Beta

Slashdot: News for Nerds

×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Mozilla First To Patch Pwn2Own Browser Vulnerability

Soulskill posted more than 5 years ago | from the comparatively-quick dept.

Security 141

Constantine the Less writes "Mozilla has released Firefox 3.0.8 to fix a pair of code execution holes that put users of the browser at risk of drive-by download attacks. It includes a fix for one of the flaws exploited during this year's CanSecWest Pwn2Own hacker contest. The update also fixes a separate zero-day flaw disclosed earlier this week on a public exploit site. Both issues are rated 'critical,' Mozilla's highest severity rating."

cancel ×

141 comments

First post. (1)

cbiltcliffe (186293) | more than 5 years ago | (#27370053)

And good to see Mozilla patching things this quickly.

Re:First post. (5, Funny)

MightyYar (622222) | more than 5 years ago | (#27370069)

Yeah, but internet browsing just doesn't feel as exciting without the risk. Back to unpatched XP with IE6 for me...

Re:First post. (4, Funny)

purpledinoz (573045) | more than 5 years ago | (#27370415)

You finish installing Windows XP. You connect to the internet and fire up your browser. 4 minutes later, additional processes start appearing in your task manager. You've been pwnd! You frantically try to close the security holes by going to the Windows Update website, but all you get are ads for penis enlargement and free porn. As your PC slows to a crawl, the excitement fades...

Re:First post. (0)

Anonymous Coward | more than 5 years ago | (#27370565)

I misread the final line as "the excrement fades". :)

Re:First post. (0)

Anonymous Coward | more than 5 years ago | (#27370813)

The excitement fades? Are you nuts?
I just got links for penis enlargement and free porn! OH SWEET

Re:First post. (2, Interesting)

Anonymous Coward | more than 5 years ago | (#27371887)

That is nothing. Once, during the second stage of a Windows XP installation, as soon as Windows brought up the network interface to configure the DHCP it got slammed by the blaster worm right in the middle of the installation! (The box was connected to a DOCSIS cable network.) I had to power off the modem, reformat, and restart the install. That is why I no longer use windows.

Re:First post. (-1, Flamebait)

Anonymous Coward | more than 5 years ago | (#27372083)

Yeah, right. You no longer use Windows because you lie about things.

Re:First post. (2, Interesting)

Vu1turEMaN (1270774) | more than 5 years ago | (#27370479)

It would have been funny son, but the sad fact of the matter is that probably half of the XP systems out there are unpatched and use IE6...

Re:First post. (3, Interesting)

iminplaya (723125) | more than 5 years ago | (#27370839)

That's because they're bootlegs, and updating will just install WGA

Re:First post. (0)

Anonymous Coward | more than 5 years ago | (#27371429)

Nope, I use a pirated Windows, and it cheerfully passes WGA and updates just fine.

It's because those people using vanilla WinXP + IE6 can barely change their Yahoo Messenger status, or load a list into Winamp.

Re:First post. (4, Funny)

RiotingPacifist (1228016) | more than 5 years ago | (#27370785)

untrusted extentions are the way of the future. they let YOU choose how much you get pwned.
Only want a mild risk? install a few 3rd party extentions,
Fancy taking your chances? look for ones with spelling mistakes in the discriptions,
Unprotected sex with the internet? well start installing them from 3rd party sites
Fuck it, pwn me already? install greasemonkeys and look for scripts that have the discription written in 1337 sp3/\k

Re:First post. (-1, Offtopic)

Anonymous Coward | more than 5 years ago | (#27370081)

second post

Re:First post. (-1, Offtopic)

pbhj (607776) | more than 5 years ago | (#27370167)

sixth post

that's quick (1)

siriuskase (679431) | more than 5 years ago | (#27370111)

If I want to have Firefox download my exploit, umm, contribution to thousands of users worldwide, could I get such fast service and minimal vetting if I called it a security patch?

Re:that's quick (3, Informative)

cbiltcliffe (186293) | more than 5 years ago | (#27370243)

Could you get such fast service? Certainly.

With such minimal vetting? I doubt it. Only if you're a trusted submitter to the Mozilla tree. And if you were, you'd only get to pull a stunt like that once.

Re:that's quick (1, Funny)

Anonymous Coward | more than 5 years ago | (#27370419)

Here, I've found this tinfoil hat just around the corner. You must have misplaced it.

Re:First post. (1)

0xygen (595606) | more than 5 years ago | (#27370551)

Although I do notice the Firefox 3.1 Beta 3 has no update yet - I just tried the PoC, it is definitely vulnerable.

Maybe it's time to start using nightlies if you are a 3.1 beta user?

Re:First post. (2, Insightful)

Thinboy00 (1190815) | more than 5 years ago | (#27371699)

The whole point of Betas is that they have bugs etc. and haven't been tested. If you care about security, you shouldn't use a Beta. If you don't care, why are you asking?

And this is a surprise? (-1, Flamebait)

TinBromide (921574) | more than 5 years ago | (#27370083)

Here I was thinking that the security benefits of open source arose from the source code being open to all. More eyes on the code means more opportunity to find and fix holes. I also thought that open source had a built in Plan B that if a hole was found, anyone could submit a patch and it would get folded in as soon as it was reviewed and approved.

Silly me.

Re:And this is a surprise? (0)

Anonymous Coward | more than 5 years ago | (#27370123)

I really don't understand your logic. Just because Apple happens to be a decent software company, and quickly fixes exploits *that have been reported to them*, open source is less secure?

This says nothing negative about open source, IMO. The exploits that were patched here were found because someone took the time to try to find them. When all you get is a binary blob, that's obviously going to be harder than if you've got is source code. So your point is moot.

And yes, exploits submitted to open source packages generally get included quickly. Look at the lkml, this happens daily.

Re:And this is a surprise? (0)

Anonymous Coward | more than 5 years ago | (#27370169)

(Same coward as parent...)

Heh, I just got done reading an Apple story, and here I am thinking we were talking about them.

Anyways, I still don't get this guys point.

Re:And this is a surprise? (4, Insightful)

drinkypoo (153816) | more than 5 years ago | (#27370127)

I also thought that open source had a built in Plan B that if a hole was found, anyone could submit a patch and it would get folded in as soon as it was reviewed and approved.

That's funny, this is a story about the Open Source browser being patched before every other browser, and you're not seeing a benefit?

Re:And this is a surprise? (0, Redundant)

TinBromide (921574) | more than 5 years ago | (#27370185)

I'm seeing the benefit, just not the surprise.

Re:And this is a surprise? (1, Insightful)

Anonymous Coward | more than 5 years ago | (#27370259)

How many stories on Slashdot are surprising?

Re:And this is a surprise? (1, Informative)

Anonymous Coward | more than 5 years ago | (#27370343)

seven

Re:And this is a surprise? (2, Funny)

Anonymous Coward | more than 5 years ago | (#27370387)

42

Re:And this is a surprise? (1)

ion.simon.c (1183967) | more than 5 years ago | (#27371239)

What does Fox Mulder's apartment number have to do with this?

Re:And this is a surprise? (2, Informative)

Anonymous Coward | more than 5 years ago | (#27370217)

Actually the IE8 exploit used during Pwn2Own contest wouldn't work on the final release of IE8 published one day later on the 19th of March.

http://dvlabs.tippingpoint.com/blog/2009/03/27/pwn2own-ie8-exploit-foiled-is-the-browser-finally-secure [tippingpoint.com]

Re:And this is a surprise? (5, Informative)

makomk (752139) | more than 5 years ago | (#27370411)

Well, it wouldn't work on Vista on the final release of IE8, except on Intranet pages. Apparently, it still works on IE8 running under XP, still works on Intranet pages. The underlying vulnerability is still present on IE8 on all platforms, it's just that there's not currently any way to exploit it thanks to DEP and ASLR.

Re:And this is a surprise? (1)

rs232 (849320) | more than 5 years ago | (#27370715)

'Actually the IE8 exploit used during Pwn2Own contest wouldn't work on the final release of IE8 published one day later on the 19th of March'

According to this only when .NET controls have been disabled [iss.net]

Re:And this is a surprise? (0, Interesting)

Anonymous Coward | more than 5 years ago | (#27370587)

I love how this is being spun as some great thing for Firefox. Google Chrome didn't even need a patch because it was unaffected by the exploit. Also, as someone else mentioned, IE8 is unaffected, therefore it was patched before Firefox.

Firefox hasn't come first at all. If anything it came pretty damned close to last place, ahead of Safari only.

OSX 10.3 blues (2, Informative)

Dog135 (700389) | more than 5 years ago | (#27370739)

That's funny, this is a story about the Open Source browser being patched before every other browser, and you're not seeing a benefit?

I'm not. I can't download the upgrade. I'm running OSX 10.3.9, and Firefox 2.0.0.1. Firefox 3.x requires 10.4.

OSS developers should think about those of us that are still happy with their older software! (or can't upgrade) I'm only 1 major version behind the current Firefox.

I'm not sure if I'm in danger of a drive-by download though. I do remember getting a few "exe" programs downloaded to my HD while visiting some shadier sites. I just laugh, delete it, and move on.

Re:OSX 10.3 blues (1)

644bd346996 (1012333) | more than 5 years ago | (#27370833)

Don't blame Mozilla. Blame Apple for not retrofitting 10.3 with Universal Binary support. That way, you can be right, and also make the unreasonableness of your request apparent.

10.3 has universal binaries (0, Flamebait)

Dog135 (700389) | more than 5 years ago | (#27370925)

All versions of OSX have universal binary support. Every application is a folder with a ".app" extension. Inside the folder are sub-folders for the binary for each system.

A fast Google search for "os x" 10.3 "universal binary" will show that many applications have universal binary downloads that support 10.3.

If you look at Mozilla's site, however, they say they no longer support Firefox 2.x. Why drop support of their previous major version? They could at least provide security updates.

Re:10.3 has universal binaries (1)

ion.simon.c (1183967) | more than 5 years ago | (#27371287)

Why drop support of their previous major version?

'Cause they don't have the manpower and/or money to support the previous major version?

They could at least provide security updates.

I daresay that they did just this for roughly six months after FF 3.0 was released.
https://wiki.mozilla.org/ReleaseRoadmap [mozilla.org]

Re:10.3 has universal binaries (1)

Thinboy00 (1190815) | more than 5 years ago | (#27371823)

Why drop support of their previous major version? They could at least provide security updates.

For the same reason Microsoft dropped support of Windows 3.1 a long time ago, and in contrast with the reason Microsoft is now trying to drop support for XP.

Obsolete versions waste time and energy. Firefox 2 was supported for some time after Fx 3 came out, but they can't support it indefinitely.

Think of it another way: Mozilla doesn't have to make Fx (well|free as in beer|free as in speech|at all), so don't bitch about it if they decide to do something you don't like, unless you're paying for Fx, which you're not. Note that "Fx" is the correct abbreviation of "Firefox" ("FF" is wrong).

Re:OSX 10.3 blues (0)

Anonymous Coward | more than 5 years ago | (#27370845)

Just run your program under a sandbox if you can, this tends to solve the problems of most crash-based virii. (they can still run, though)

Re:OSX 10.3 blues (2, Informative)

Ant P. (974313) | more than 5 years ago | (#27371059)

If you're worried about security at all, why are you running a browser 19 security patches out of date [mozilla.com] ?

Mac OS X != OSS (4, Informative)

tepples (727027) | more than 5 years ago | (#27371777)

I can't download the upgrade. I'm running OSX 10.3.9, and Firefox 2.0.0.1. Firefox 3.x requires 10.4.

OSS developers should think about those of us that are still happy with their older software! (or can't upgrade)

Mac OS X is not open-source software. If you can't install Leopard or even Tiger on your PowerPC Mac, try installing a Linux distribution that supports your Mac model. I'm sure they still exist.

Re:OSX 10.3 blues (1)

Chemicalscum (525689) | more than 5 years ago | (#27372041)

It's open source compile it yourself, gcc still runs on OSX 10.3.9. That's the sort of fun project you get stuck doing if you don't update your software.

I do remember getting a few "exe" programs downloaded to my HD while visiting some shadier sites. I just laugh, delete it, and move on.

On Linux I once had a site try to download a .exe file on me and Wine opened it. Though it started executing a process it just hung, too different environment to do any damage.

Re:And this is a surprise? (1)

Yetihehe (971185) | more than 5 years ago | (#27370131)

Yeah, and this resulted in them being first to patch. I already have patched version, it downloaded automatically. Even if microsoft patched ie8 today it probably wouldn't update automatically till next patch tuesday. And did closed source helped ms to make more secure browser?

Re:And this is a surprise? (4, Informative)

Anonymous Coward | more than 5 years ago | (#27370293)

And did closed source helped ms to make more secure browser?

umm, yes.
the person who cracked safari on osx said that ie8 on vista was the toughest to exploit.

Re:And this is a surprise? (5, Informative)

icebraining (1313345) | more than 5 years ago | (#27370531)

On the other hand, Firefox on Linux wasn't exploited at all.

Re:And this is a surprise? (1, Insightful)

Anonymous Coward | more than 5 years ago | (#27370547)

On the other hand, Firefox on Linux wasn't exploited at all.

Yes, but there wasn't a Linux box. IE 4 on Windows 95 wasn't exploited during the contest either... does that prove anything?

Re:And this is a surprise? (0)

Anonymous Coward | more than 5 years ago | (#27370819)

And they still asked me to download a patch.

Re:And this is a surprise? (2, Informative)

Anonymous Coward | more than 5 years ago | (#27370713)

"Charlie: The NX bit is very powerful.When used properly, it ensures that user-supplied code cannot be executed in the process during exploitation. Researchers (and hackers) have struggled with ways around this protection. ASLR is also very tough to defeat. This is the way the process randomizes the location of code in a process. Between these two hurdles, no one knows how to execute arbitrary code in Firefox or IE 8 in Vista right now. For the record, Leopard has neither of these features, at least implemented effectively. In the exploit I won Pwn2Own with, I knew right where my shellcode was located and I knew it would execute on the heap for me."

That has nothing to do with it being closed source.

Re:And this is a surprise? (1)

RiotingPacifist (1228016) | more than 5 years ago | (#27370879)

erm that doesn't answer the question, there are some nice technologies in vista* and ie8 can take full advantage of those, eventually FF will be able to use those on vista and still be more secure than IE on xp (something MS has no intention of doing). It DOESN'T have anything to do with it being closed.

Re:And this is a surprise? (0)

Anonymous Coward | more than 5 years ago | (#27370135)

Why is this marked flame-bait?

The remark is rhetorical and underlines open-source's strange!

Silly me too!

Re:And this is a surprise? (0)

Anonymous Coward | more than 5 years ago | (#27370189)

Exactly! The siblings to parent's post should re-read the GP. Slowly this time.

Re:And this is a surprise? (1)

maxume (22995) | more than 5 years ago | (#27370171)

See what sarcasm gets ya?

Re:And this is a surprise? (1)

TinBromide (921574) | more than 5 years ago | (#27370193)

I know, I just wish that people read the subject before firing off a reply.

Re:And this is a surprise? (1)

Svippy (876087) | more than 5 years ago | (#27370435)

See what sarcasm gets ya?

And that, ladies and gentlemen, is the surprise.

Re:And this is a surprise? (0)

Anonymous Coward | more than 5 years ago | (#27370175)

This is in reply to all of this post's brothers and sisters:

*whoosh*

Re:And this is a surprise? (0)

Anonymous Coward | more than 5 years ago | (#27370223)

What about the post's parents, grandparents, aunts and uncles, children and what-not: don't they get a *whoosh* too?

What about cousins?

There is a second benefit (2, Insightful)

Colin Smith (2679) | more than 5 years ago | (#27370401)

Of having discrete components, and of modular operating systems.

Mozilla isn't integrated into the OS, so they can just fix bugs. IE is "integrated into the OS" which means they can't simply fix bugs, they've got to make sure the rest of the big ball of mud OS continues to work as well.

 

Re:And this is a surprise? (0)

Anonymous Coward | more than 5 years ago | (#27370831)

Are you kidding? I patched this exploit BEFORE the pnw2own contest. But my submission of the patch wasn't accepted. But at least my own system is secure.

What's needed is Slashdot to be coded better (0)

Anonymous Coward | more than 5 years ago | (#27370121)

In other news, Slashdot have announced an update to version 0.03 alpha.

This version doesn't fix the Javascript Slowdown that causes the browser window to turn grey on Linux systems, for spinning beachballs on Mac OS X, and Windows thinking the application isn't responding.

However it alters something that was working into something that doesn't. Also there's a "Prefs" button on the bottom of the page.

is the patch also in 3.5b4pre ? (0)

Anonymous Coward | more than 5 years ago | (#27370125)

Because I like to use the JIT javascript compiler in 3.5 (aka 3.1)

zero-day flaw disclosed earlier this week (0, Troll)

Dan9999 (679463) | more than 5 years ago | (#27370133)

and I finally used that good-for-only-one-month coupon that I got last year for a free oil change on my car yesterday.

if it's not still day zero, don't call it a zero-day flaw.

Re:zero-day flaw disclosed earlier this week (1)

maxume (22995) | more than 5 years ago | (#27370271)

It might not be the best terminology, but it is describing how many days a patch has been available for the vulnerability.

Seen how insecure web browsers are... (4, Interesting)

Anonymous Coward | more than 5 years ago | (#27370153)

Seen how insecure web browsers are, what would be a good way to surf under Linux?

I have an account that I use only for GMail and my bank's website (the latter using a physical device answering cryptographic challenge so nobody is abusing that [when wiring money to a new account number, the account number of the recipient itself is part of the cryptographic challenge, there's no MITM, no nothing that can work against that]).

Then I have an account only for browsing. The user owning this account on my machine has user ID 1007.

This user is not even allowed to connect to localhost. I don't want to know. All he can do is surf the web, using iptables like this:

iptables -I OUTPUT -m owner --uid-owner 1007 -j REJECT
iptables -I OUTPUT -m owner --uid-owner 1007 -p tcp --dport 80 -j ACCEPT
iptables -I OUTPUT -m owner --uid-owner 1007 -p tcp --dport 443 -j ACCEPT
iptables -I OUTPUT -m owner --uid-owner 1007 -p udp --dport 53 -j ACCEPT

Are there others simple things I could do to deal with security hazard that these browsers are?

Things I could do about this user's home directory permissions? Disable his SSH? etc.

Basically I think I'd like to have an account that can "do nothing but run Firefox".

Or is there an easy, lightweight (lightweight as in "I don't necessarily want to virtualize a full OS just to run a browser", way to sandbox a browser?

In other words, I consider the "security" of all the browsers to be a bad joke and I regard running a browser basically the same as executing "omgWindozeServer2012Crack.exe" on my machine and I'd like any hint from people who are surfing in a "safer" way.

Re:Seen how insecure web browsers are... (1)

iminplaya (723125) | more than 5 years ago | (#27370269)

when wiring money to a new account number, the account number of the recipient itself is part of the cryptographic challenge, there's no MITM, no nothing that can work against that

Very confident you are.

I'd like any hint from people who are surfing in a "safer" way.

Use somebody else's computer.

Re:Seen how insecure web browsers are... (5, Interesting)

siride (974284) | more than 5 years ago | (#27370325)

You could try not freaking the fuck out about browser security, unless you plan on visiting Russian spam sites and whatnot. I use Firefox on Linux and I've never had an issue. I use Flashblock, Adblock and occasionally Noscript. Just exercise reasonable caution and you should be fine. Heck, even under Windows I never got viruses or spyware, and I used IE!

Re:Seen how insecure web browsers are... (3, Interesting)

Hurricane78 (562437) | more than 5 years ago | (#27371731)

Not exactly true. You never got viruses, that you knew of.

Under Windows, with IE, this is no hard thing to achieve. Think of the Sony rootkit. Or about the tons of trash that average people get on their systems, despite having a anti-virus and a firewall software running.
I know of many people who completely turn them both off, when they play games. For performance reasons. Even when the games allow the usage of browsers while running.

Re:Seen how insecure web browsers are... (3, Interesting)

siride (974284) | more than 5 years ago | (#27371973)

I didn't get viruses. I had no slowdowns, nothing showing up in process explorer, no weird behavior, nothing from ZoneAlarm (worthless though it otherwise be). Of course, if you go the route of "you can't ever truly be sure of xyz", then I suppose you are right. I probably did get viruses. And even though I think I'm running Linux, it's probably actually just a rootkit that's infected my Windows XP installation to make it look like some other OS. How can I really know?

Re:Seen how insecure web browsers are... (3, Interesting)

0xFCE2 (859134) | more than 5 years ago | (#27370467)

Or is there an easy, lightweight (lightweight as in "I don't necessarily want to virtualize a full OS just to run a browser", way to sandbox a browser?

Have a look at the Linux extensions like SELinux or AppArmor. At least the latter one can be set up comparatively easy, and is useful to protect a few selected processes such as FF from doing harm. Certainly not perfect, but it should be able to stop an exploit from taking over the whole account.

However, the weak link will then probably be X and your window environment (KDE/gnome), so full virtualization is still much better. Of course, even that doesn't offer perfect protection.

Re:Seen how insecure web browsers are... (3, Interesting)

RiotingPacifist (1228016) | more than 5 years ago | (#27371199)

how is X the weak link? the weak link is whatever you let on the internet and whatever network aware daemons you have running. once on your system X MAY be the weak link but the pwm2own vulnerabilities dont need root, so X doesn't even matter (much like it matters little in modern security) where attackers don't need root. while SElinux & AppArmor MAY protect against use of these attacks, e.g killing firefox when it executes malicious code, but a fishing scam doesn't need to do anything malicious to your system (and Firefox has already been 'pwned' in the context of this competition).

Full virtulization is useless, if the attack is advanced enough that it can is keylogging a separate user (has root), modifying your Firefox binaries (has root and then some) or modifying what you see (one hell of an exploit somewhere in your xorg stack), then the chances are the attacker can modify your virtualized os when its mounted,( there's nothing you can do that a kernel recompile cant beat and as the attacker has root, he can do that).

you have 2 choices:
1) stop being paranoid
2) run a livecd and update it regularly enough (from your livecd using toram) that there are no known exploits for it. OFC this HAS to be done on multiple cd-rs as a cd-rw could be patched if its exploited. But wait they could actually exploit you and modify the iso before you managed to get it to the disk, so i refer you to point 1.

Now assuming you that you've stopped being paranoid and just want a bit of extra security the GP post is about as good as you can get it protects against all user level exploits.

Re:Seen how insecure web browsers are... (1)

Jeppe Salvesen (101622) | more than 5 years ago | (#27370615)

I'd consider running the web browsing session inside a virtual machine. That's both more secure and more practical. :)

Re:Seen how insecure web browsers are... (1)

TheLink (130905) | more than 5 years ago | (#27371323)

Depends on your virtual machine. Lots of virtualization software/hardware has bugs.

See:

http://www.securityfocus.com/bid/32597/discuss [securityfocus.com]

And:
http://www.google.com/search?hl=en&safe=off&q=+site:www.securityfocus.com+vmware+vulnerability [google.com]

I'm sure the others have problems too.

Re:Seen how insecure web browsers are... (3, Interesting)

Anonymous Coward | more than 5 years ago | (#27370937)

On Windows, i sandbox my browsers using Sandboxie, such a fantastic little program.
The newer versions are much better, more control over what a program can access, file-permissions, network, etc

Not sure of any similar sandboxing programs for Linux, sadly.
I second this request.

Re:Seen how insecure web browsers are... (0)

Anonymous Coward | more than 5 years ago | (#27370945)

try running Firefox in its own chroot jail.

Re:Seen how insecure web browsers are... (0)

Anonymous Coward | more than 5 years ago | (#27370973)

Getting a life might be a good first step.

Re:Seen how insecure web browsers are... (1)

mcneely.mike (927221) | more than 5 years ago | (#27371395)

getting an account and not posting a.c. would be a good first step!

MS already patched in IE8 final build (4, Informative)

Anonymous Coward | more than 5 years ago | (#27370209)

MS patched this on IE8 on Vista already before it published Mar 19. http://blogs.iss.net/archive/chicksdigIE8.html

XP hasn't been patched yet. Doesn't support DEP, so will be a bit more work.

Re:MS already patched in IE8 final build (5, Informative)

Anonymous Coward | more than 5 years ago | (#27370367)

Doesn't support DEP, so will be a bit more work.

DEP is supported on Windows XP since SP2.

Seamonkey too? (1)

Anonymous Coward | more than 5 years ago | (#27370213)

Is Seamonkey affected by the same bugs? Are the updates ready?

Telnet too? (0)

Anonymous Coward | more than 5 years ago | (#27370433)

what about telnet 80?

that's how I do all my browsing

When I find an exploit, I patch it using cat > /usr/bin/telnet

that's how I keep it real

Re:Seamonkey too? (1)

dryeo (100693) | more than 5 years ago | (#27372253)

MFSA 2009-13: Security researcher Nils reported via TippingPointâ(TM)s Zero Day Initiative that the XUL tree method _moveToEdgeShift was in some cases triggering garbage collection routines on objects which were still in use. In such cases, the browser would crash when attempting to access a previously destroyed object and this crash could be used by an attacker to run arbitrary code on a victimâ(TM)s computer. This vulnerability does not affect Firefox 2, Thunderbird 2, or released versions of SeaMonkey.

Don't know about the dailies though.

BAH! (5, Insightful)

iminplaya (723125) | more than 5 years ago | (#27370247)

The contestants already have next year's winning exploit waiting in the wings. Maybe we should have these contests every month instead of once a year.

Re:BAH! (1)

v1 (525388) | more than 5 years ago | (#27370349)

That's what I was thinking too. It'd be a bit like that Month of Bugs, quite a lot of progress was made in those 30 days.

Though they'd start running out quick I bet. But for us, that's a good thing.

Re:BAH! (1)

iminplaya (723125) | more than 5 years ago | (#27370473)

Unfortunately, it's the market that will decide how to deal with exploits. They will always go to the highest bidder. White hat, black hat, it doesn't mattah.

MS already fixed this in IE8 gold. (0)

Anonymous Coward | more than 5 years ago | (#27370323)

http://blogs.iss.net/archive/chicksdigIE8.html

MS already fixed this in Vista when IE8 was published on March 19. XP hasn't been patched yet - doesn't support DEP.

Re:MS already fixed this in IE8 gold. (1)

makomk (752139) | more than 5 years ago | (#27370459)

Not exactly. They fixed a hole in DEP+ASLR, first reported in August 2008, that made it possible to exploit the IE8 vulnerability (by disabling the functionality the hole was in) - but only for internet sites; intranet sites can still exploit it. The underlying vulnerability is also still there, and there are probably other ways of exploiting it to get code execution.

Any patch applied before I read about it on /. ... (0)

Anonymous Coward | more than 5 years ago | (#27370363)

...is a good patch! Cheers to all involved.

Not only that (2, Interesting)

Idiot with a gun (1081749) | more than 5 years ago | (#27370385)

But Ubuntu has already reviewed it, and pushed it out through the repositories, marking it as critical. I love open source.

old news (0)

Anonymous Coward | more than 5 years ago | (#27370511)

hmm, this is like 3 days old news

Re:old news (1)

Computershack (1143409) | more than 5 years ago | (#27370621)

Not up to 24hrs ago. Yesterday I downloaded FF for a client and it was still punting Ver 3.0.7 on Mozillas website.

BULLSHIT. (0)

Computershack (1143409) | more than 5 years ago | (#27370637)

Article is bullshit. Microsoft patched IE8 in under 24hrs. Pwn2Own targetted IE8RC1. The full IE8 was released the following day and was immune to the exploit used.

Re:BULLSHIT. (2, Insightful)

Anonymous Coward | more than 5 years ago | (#27371251)

It was only immune in the internet zone, due to MS disabling .net controls in that zone. The bug still exists and is fully exploitable in the intranet zone. Also, IE has had a long history of cross-zone-scripting bugs which allow an attacker to run js code in a different protection zone than it really exists in. If you trick IE into thinking your code is in the intranet zone, this vulnerability opens right up.

Noscript (0)

Anonymous Coward | more than 5 years ago | (#27370675)

I wonder how good in bloacking all these new attacks is Noscript.

I feel comfortable (0)

Anonymous Coward | more than 5 years ago | (#27370729)

I use Firefox with NoScript on Sandboxie and I feel comfortable.

Not that quick, actually (1)

RockMFR (1022315) | more than 5 years ago | (#27370753)

I'm surprised that nobody has mentioned that the XSL issue was reported 5 months ago [mozilla.org] , and it had a patch ready to go [mozilla.org] 4 months ago. Why was a critical issue with a two-line patch not fixed immediately? A better question - if the "bad guys" searched bugzilla for unfixed critical issues, how long would it take them to strike gold?

Re:Not that quick, actually (1)

BZ (40346) | more than 5 years ago | (#27372173)

Thing is, that patch fixes the particular crash but not the vulnerability. And no one at the time recognized that this was a security issue (unlike the numerous non-exploitable crashes)....

It's still a problem, of course. I don't think anyone's happy that that patch didn't land. :(

Re:Not that quick, actually (1)

dryeo (100693) | more than 5 years ago | (#27372285)

Bugzilla won't show certain critical bugs unless you have the right privileges. Hopefully the bad guys aren't developers with those privelages.

Regression testing? (0)

Anonymous Coward | more than 5 years ago | (#27370823)

Coming from a big software company, this seems like too fast of a release. Isn't there any significant regression testing that goes on to verify that no other bugs have been caused? Or is it just "verified this bug is closed...ship the release!"

Opera? (0)

Anonymous Coward | more than 5 years ago | (#27370873)

Once again, Opera has been forgotten.

Re:Opera? (2, Funny)

cp.tar (871488) | more than 5 years ago | (#27371305)

Who?

Mozilla (0)

Anonymous Coward | more than 5 years ago | (#27371557)

This is why I use Firefox and not Chrome/Safari/IE/etc. Firefox is always centered first and foremost on security, then speed, then features.

Besides the browser itself being very secure, it comes with plugins like NoScript, Ghostery, Objection, Adblock Plus + Elements, CookieSafe (I use CS Lite) that combined make it the most powerful browser against potential security vulnerabilities that you can get.

The most important one out of the bunch is NoScript, and I just can't live without it. Until other browser catch up with Mozilla's patching prowess and this particular plugin, they aren't worth my time.

Re:Mozilla (1)

Computershack (1143409) | more than 5 years ago | (#27371769)

On Vista and Win7, I'd rather use IE as it runs in a sandbox.
Load More Comments
Slashdot Account

Need an Account?

Forgot your password?

Don't worry, we never post anything without your permission.

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>
Create a Slashdot Account

Loading...