Extremely critical exploit reported in Firefox v1.0.3

859 Views 10 Replies 9 Participants Last post by Kraelis, May 11, 2005

Melly

Discussion Starter · May 9, 2005

Security researchers have discovered two unpatched vulnerabilities in Firefox, the popular alternative web browser. The security bugs affect even the latest version of Firefox (version 1.0.3) and create a means for attackers to seize control of vulnerable systems using cross-site scripting attacks. One vulnerability enables arbitrary JavaScript code with escalated privileges to be executed via a specially crafted JavaScript URL. Successful exploitation requires that a site is allowed to install software (default sites are "update.mozilla.org" and "addons.mozilla.org"). This would normally drastically reduce the scope for mischief - but for a second security bug, involving "IFRAME" JavaScript URLs, which creates a means to execute arbitrary HTML and script code in the context of an arbitrary site. A combination of the two vulnerabilities can be exploited to execute arbitrary code on vulnerable systems, according to Danish security firm Secunia. Exploit code is publicly available greatly increasing the chance of attack, it warns. The vulnerabilities - described by Secunia as "extremely critical" - have been confirmed in version 1.0.3 of Firefox. Other versions may also be affected. Users are advised to disable JavaScript and the software installation option within Firefox pending a more comprehensive fix from the Mozilla Foundation. ®

Save

1 - 11 of 11 Posts

Cylinder

· #2 · May 9, 2005

Dahahah...

/me browses on with IE, properly updated..

All kidding aside, It's not going to be all peaches and cream forever. You get big, you get attacked, nuff said.

Save

/me waits for those against FireFox to laugh at the users of FireFox
while
/me waits for those against IE to still brag that FireFox is more secure than IE

In other words, /me waits for the browser war

*sigh*

Save

Melly

Discussion Starter · #4 · May 9, 2005

I didn't mean to start a war... just wanted people to be aware!

Save

Esturk

· #5 · May 9, 2005

LOL. I'm just waiting for Linux to get huge and see what happens. Nothing is perfect.

Save

FLaRe85

· #6 · May 9, 2005

mikeshoup said:
/me waits for those against FireFox to laugh at the users of FireFox
while
/me waits for those against IE to still brag that FireFox is more secure than IE

In other words, /me waits for the browser war

*sigh*

stupid fanbois

Save

Boltzmann

· #7 · May 9, 2005

This is bound to happen in any large software project. Humans write codes like painters without a visual cortex.

Save

RZetlin

· #8 · May 10, 2005 (Edited)

So where's the firefox update?

I thought opensource programs were suppose to have a fix on the same day for the exploit?

Save

Boltzmann

· #9 · May 10, 2005

Well, someone has to write the fix

Save

Talbain

· #10 · May 10, 2005

FIREFOX R0xx0rs my B0xx0rs 0MG!!!!!

Just so you know, XSS (Cross-Site Scripting) creates huge holes in any browser as of right now. There is no known way to accurately fix XSS so that it cannot create huge security holes. This applies to IE and FireFox alike.

Save

Kraelis

· #11 · May 11, 2005

Like Talbain said, XSS is not just a browser specific problem. The problem is actually inherent in a complicated combination of standards, implementations and the like. It's hardly an earth shattering issue with what... hundreds of XSS problems reported every so often.

The IFRAME exploit might be important though. Will look into it.

Save

1 - 11 of 11 Posts

This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.

Top Contributors this Month