SANS ISC Update: Firefox 1.5.0.3 Vulnerability Update (NEW)
Wheee! I have also bolded their proposed solution.
Link: http://isc.sans.org/diary.php?storyid=1327
The story so far:
Quote:
Published: 2006-05-11,
Last Updated: 2006-05-11 11:50:09 UTC by Johannes Ullrich (Version: 1)
Ronald sent us a PoC DoS exploit, which uses the recently discussed Firefox 1.5.0.3 image issue.
His prove of concept exploit will use javascript to generate image tags with 'mailto:' link, which in turn will open the mail application automatically without any user interaction. As a result, many mail windows (e.g. Outlook) will be opened and the system will become unresponsive.
One possible workaround is to turn off automatic startup of your e-mai application in Firefox. To do so, enter in the URL bar: about:config . This will show a long list of configuration options. Search for 'warn-external.mailto' (e.g. use the 'Filter' option). By default, this value should be set to "false". Click on the line to toggle it to "true" (it will be bold if it is not set to the default).
Now, whenever you click on a mailto: link, you will first be asked if you would like to start your e-mail application. In the case of the exploit this will keep your system responsive, even though you may still have to click on all the dialogs.
Disabling javascript is another option, or disabling mailto: link all together. But these options are more intrusive.
For more details and a link to a PoC, see securityview.org
Annnd... from securityview.org:
Link: http://www.securityview.org/confirme...efox-1503.html
Annnd, their story so far - but you will see at the end, it's all a circle:
Quote:
Confirmed bug in Firefox 1.5.0.3
We have confirmed a bug in Firefox 1.5.0.3 with DoS possibilities. When you download the source of the following page you will see what it does. It will open 100 mailforms, so be cautions when you open the link!
Update:
One way to mitigate this: set
“network.protocol-handler.warn-external.mailto’ to ‘true’ (its false by
default). This will show a popup dialog whenever a mailto link is
clicked (or opened in your case) instead of launching the mail
application right away. You still need to click the button 100 times,
but at least the system stays responsive.
Thanks to the guys at isc.sans.org for this workaround!
As many of us already know, as platforms or OS/OEs gain popularity, so too, do they become more likely targets of attack; so we just apapt our approach, and hopefully be a proactive as possible to head off any potential disaster events. As I stated before, *ahem-ahem, "Wheee!"
