Firefox blighted by unpatched bug

[geminian68]

h**p://www.theregister.co.uk/2005/09/09/firefox_security_flap/

By John Leyden (john.leyden at theregister.co.uk)
Published Friday 9th September 2005 15:43 GMT

Security researchers have discovered an unpatched vulnerability (h**p://secunia.com/advisories/16764) in Firefox that might be used to crash vulnarable systems. Hackers might also use the security bug to trick surfers into running malicious code by simply fooling them into visiting a maliciously constructed website.

This is a class of problem well known to IE users but it will come as a nasty shock to users of the alternative browser, which has been seen as something of a safe haven from hacker attack even though this assumption has come under question over recent months. The vulnerability (h**p://security-protocols.com/advisory/sp-x17-advisory.txt), discovered by Tom Ferris of Security Protocols, has been confirmed in Firefox version 1.0.6. Previous versions may also be affected but this has yet to be confirmed. The security bug stems from an error in handling a URL that contains the 0xAD character in its domain name, giving rise to possible heap-based buffer overflow attacks. Security notification service Secunia describes (h**p://secunia.com/advisories/16764) the vulnerability as "highly critical". It advises users not to browse untrusted websites as a precaution. This isn't exactly the easiest precaution to stick to, though it's the only one on offer just now pending a more comprehensive workaround from the Mozilla Foundation. ®

[Stuart]

Interesting article, but why put h**p instead of http? It would make things easier if the reader could just click on the link..
__________________

Here's the link to the original article: http://www.theregister.co.uk/2005/09...security_flap/

[Richard M]

It will probably be fixed by Monday, I'm not that bothered by it.

[geminian68]

I couldn't remember whether live links were allowed on this forum, others I'm a member of don't allow them.

[Stuart]

Originally Posted by geminian68

I couldn't remember whether live links were allowed on this forum, others I'm a member of don't allow them.

We do allow them, as long as they don't point to anything against the forum ts&cs (ie, anything offensive, pornographic etc)>

[Mal]

See here and here for a fix
__________________

I've just done the manual fix and when I went to change it, it's already showing as false. Using 1.06

[Mal]

More info

Seems version 1.07 will fix the bug.

[Paul K]

Will it cover this one as well?
http://secunia.com/advisories/16869/

Secunia Advisory: SA16869 Print Advisory
Release Date: 2005-09-20
Critical:
Extremely critical
Impact: System access
Where: From remote
Solution Status: Unpatched
Software: Mozilla Firefox 1.x
CVE reference: CAN-2005-2968
Description:
Peter Zelezny has discovered a vulnerability in Firefox, which can be exploited by malicious people to compromise a user's system.
The vulnerability is caused due to the shell script used to launch Firefox parsing shell commands that are enclosed within backticks in the URL provided via the command line. This can e.g. be exploited to execute arbitrary shell commands by tricking a user into following a malicious link in an external application which uses Firefox as the default browser (e.g. the mail client Evolution on Red Hat Enterprise Linux 4).
This vulnerability can only be exploited on Unix / Linux based environments.
The vulnerability has been confirmed in version 1.0.6 on Fedora Core 4 and Red Hat Enterprise Linux 4. Other versions and platforms may also be affected.
Solution:
Do not open links in Firefox from external applications.

[Millay]

All really rather acedemic if you ask me, its not who is more buggy but surly who is more activly attacked, and soon im sure it will be firefox, but as I always do I use the browwser I find better not the one at most risk...