaps, yes.. but a "doh" moment on something like that should have been caught in testing of the product, no?