Cable Forum
Page 1 of 2 1 2
Show 100 post(s) from this thread on one page

Cable Forum (https://www.cableforum.uk/board/index.php)
-   Security & Virus Discussion (https://www.cableforum.uk/board/forumdisplay.php?f=38)
-   -   Firefox Exploit Targets Zero Day Vulns (https://www.cableforum.uk/board/showthread.php?t=28345)

Neil 09-05-2005 12:50
Firefox Exploit Targets Zero Day Vulns
 
Quote:
Originally Posted by El Reg
Security researchers have discovered two unpatched vulnerabilities in Firefox, the popular alternative web browser. The security bugs affect even the latest version of Firefox (version 1.0.3) and create a means for attackers to seize control of vulnerable systems using cross-site scripting attacks.

One vulnerability enables arbitrary JavaScript code with escalated privileges to be executed via a specially crafted JavaScript URL. Successful exploitation requires that a site is allowed to install software (default sites are "update.mozilla.org" and "addons.mozilla.org"). This would normally drastically reduce the scope for mischief - but for a second security bug, involving "IFRAME" JavaScript URLs, which creates a means to execute arbitrary HTML and script code in the context of an arbitrary site.
More Info Here....

Paul K 09-05-2005 12:51
New FF vulnerability found
 
0 Day exploit
Quote:
Security researchers have discovered two unpatched vulnerabilities in Firefox, the popular alternative web browser. The security bugs affect even the latest version of Firefox (version 1.0.3) and create a means for attackers to seize control of vulnerable systems using cross-site scripting attacks.

One vulnerability enables arbitrary JavaScript code with escalated privileges to be executed via a specially crafted JavaScript URL. Successful exploitation requires that a site is allowed to install software (default sites are "update.mozilla.org" and "addons.mozilla.org"). This would normally drastically reduce the scope for mischief - but for a second security bug, involving "IFRAME" JavaScript URLs, which creates a means to execute arbitrary HTML and script code in the context of an arbitrary site.

A combination of the two vulnerabilities can be exploited to execute arbitrary code on vulnerable systems, according to Danish security firm Secunia. Exploit code is publicly available greatly increasing the chance of attack, it warns. The vulnerabilities - described by Secunia as "extremely critical" - have been confirmed in version 1.0.3 of Firefox. Other versions may also be affected.

Users are advised to disable JavaScript and the software installation option within Firefox pending a more comprehensive fix from the Mozilla Foundation. ®

Paul K 09-05-2005 12:53
Re: Firefox Exploit Targets Zero Day Vulns
 
Beat me by a minute :( :p:
http://www.cableforum.co.uk/board/sh...923#post466923

Neil 09-05-2005 12:58
Re: Firefox Exploit Targets Zero Day Vulns
 
Quote:
Originally Posted by Paul
And I posted it in the correct forum too.....;)

Mal 09-05-2005 13:01
Re: Firefox Exploit Targets Zero Day Vulns
 
More info here

Mal 10-05-2005 17:30
Re: Firefox Exploit Targets Zero Day Vulns
 
...and a bit more info here

Paul K 10-05-2005 20:14
Re: Firefox Exploit Targets Zero Day Vulns
 
Already seen reports of 1.0.4 version that is patched against the vulnerability. Wonder when they will release it?

Gareth 10-05-2005 21:29
Re: Firefox Exploit Targets Zero Day Vulns
 
I think this could be a good opportunity for demonstrating how quickly a fix can be prepared within the open source community. I'm not surprised there are flaws in Firefox (I would be surprised if there weren't any!), so the key is getting the fixes shipped quickly.

Gareth 11-05-2005 21:13
Re: Firefox Exploit Targets Zero Day Vulns
 
Well, almost 24 hours since my last post, you can now get FF 1.04 from here: http://ftp.mozilla.org/pub/mozilla.o...t-aviary1.0.1/

Alternatively, this will filter through the normal channels over the next few hours, so you'll be able to upgrade from getfirefox.com soon too.

Mal 11-05-2005 21:20
Re: Firefox Exploit Targets Zero Day Vulns
 
Quote:
Originally Posted by Gareth
Well, almost 24 hours since my last post, you can now get FF 1.04 from here: http://ftp.mozilla.org/pub/mozilla.o...t-aviary1.0.1/

Alternatively, this will filter through the normal channels over the next few hours, so you'll be able to upgrade from getfirefox.com soon too.
Those are release candidates that are available. :)

Richard M 11-05-2005 21:51
Re: Firefox Exploit Targets Zero Day Vulns
 
Yet another example of how Firefox is better, security wise.
Not one IT professional I know runs IE.

Gareth 11-05-2005 22:10
Re: Firefox Exploit Targets Zero Day Vulns
 
Quote:
Originally Posted by Mal
Those are release candidates that are available. :)
Heh, yeah... forgot to mention that. Best wait if you don't like installing RC's :)

Paul K 12-05-2005 07:18
Re: Firefox Exploit Targets Zero Day Vulns
 
Release version is out
http://ftp.mozilla.org/pub/mozilla.o...eleases/1.0.4/

Paul K 12-05-2005 09:30
Re: Firefox Exploit Targets Zero Day Vulns
 
Also alvailable from the main page now as well
http://download.mozilla.org/?product...win&lang=en-US

Richard M 12-05-2005 10:34
Re: Firefox Exploit Targets Zero Day Vulns
 
Kinda unrelated but I found this comment in the Firefox source code:
Quote:
// C++ sucks! There's no way to do this with a macro, at least not
// that I know, if you know how to do this with a macro then please do
// so...
static const PRUnichar sHTMLTagUnicodeName_a[] =
{'a', '\0'};
static const PRUnichar sHTMLTagUnicodeName_abbr[] =
{'a', 'b', 'b', 'r', '\0'};
static const PRUnichar sHTMLTagUnicodeName_acronym[] =
{'a', 'c', 'r', 'o', 'n', 'y', 'm', '\0'};
It then goes on to list hundreds more HTML tags. :D


All times are GMT. The time now is 14:44.
Page 1 of 2 1 2
Show 100 post(s) from this thread on one page

Powered by vBulletin® Version 3.8.11
Copyright ©2000 - 2026, vBulletin Solutions Inc.
All Posts and Content are © Cable Forum