Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Mozilla The Internet Security IT

2 Firefox Security Flaws Lead to Exploit Potential 417

Posted by timothy from the live-dangerously dept.
Marthisdil points out a News.com story which reports that "Two vulnerabilities in the popular Firefox browser have been rated "extremely critical" because exploit code is now available to take advantage of them." Security firm Secunia reported the vulnerabilities (and the "extremely critical" rating is theirs), but the News.com story points out that thus far, "no known cases have yet emerged where an attacker took advantage of the public exploit code." Update: 05/09 20:20 GMT by T : Rebron of the Mozilla Foundation sends a correction; this is really the same flaw reported yesterday. He suggests that you glance at the Mozilla security alert on this hole (as well other alerts at the Mozilla Security Center), and says "The Mozilla Foundation has made changes to our update servers that will protect users from this arbitrary code execution exploit."
This discussion has been archived. No new comments can be posted.

2 Firefox Security Flaws Lead to Exploit Potential More

2 Firefox Security Flaws Lead to Exploit Potential

Comments Filter:

  • IE (Score:3, Funny)

    by blake3737 ( 839993 ) on Monday May 09, 2005 @03:25PM (#12480157)
    I smell scandel, it was bill gates who wrote the code and you know it. IT's like the SetErrors flag in windows (Fp maybe?)

  • sorry.. (Score:2, Insightful)

    by rootedgimp ( 523254 )
    i dont mean to be trolling/flaimbait, but please
    mod me accordingly if i am.

    do we really need to see it posted here, every time
    a firefox sploit is found?

    gettin me all excited for nothing :/

    • Re:sorry.. (Score:5, Insightful)

      by ViperG ( 673659 ) on Monday May 09, 2005 @03:29PM (#12480214) Homepage Journal
      Well, I would agree, but then why does slashdot post every IE bug that comes up?

      • Re:sorry.. (Score:4, Funny)

        by Taladar ( 717494 ) on Monday May 09, 2005 @03:45PM (#12480441)
        Probably because lots of /. posters have to fix machines of relatives or at their work running IE.

      • Re:sorry.. (Score:5, Informative)

        by RoLi ( 141856 ) on Monday May 09, 2005 @04:14PM (#12480805)
        You got that all wrong.

        Firefox bugs get on the front page when they are exploitable in theory (this exploit here also worked only for a couple of hours because Mozilla's servers have been modified so Firefox is redirected to a non-whitelist site) while IE bugs get on the front page only when they cause serious mass infections.

      • Re:sorry.. (Score:3, Funny)

        by grolschie ( 610666 )
        Well, I would agree, but then why does slashdot post every IE bug that comes up?

        Because serious IE security holes are popping up every other day. The front page at /. would be choked with all the posts. But seriously, we all know that MS are notoriously slow at patching security holes, so people need to know that... <insert swiss cheese reference here>.

    • Re:sorry.. (Score:2, Interesting)

      by MankyD ( 567984 )
      We hear about it every time IE has an exploit - and most people flame MS like it hasn't already gone out of style. Why should Mozilla be immune to such treatment?

      • ...obligatory (Score:4, Funny)

        by op12 ( 830015 ) on Monday May 09, 2005 @03:44PM (#12480421) Homepage
        Welcome to Slashdot, you must be new here.

      • Re:sorry.. (Score:3, Insightful)

        by Anonymous Coward
        Because this is Slashdot, an extremely biased site that often reports opinions as news, and where the editors do all they can to promote flaming and bashing by adding inaccurate titles to the articles they post.

        The articles here _aren't_ supposed to be impartial and the user comments _aren't_ supposed to be insightful. Slashdot is all about preaching to the choir - if you want something else, I suggest you find a legimate news site.

        • Re:sorry.. (Score:3, Insightful)

          by rizzo ( 21697 )
          Because this is Slashdot, an extremely biased site that often reports opinions as news, and where the editors do all they can to promote flaming and bashing by adding inaccurate titles to the articles they post.

          s/Slashdot/Fox News/

      • Re:sorry.. (Score:4, Informative)

        by Herr_Nightingale ( 556106 ) on Monday May 09, 2005 @04:14PM (#12480794) Homepage
        The posted exploit code stopped working several minutes after posted on slashdot. The exploit code won't do anything at all.
        Reposting the story ad nauseum won't make it any more interesting or useful.

    • Re:sorry.. (Score:3, Informative)

      by angrist ( 787928 )
      Works for me, I visit slashdot more often than MOzilla.org.

      I'd rather get a headsup here, or even better yet .... How about a firefox plugin that automatically informs me when an exploit is found?

    • Re:sorry.. (Score:2, Informative)

      by mcsporran ( 832624 )
      But I actually need to know about this....I have the good fortune to admin no copies of IE.
    • The javascript privilege escalation exploit is quite a biggy so in the interest of creating awareness it isn't a bad thing. The real shameful thing about this is it is pretty much a dupe, giving little or no more information than the first submission. [slashdot.org].

      News of malicious use of the exploit in the wild may have been worthy, but if anything it says the risk is now lower.

      *shakes head and wonders off*

  • See! See! (Score:2, Insightful)

    by Anonymous Coward
    Exploits rise with popularity. Watch out desktop linux.

  • asdasd (Score:2, Insightful)

    by securehack5 ( 880712 )
    Seriously this Is getting repetitive. There are always flaws. Just update your browser and hope it doesn't become the next iexplore.

    • Re:asdasd (Score:3, Insightful)

      by Dionysus ( 12737 )
      Hmmm... this bug affects Firefox 1.0.3. Going to mozilla.org, there are no update to 1.0.3. The browser hasn't notified me that there is an update available. So where is the update? Or do you expect people to download the nightly?
    • Seriously this Is getting repetitive. There are always flaws. Just update your browser and hope it doesn't become the next iexplore.

      Seriously, this is getting repetitive. There are always flaws. Just run Windows Update and hope there's a patch for Internet Explorer.

  • And to think... (Score:5, Funny)

    by oskard ( 715652 ) on Monday May 09, 2005 @03:26PM (#12480173)
    I JUST got through explaining to my parents why Firefox is a safer alternative.
    • Read the Firefox code and prove it to yourself, or find someone you trust and get them to do it for you. Too bad you can't read the IE code to get the same level of assurance. And do you trust Bill? :-)

    • Re:And to think... (Score:5, Informative)

      by MikeFM ( 12491 ) on Monday May 09, 2005 @03:43PM (#12480408) Homepage Journal
      Does Microsoft offer bounties to those who find, and alert them to, security problems? Not as far as I know. This, along with the opensource nature of Firefox will eventually make it mature into a more solid product than IE is likely to be unless Microsoft changes it's attitude. Security is, and always has been, a goal with Firefox. That just isn't true of IE. Also Firefox has the benefit of 20/20 hindsight with it's design as it was designed after many important types of exploits were discovered whereas IE's codebase is much older.

      Overall, I think Firefox is more secure than IE and will just grow to be increasingly more secure with time. That doesn't mean it is flawless. :)

  • Don't downplay it (Score:4, Insightful)

    by Anonymous Coward on Monday May 09, 2005 @03:26PM (#12480176)
    Come on, timothy. This is hardly the time to be downplaying the severity, even though we all like Firefox. There are undoubtedly people using the posted code, and they wouldn't be likely to tell News.com about it. Everyone should upgrade immediately.

  • Bug Details (Score:5, Informative)

    by Talian ( 746379 ) * on Monday May 09, 2005 @03:26PM (#12480179)
    Before everyone freaks out, take a look at the bug notes to get the details.

    Exploitation requires the javascript bug AND a whitelisted site. The only default whitelisted site is the update.mozilla.org, and they have made changes to mitigate the problem on their end.

    So unless you've whitelisted a lot of extra sites to install themes or extensions, this is not a huge risk. To be sure, disable install "Allow websites to install software" under options | web features, and if really worried, disable javascript.

    • Re:Bug Details - Poison DNS (Score:5, Insightful)

      by Chairboy ( 88841 ) on Monday May 09, 2005 @03:33PM (#12480281) Homepage
      So combine this with a poisoned DNS attack. update.mozilla.org resolves as your malware server, then you use this exploit.

      Sure, it makes it a little harder to execute then, say, something like Nimda that could run free across the internet, but it's still a valid security issue.
    • XPI installation isn't the most dangerous part of the IFRAME exploit. As posted in this comment [slashdot.org] by some Anonymous Coward it can steal your cookies and probably more some.

  • Mozilla's Security? (Score:5, Insightful)

    by sterno ( 16320 ) on Monday May 09, 2005 @03:29PM (#12480215) Homepage
    Mozilla and Firefox have been recommended as alternatives to IE for security reasons. Yet, lately, it seems that there's quite a lot of security problems being uncovered in Firefox. So I'm trying to figure out how to read this.

    I suspect that Firefox is somewhat more secure on the simple basis that it is not as tightly integrated with the rest of the operating system as IE is. What makes IE exploits so nasty is that they tend to become email and other exploits too.

    My concern is that if Firefox gains some more ground and does become a more active target for exploits, that it may become a poster child Microsoft can use to point out that open source software's "many eyes" theory is hogwash. Maybe it is hogwash.

    • Re:Mozilla's Security? (Score:3, Interesting)

      by garcia ( 6573 ) *
      it may become a poster child Microsoft can use to point out that open source software's "many eyes" theory is hogwash. Maybe it is hogwash.

      I don't run Firefox because I find it inferior to IE in rendering pages as they were intended (yes, we live in an IE world, deal with it).

      As far as "many eyes" being hogwash, I can't agree. Even though these exploits were found recently work has been done to make sure that the exploits are closed quickly. Some of MSFT's holes were left open for MONTHS before anythin

      • Re:Mozilla's Security? (Score:5, Insightful)

        by Blkdeath ( 530393 ) on Monday May 09, 2005 @03:53PM (#12480551) Homepage
        I don't run Firefox because I find it inferior to IE in rendering pages as they were intended (yes, we live in an IE world, deal with it).

        I used to think the same thing, but I stuck it out and just dealt with the incorrectly rendered pages. Of course there have always been / will always be people who think like you, but the fact is many (most) pages now render correctly in FireFox.

        As alternate browsers are again being recognized as statistically significant companies and even hobbyist webmasters are starting to realize their value. If you see a site that isn't rendering correctly, contact the site owner and inform them. Your message might not turn the tide, but perhaps combined with the 5-6 they received last week yours will be enough to convince them of the advantage of compliance.

        Please, though, don't send a nasty-gram espousing the virtues of open source, criticizing Microsoft (no need to even mention MS/IE) as it destroys all of our credibility.

    • Re:Mozilla's Security? (Score:5, Insightful)

      by Uruk ( 4907 ) on Monday May 09, 2005 @03:41PM (#12480372)

      A few points to consider when you're evaluating the security of software:

      • Security issue visibility is not the same thing as security. Just because IE has more exploits publicized (or Firefox has more) doesn't actually mean they're more or less secure, it means they're getting more public attention about their security. Important difference. If someone has an objective, quantitative, and verifiable way of measuring a piece of software's security so that we can actually make these comparisons, I'd love to see it
      • The more users use a piece of software, the more it will be targeted. But again, that's not the same thing as saying "the more it will be exploited"
      • Most users ultimately decide based on personal experience, which typically trumps abstract reporting. Have you ever had a problem with Firefox? Have you ever had a problem with IE? I'd suspect most people who switched to Firefox did it because they actually experienced a problem with IE, not because it was more ideologically pure.

    • Re:Mozilla's Security? (Score:3, Interesting)

      by molo ( 94384 )
      Its the security response that is really beneficial.. Microsoft has sat on bugs for months and months before releasing fixes. Mozilla has a transparent bug tracking system that you can access to get patches and so forth, before they even release an update. And they tend to release updates within days, not months.

      -molo

    • Re:Mozilla's Security? (Score:4, Insightful)

      by buhatkj ( 712163 ) on Monday May 09, 2005 @03:52PM (#12480546) Homepage
      I dunno, I just use firefox because I like it better. The tabbed browsing is awesome and it feels a little faster on my PC than IE. A little experience in network administration has showed me that the best security is physical security, and even that sucks. The web is not safe...nothing is really. "safe" is kind of a subjective and largely meaningless term anyway, without a qualifier of "more" or "less". eg. "Wearing a seatbelt is more safe than not wearing one." Either way, there's a good chance that if you crash bad enough you're toast ;-)

      SO, not to get too wierd on anyone...really, it's all probably hogwash, the whole bloody pursuit of "safety and security". Take the obvious precautions yes(update your software, use a firewall...), but don't get all surprised and indignant when somebody figures out how to break them!
  • When was this vulnerability first introduced? How long did/has it gone unpatched? Inquiring minds want to know.

  • What Firefox needs is... (Score:5, Insightful)

    by turbofisk ( 602472 ) on Monday May 09, 2005 @03:30PM (#12480223)
    What Firefox (and the rest of the suite) is a good way to upgrade the software, without installing everything as a new user would... This is something they really should fix...

  • It was expected (Score:5, Insightful)

    by mpontes ( 878663 ) on Monday May 09, 2005 @03:30PM (#12480236)
    With the spotlight on Firefox, it's obvious a lot more crackers and hackers are going to start looking at Mozilla Foundation's code. While previously there was little incentive for crackers to exploit vulnerabilities in MoFo's code, you can't say that now, with all the attention Firefox caught.

    It's up to MoFo to fix their software as soon as vulnerabilities are reported now. The play time is over, from now on it's going to be Browser Wars II: The Security Menace.

  • Balanced? (Score:5, Insightful)

    by PDHoss ( 141657 ) on Monday May 09, 2005 @03:31PM (#12480250)
    "no known cases have yet emerged where an attacker took advantage of the public exploit code."

    I appreciate this clarification. And I'm sure such a clarification will be included in the next IE bug report posted on Slashdot... Right?

    PDHoss

    • Re:Balanced? (Score:3, Insightful)

      by Uruk ( 4907 )
      Where does Slashdot say that it will provide a fair and balanced view of technology? Where does the site claim to be a source of unbiased journalistic excellence?

      Isn't it incumbent upon all readers of all internet media to identify bias and understand what they're reading, and the viewpoint that it's coming from? Even when people do claim to be impartial that's necessary to do.

      It's a tech site that's provided for tidbits of information, and to furnish and environment where we can all pick on each other.
  • Anyone know of a Firefox distribution that can be executed(and consequently updated just once) from a network drive or thumb drive?

    I ask because I have alot of extensions on each of my Firefox installations. I have Firefox on my desktop at work, my laptop, my home computer, my wife's computer, etc etc

    updating one computer (and then going into safe mode to find the extension that freaked out) is not that bad. But updating 5 or 10 computers can be a pain in the butt. Can I run ONE Firefox from *some
    • Try Portable Firefox [johnhaller.com].

      Note that all of your extensions, bookmarks, themes etc are stored in one directory (on Windows, it's in %appdata%/firefox/, or something - I do't have access to a Windows machine right now) so you just need to carry this directory around with you - no need to manually install extensions etc every time you do a new install.

  • Does this affect Mozilla also? (Score:5, Interesting)

    by llzackll ( 68018 ) on Monday May 09, 2005 @03:35PM (#12480305)
    I'm a Mozilla user. I don't use Firefox. I'm guessing that Mozilla is affected by this as well, but every time a security flaw is found, only Firefox is mentioned.

  • LINUX USERS DON'T GET VIRUSES (Score:4, Funny)

    by Anonymous Coward on Monday May 09, 2005 @03:41PM (#12480369)
    Mind you, they don't get laid, either.

  • In other news... (Score:2, Funny)

    by Anonymous Coward
    .. two unpatched security security holes (code named timothy and CmdrTaco) in Slashdot allowing posting of dupes were disclosed.

  • One Vulnerability Already Fixed (Score:5, Informative)

    by Master of Transhuman ( 597628 ) on Monday May 09, 2005 @03:44PM (#12480419) Homepage
    From a news report:

    Because the foundation controls all sites in the default software installation white list, it has been able to take preventative action by placing more checks in the server-side Mozilla Update code and moving the update site to another domain.

    The foundation said users who have not added any additional sites to their software installation white list are no longer at risk.

    So one down, the other to be fixed shortly.

    Meanwhile I got a notice this morning that tomorrow's Microsoft security patch will fix one major flaw, but leave others unpatched UNTIL NEXT MONTH.

    So much for "days of unpatched vulnerability" supposedly favoring Microsoft.

  • On behalf of the IE programming team, let me be the first to say "Neener neener neener!"

  • Comment removed based on user account deletion

  • Should not be exploitable any more (Score:5, Informative)

    by CTho9305 ( 264265 ) on Monday May 09, 2005 @03:57PM (#12480610) Homepage
    On Saturday, the Mozilla Update team, plus some Mozilla devs, took steps which prevented all published exploits we'd found from working. On Sunday, Mozilla Update was moved to an untrusted URL; as a result, users who have not added other sites to their whitelist should now be safe from the remote code execution attack.

  • Solution (Score:5, Informative)

    by cryptocom ( 833376 ) on Monday May 09, 2005 @04:05PM (#12480706)
    Tools/Options/Web Features/"Allow web sites to install software" - uncheck it. I don't know why this isn't unchecked by default.
  • Sure, MoFo can get out patches quicker and take other actions quicker because they don't have to pass through tons of quality control....but the point is that the everyday user doesn't update it.

    If Firefox is going to win in the Browser Security Wars, they need to make the "critical update" thingy from the toolbar pop up, raise hell, close the browser, have someone check a disclaimer to skip it, etc. It needs to be ABSOLUTELY clear to the user that ignoring a critical update is a Bad Thing(tm).

    They also

  • The bugtraq post... (Score:5, Informative)

    by EvilStein ( 414640 ) <.ten.pbp. .ta. .maps.> on Monday May 09, 2005 @04:15PM (#12480826)
    Another post mentions that someone is claiming an 0-day exploit in the wild for these issues.

    From BT:

    Firefox Remote Compromise Technical Details

    Before I start, I need to say that this thing has been patched on Mozilla's server. If you take a look at any of the extension install pages on their site, you will see that the install function has a bunch of random letters and numbers after it. Even though this would probably be an easy thing to bypass, I am not going to attempt it because of the uselessness of such a bypass. A patch is already in development and so any more work going into fine-tuning this exploit would be a waist of time.

    There are three core vulnerabilities being used in my example. A friend of mine (Michael Krax, http://www.mikx.de/ [www.mikx.de] helped me with the research.

    To understand why the example works, one must understand the basics of how Firefox works. Everything you see in firefox is essentially a webpage being rendered by a compiler. This is what the gui is made of, and this is why firefox is so easy to customize. However, it also allows for some security bugs. If one could get one of the chrome pages to request a javascript:[script] url, that individual would be given complete access to the system because chrome urls are given full rights in firefox. My example works by tricking the addon install function into displaying an icon with a javascript url.

    However, this would not be enough to compromise the system. By default, the install feature only works when called from a page within update.mozilla.org or addon.mozilla.org. Therefore, another (cross site scripting) vulnerability had to be found to call the install feature from mozilla.org. This vulnerability navigates to a javascript page and displays a link (pointing to a mozilla.org page) within a frame that follows the user's cursor. After the user clicks, the link is navigated to, which fires the onload event. This is a buggy event in Firefox because with it we can now access certain parts of the window object that we shouldnt, such as the history object. After the page loads, we use the history object to navigate backwards to the javascript page. The javascript is executed again, now from update.mozilla.org because when we navigated backwards, we essentially navigated to a javascript:[script] page. Now we call the install addon feature, which displays a dialog with det
    ails of the requested addon, including an image with a specified image. This image points to a javascript:[script] url, which gets executed in the context of chrome. Now we have compromised the system :)

    Whew, that was quite a mouthful.

    I am still trying to gather all the details as to how my research was leaked, but recent conversations are leading me to believe that it was a misplacement of trust, not a server compromise. However, I do not want to jump to conclusions too quickly, as this will only lead to more problems. That's all I will say about that subject, as I don't want to offend anybody.

    Also, I would like to let everyone know that this is not the only vulnerability that Mikx and I have found. We still have a couple of tricks up our sleeves, and you can be sure that we will not make the same mistake twice.

    If you want to see the original PoC, here is the url:
    http://greyhatsecurity.org/vulntests/ffrc.htm [greyhatsecurity.org]

    Paul
    Greyhats Security
    http://greyhatsecurity.org/ [greyhatsecurity.org]

  • In other news (Score:3, Insightful)

    by pg110404 ( 836120 ) on Monday May 09, 2005 @04:40PM (#12481145)
    A serious exploit flaw has been found. So severe is the flaw that it spans all hardware and all software. It matters not if your computer is patched or unpatched. This exploit flaw is so serious that any computer that emits power from its power supply is vulnerable. The only security fix to this devastating exploit flaw involves pulling the power plug from the computer.

    ......Seriously though, there has always been a direct correlation between usability and security. Any time features are added to a piece of software to make it more usable, will make it more vulnerable and open to flaws that can be exploited. Firefox may have started out as a stripped down, no nonsense browser, but with its popularity rising, feature creep sets in and inherent flaws will be discovered and exploited.

    The only way to make it 100% secure is to make sure nothing can be done to the system, and that's powered off with no automated way of powering on (i.e. it's unplugged). Once we accept that it MUST be plugged in to be usable, we need to accept the possibility of exploits. Given that, however, we can't accept defeatism, and must strive to fix it.

    The typical rhetoric of "There see? product y is just as insecure as product x", and "Well at least the exploit count is 2, not 50!", only serves to distract us from the real goal of getting better and MORE secure software. Like the saying goes, "SHIT HAPPENS". Let's just learn from it and move on.

    Security through obscurity is theoretically plausible, but not very practical. What may be firefox's saving grace is that it's open source and is not held as proprietary IP, controlled by a corporation out for profit, thus the evolution of the product is driven by its need to simply be better.

    Perhaps microsoft will see these flaws as proof that open source doesn't work and will lower their own standards, making IE7 less secure or shipping earlier with less stability, or maybe they will take this opportunity to make IE7 that much better in the hopes of regaining popularity and claiming vindication. As long as firefox advances and closes those holes, we still have one extra viable choice. This would only result in a fundamentally more secure web surfing experience.

  • Hey! (Score:4, Insightful)

    by antoy ( 665494 ) <alexis@thMOSCOWenull.net minus city> on Monday May 09, 2005 @04:46PM (#12481214)
    I'm surprised (or maybe I missed something). Why is noone asking the real questions here?

    Sure, Firefox had two security flaws. Okay. HOW were those vulnerabilites found? Were they found because Firefox is an open-source program, and has the 'many eyes' advantage? Were the people who found them going through the code, evaluating and auditing it function-by-function is search of flaws?

    Or were they testing against it in the traditional way, the way IE vulnerabilities were found? Or maybe a combination of the two?

    The article doesn't say, but I believe this is more important to know than the current count on a Firefox/IE vulnerability pissing match. It's the best example (or counter-example) of open-source security in action that we have. If anyone can supply this information, I (and others, perhaps) will be most grateful.

  • Uh huh (Score:5, Insightful)

    by Myopic ( 18616 ) on Monday May 09, 2005 @05:26PM (#12481739)
    Can you imagine what would happen if bugs in proprietary software (I'm thinking of Windows or IE) were considered "extremely critical" as soon as an exploit was solidified in code? I mean, if "extremely critical" corresponds to "it is *possible* to exploit this bug" then what is the term to describe a bug which in fact is wreaking havoc on worldwide information infrastructure (as many Windows bugs)?

Slashdot Top Deals

What is research but a blind date with knowledge? -- Will Harvey

Close