Critical Firefox flaw exposed

[Richard]

Chicago (IL) - According to media reports, a pair of hackers said on Saturday that the Firefox Web browser, commonly perceived as the safer and more customizable alternative to market leader Internet Explorer, is critically flawed. A presentation on the flaw was shown during the ToorCon hacker conference in San Diego.

The hackers claim that anyone running Firefox could be a victim of the flaw, which is related to the browser's handling of the Internet language JavaScript. Reportedly, someone could create a Web page with malicious JavaScript code that would specifically affect computers running Firefox browsers. The hackers, Mischa Spiegelmock and Andrew Wbeelsoi, claim that this could lead to remote control of any affected computer, including Windows, Apple, and Linux systems.

Spiegelmock reportedly said that the JavaScript implementation is a "complete mess" and that it is "impossible to patch." Upon watching a video of the presentation, Window Synder, Mozilla's security chief, said that this issue appears to be a "real vulnerability".

Reportedly, Snyder is also understandably upset about the public flow of this information, claiming that the details presented during the conference almost completely show how one could exploit the flaw. "I think it is unfortunate because it puts users at risk, but that seems to be their goal," she said.

Jesse Ruderman, another member on the Mozilla security staff, persuaded hackers to disclose any potential security holes via their "bug bounty" program, instead of maliciously exploiting them for hijacking vulnerable computers. Mozilla's bug-reporting system gives $500 to anyone who reports a vulnerability to the Firefox staff.

Firefox was originally introduced as an alternative to Internet Explorer, the browser that has long been known for easy exploiting and distribution of worms and viruses. Because Microsoft's browser contains such an enormous userbase, it has always remained the main target for hackers. However, Firefox's audience has been growing and it is becoming a viable target for hackers.

http://www.tgdaily.com/2006/10/02/firefo...ity_issue/

[violeteagle]

Firefox Flaw Demo Is Itself Flawed


One of the hackers who gave the demo says the main goal was to be humorous and has both apologized and retracted a bug claim.

http://www.informationweek.com/internet/...=193101659

One of two hackers who demonstrated a vulnerability in Mozilla Corp.'s Firefox at a hacker conference on Saturday has retracted claims that the bug could be exploited to hijack computers running the browser. In fact, the hacker's demo may have been little more than a joke.

Mischa Spiegelmock and Andrew Wbeelsoi showed exploit code for a Firefox JavaScript vulnerability at the ToorCon hacker conference amid claims that they had nearly three dozen vulnerabilities they weren't going to disclose. Mozilla immediately began investigating.

Monday, however, Spiegelmock forwarded a message to Mozilla that was posted on the company's developer center.

"We mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution," wrote Spiegelmock. "However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has.

"I do not have 30 undisclosed Firefox vulnerabilities, nor did I ever make this claim. I have no undisclosed Firefox vulnerabilities," he added.

"The main purpose of our talk was to be humorous. I apologize to everyone involved," Spiegelmock said.

Earlier Monday, Window Snyder, the new security chief of Mozilla, said her team had been unable to produce more than a browser crash with the exploit code. "Even though Mischa hasn't been able to achieve code execution, we still take this issue seriously," Snyder said in an accompanying message on the developer center site. "We will continue to investigate."

The investigation may hold up the update to Firefox 2.0 Release Candidate 2 (RC2). According to notes from a staff meeting posted online, a Friday release for RC2 has been scratched. Although RC2 has already been posted to Mozilla's FTP servers, it might be pulled to fix the JavaScript flaw and/or another bug in an overlooked dialog that remains in the code from previous test builds, said Mozilla.

Firefox 2.0 is nearly completion -- RC1 was launched last week -- and will compete with Microsoft's Internet Explorer 7 when it reaches final form.