
Exploit goes public...
Published: 9 December 2005 08:45 GMT
Exploit code for the latest version of open-source browser Firefox was published on Wednesday, potentially putting users at risk of a denial of service (DoS) attack.
The exploit code takes advantage of a bug in the recently released Firefox 1.5, running on Windows XP with Service Pack 2. Firefox, which initially debuted more than a year ago, has moved swiftly to capture eight per cent of the browser market.
The latest Firefox flaw exists in the history.dat file, which stores information from websites users have visited with the Firefox 1.5 browser, according to a posting on the Internet Storm Center, which monitors online threats.
According to the posting: "If the topic of a page is crafted to be long enough, it will crash the browser each time it is started after going to such a page. Once this happens, Firefox will be unable to be started until you erase the history.dat file manually."
In testing Firefox 1.5 without a system running McAfee security software, the Firefox 1.5 browser would stall and not respond to a user's mouse, said Johannes Ullrich, chief research officer for the Sans Institute, which runs the Internet Storm Center.
Ullrich said: "Users have to kill out of the browser and start over again. This stalled browser creates a DoS condition."
Packet Storm, the security group that initially published the proof-of-concept exploit code, noted that in addition to the potential DoS attack that could follow a buffer overflow, systems may also be subject to a malicious execution of code.
Ullrich, however, said while the potential may exist, it has not been proven either way that malicious code could be executed.
The Mozilla Foundation, which released Firefox, said it was not able to confirm the browser would crash or be at risk of a DoS attack, after visiting certain websites. And Mozilla has not received any reports from users of such a problem, said Mike Schroepfer, vice president of engineering for Mozilla Corp.
He added that Firefox 1.5 can be sluggish on its next start-up, due to a bug in the history.dat but that this is not a security problem.
Schroepfer said: "We have gotten no independent verification that it crashes [Firefox] but there have been a lot of attempts to try."
Dawn Kawamoto writes for CNET News.com
WAI, AAA) and cross browser development skills. You will be developing high-end, client-facing websites using CSS, HTML, XHTML, Java Script and will ...
TCP/IP, VPNs, Firewall configuration - IIS Server - Knowledge of Informix database or MS DOS This is a great opportunity to work on with a well ...
Web Developer required to design and develop public-facing websites and e-commerce solutions in support of e-marketing objectives. Also involved will ...
CIO50 2008
The silicon.com CIO50 2008 profiles the most influential and innovative tech chiefs in the UK across all industries and organisation size, from the biggest FTSE100 companies to high growth dot-com start ups and the public sector. The list was voted on by the UK CIO community and a panel of experts. Find out more in our latest special report.
Stories from the web...
Copyright ©1995-2008 CNET Networks, Inc. All rights reserved. Top of page
Ruth Hoy Legal Eye: Who's tracking your online trail? Putting privacy under the spotlight
Louella Fernandes Quocirca's Straight Talking: License this software Time to get your house in order