- Related Stories
-
Firefox sees 100 millionth download
October 19, 2005 -
Netscape update fixes Firefox bugs
October 19, 2005 -
Firefox promo site taken down by hackers
October 4, 2005
Exploit code for the latest version of open-source browser Firefox was published Wednesday, potentially putting users at risk of a denial-of-service attack.
The exploit code takes advantage of a bug in the recently released Firefox 1.5, running on Windows XP with Service Pack 2. Firefox, which initially debuted over a year ago, has moved swiftly to capture 8 percent of the browser market.
The latest Firefox flaw exists in the history.dat file, which stores information from Web sites users have visited with the Firefox 1.5 browser, according to a posting on the Internet Storm Center, which monitors online threats.
"If the topic of a page is crafted to be long enough, it will crash the browser each time it is started after going to such a page," according to the Internet Storm Center posting. "Once this happens, Firefox will be unable to be started until you erase the history.dat file manually."
In testing Firefox 1.5 without a system running McAfee security software, the Firefox 1.5 browser would stall and not respond to a user's mouse, said Johannes Ullrich, chief research officer for the Sans Institute, which runs the Internet Storm Center.
"Users have to kill out of the browser and start over again. This stalled browser creates a DOS (denial of service) condition," Ullrich said.
The author of the proof-of-concept exploit code, initially published by nonprofit group Packet Storm, claimed the glitch is a buffer overflow that could lead to a denial-of-service attack and may even be used for a malicious execution of code. Packet Storm itself said a possible denial-of-service condition exists.
Ullrich, however, said while the potential may exist, it has not been proven either way that malicious code could be executed.
The Mozilla Foundation, which released Firefox, said it was not able to confirm the browser would crash or be at risk of a DOS attack, after visiting certain Web sites. And Mozilla has not received any reports from users of such a problem, said Mike Schroepfer, vice president of engineering for Mozilla Corp.
He added that Firefox 1.5 can be slugglish on its next start-up, due to a bug in the history.dat, but it is not a security problem.
"We have gotten no independent verification that it crashes (Firefox), but there have been a lot of attempts to try," Schroepfer said.
See more CNET content tagged:
Firefox 1.5,
Internet Storm Center,
denial of service,
Firefox,
Mozilla Corp.
However, Mozilla needs to get a fix out for it ASAP. A flaw is a flaw no matter how hard or easy it is to exploit.
*yawn* Same old rhetoric...
Finding out about flaws and vunerability, may be somewhat scary, but researching, asking the support teams questions, putting the info you know out here so we all can stay ahead of the game, is the computer world.
If I find news on here say, I will visit many sites to find what I need to understand what to do.
Stay safe all
This is pitiful journalism!!!
What a load of utter crap, written by someone without a clue. I want to know who is paying CNet to publish **** like this?
News.com keeps this up, they're going to lose any sort of respect they might have had.
Oh, wait, they already have. As you were then.
- firefox - What a joy to use.
-
by grey_eminence
December 13, 2005 6:55 AM PST
- I love Firefox and the options.
-
Reply to this comment
-
See all 26 Comments >>