Hackers claim zero-day flaw in Firefox

Printable View

October 2nd, 2006, 05:27 PM
Negative

Hackers claim zero-day flaw in Firefox

Just got this from BugTraq: http://news.com.com/2100-1002_3-6121...1608&subj=news

Quote:

The open-source Firefox Web browser is critically flawed in the way it handles JavaScript, two hackers said Saturday afternoon.

[...]

The hackers claim they know of about 30 unpatched Firefox flaws. They don't plan to disclose them, instead holding on to the bugs.

And as a reply:

Quote:

CNet is writing about some 0day vulnerabilities in Firefox that were demonstrated at ToorCon '06 by Mischa Spiegelmock and Andrew Wbeelsoi:

http://news.zdnet.com/2100-1009_22-6121608.html

Mischa and Andrew also claim to have found about 30 0day vulnerabilities in Firefox. The article mention that the vulnerabilities from the presentation are specific to Firefox's implementation of Javascript and hints that they are stack overflows. On the other hand, the recent security-related Mozilla commits following the presentation deal with improper validation of scope chain lookups in jsxml.c, jsinterp.c and jsiter.c, which could allow injecting content into the Chrome context.
We'll probably see a security release of Firefox in the next week, but in the mean time I have put a couple of links to the code diff's that fix these vulnerabilities at

http://blogs.securiteam.com/index.php/archives/657

--
Thor Larholm
October 2nd, 2006, 06:26 PM
ByTeWrangler

Greeting's

Just to add one more link (not much information provided).

http://www.securityfocus.com/bid/20282/discuss
October 2nd, 2006, 07:54 PM
HTRegz

Hey Hey,

In a shameless self plug :) I mentioned this in my recent blog posting on Your browser is better than mine -- http://www.computerdefense.org/?p=119 :) I'll be adding details on it as soon as I get them.

Peace,
HT
October 2nd, 2006, 11:11 PM
DakX

As stated in a reply to the zdnet article (here): Wouldn't noscript take care of most of the problems? Unless you offcourse would decide to allow the site.
October 3rd, 2006, 01:53 AM
Computernerd22

Quote:

The open-source Firefox Web browser is critically flawed in the way it handles JavaScript, two hackers said Saturday afternoon.

[...]

The hackers claim they know of about 30 unpatched Firefox flaws. They don't plan to disclose them, instead holding on to the bugs.

Thanks for the information Negative. I would give you greenies but I get that generic message ' you must spread your points around etc.. so kudos. Now, IMO 30 'unpatched' flaws in any software is a lot. Personally I don't use firefox. IMO, 'I' perfer IE over FireFox. For my own personal reasons.

You can not secure Mozilla/Firefox through the GPO (Group Policy Object) like you can with IE.

Second, some sites where strictly *coded* for IE. So viewing a site strictly coded for IE will not look 'proper'/ 'function correctly' in another web browser such as firefox/netscape/opera/konquer etc...

Just disable Active X, configure Java Permissions, Scripting (Javascript and VBS script, Active Scripting etc...) and my personal favorite user authentication.

As long as you stay up-to-date with the latest updates for your OS all your software, secure your web browser, then you can avoid about 99% of the junk on the internet. Just my two cents. Computernerd22
October 4th, 2006, 11:23 AM
dalek

Plot thickens.... :rolleyes:

Quote:

RETIRED: Mozilla Firefox Multiple Unspecified Javascript Vulnerabilities

Mozilla Firefox is prone to multiple unspecified JavaScript vulnerabilities because the application fails to properly sanitize user-supplied input before using it to create new JavaScript objects.

Successful exploits may allow an attacker to crash the application or execute arbitrary machine code in the context of the affected application.

Reportedly, about 30 undisclosed flaws exist.

Update (October 3, 2006): This BID is being retired because reports indicate that these issues are a hoax. The researchers responsible for disclosing these vulnerabilities have claimed that their original reports were incorrect. A remote denial-of-service vulnerability may possibly affect the browser, but this has not been confirmed. A new BID will be created if subsequent reports confirm the possibility of the potential denial-of-service issue. Please see the references for more information.

http://www.securityfocus.com/bid/20294/discuss
October 4th, 2006, 12:55 PM
HTRegz

Quote:

Originally posted here by dalek
Plot thickens.... :rolleyes:

http://www.securityfocus.com/bid/20294/discuss

Hey Hey,

They had a crash and couldn't get code execution... Now this has been retired... but maybe not rightfully so... Only one of the two individuals has come forward and said he doesn't have the 30 0-days... but it was the other guy that stated it... many feel he does have them..... I've read theories that they were being leaned on to say they didn't exist but as HD Moore pointed out yesterday... there's a plethora of code changes in the mozilla cvs... that could all be 0-days waiting to have code written for them.

Peace,
HT