Firefox critical update?

[Chakolate]

I just dl'ed FF 1.0.2 because it was labelled 'critical update', but I've
somehow missed reading anything about what the critical update corrected.
Are they referring to the business about Firefox allowing IE to be
compromised?

Chak

 

[Mel]

I just dl'ed FF 1.0.2 because it was labelled 'critical update', but I've
somehow missed reading anything about what the critical update corrected.
Are they referring to the business about Firefox allowing IE to be
compromised?

Chak

http://www.techweb.com/wire/security/159905537


The group released Firefox 1.0.2 on its site to fix three flaws, including one inherited from Netscape in processing .gif image
files. That bug was discovered by Internet Security Systems (ISS), and if hackers were able to get users to visit sites or view
e-mail messages with specially-crafted .gif files, they could take control of their PCs.

A patch was produced before ISS alerted the public, said Chris Hofmann, chief of engineering at Mozilla, so no harm, no foul. "The
bug patched in this update has no known real world exploits, and we were able to provide a quick response."

This is the second security-related update of Firefox in the last month. In late February, the non-profit foundation released v.
1.0.1, which patched 17 vulnerabilities.

 

[me]

http://www.techweb.com/wire/security/159905537

Interesting, thanks.
FWIW, that page contains many webbugs.

J

 

[Mel]

Interesting, thanks.
FWIW, that page contains many webbugs.

http://xforce.iss.net/xforce/alerts/id/191

Affected Products:

Firefox - all versions prior to 1.0.2
Mozilla web browser - all versions prior to 1.7.6
Mozilla Thunderbird Mail - all versions prior to 1.0.2

Note: Additional versions may be affected, please contact your
vendor for confirmation.

Description:

Graphic Interchange Format (GIF) is a common and established image
standard. This image format is widely supported in applications that
view images, including web browsers and email clients developed by
the Mozilla Foundation.

Mozilla Foundation software makes use of a common image library to
render GIF images. This library contains a buffer overflow vulnerability
when processing a Netscape-specific extension block in GIF images.
Exploitation of this buffer overflow can lead to remote compromise of
affected machines with minimal user-interaction.

In order to exploit this vulnerability, an attacker would be required
to induce the victim to view a web page or email message containing a
maliciously-crafted GIF image.



http://www.securityfocus.com/advisories/8275

A buffer overflow bug was found in the way Firefox processes GIF images.
It is possible for an attacker to create a specially crafted GIF image,
which when viewed by a victim will execute arbitrary code as the victim.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0399 to this issue.

A bug was found in the way Firefox processes XUL content. If a malicious
web page can trick a user into dragging an object, it is possible to
load malicious XUL content. The Common Vulnerabilities and Exposures
project (cve.mitre.org) has assigned the name CAN-2005-0401 to this issue.

A bug was found in the way Firefox bookmarks content to the sidebar. If
a user can be tricked into bookmarking a malicious web page into the
sidebar panel, that page could execute arbitrary programs. The Common
Vulnerabilities and Exposures project (cve.mitre.org) has assigned the
name CAN-2005-0402 to this issue.

 

[bambam]

I just dl'ed FF 1.0.2 because it was labelled 'critical update', but
I've somehow missed reading anything about what the critical update
corrected. Are they referring to the business about Firefox allowing
IE to be compromised?

Not unless they disabled the OK button.
It wasn't a Firefox vulnerability, more user stupidity that enabled the
compromise.

 

[123]

I just dl'ed FF 1.0.2 because it was labelled 'critical update', but
I've somehow missed reading anything about what the critical update
corrected. Are they referring to the business about Firefox allowing
IE to be compromised?

Bullshit. Firefox does not compromise IE. Prove it or shut up.

 

[jimpgh2002]

Bullshit. Firefox does not compromise IE. Prove it or shut up.

Actually, I did see something recently that stated a FF bug
could cause a problem in I.E., even if I.E. wasn't running. I don't
have the link any more, since I installed the FF fix.
It's fine for you to be loyal to FF, but don't be blind. FF
has had bugs and no doubt will have some in the future. Nothing's
perfect.

 

[=?ISO-8859-1?Q?=BBQ=AB?=]

Actually, I did see something recently that stated a FF bug
could cause a problem in I.E., even if I.E. wasn't running. I don't
have the link any more, since I installed the FF fix.

If you oculd find the link again, you'd see that it was not a Firefox
bug at all. It hasn't been fixed. You are still free to install the
Java applet that attacks IE if you like.

 

[elaich]

It was actually a Java applet that installed malware into IE if the user
clicked the "OK" button, and it compromised almost all browsers, not just
Firefox.

There was a widely published article entitled "Firefox Spyware Infects IE?"
which seemed to be written in an attempt to tarnish Firefox's image. The
author of the article has spent the last 2 weeks dancing like a bug on a
hot plate, both on his on blog site, and on the Mozillazine pages, but
still refuses to change the headline of the article, even though it has
repeatedly been pointed out to him that many browsers are vulnerable.

The exploit that FF 1.0.2 fixes has to do with animated GIF images. Since
the exploit is in the old legacy code from Mozilla/Netscape days, any Gecko
based browser that has not been patched will be vulnerable. This would
include the brand new Netscape beta 8. The exploit was discovered last week
by IIS, and was patched in Firefox before it was ever publicized.

 

[Aaron]

Bullshit. Firefox does not compromise IE. Prove it or shut up.

I guess you are right here. The java applet happened to cause an
installation of some IE based spyware, but it could have easily being
changed to install some other malware.

 

[jimpgh2002]

If you oculd find the link again, you'd see that it was not a Firefox
bug at all. It hasn't been fixed. You are still free to install the
Java applet that attacks IE if you like.

I stand corrected then. What applet was it and where does it
come from?

 

[=?ISO-8859-1?Q?=BBQ=AB?=]

I stand corrected then. What applet was it and where does it
come from?

The author of the piece which describes it didn't give a link to it,
just told about it's consequences after he chose to install the thing.
Maybe at some point he revealed its location, but I don't have a link.

 

[Aaron]

The author of the piece which describes it didn't give a link to it,
just told about it's consequences after he chose to install the thing.
Maybe at some point he revealed its location, but I don't have a link.

There's actually a screenshot of it with a partly blanked out url, but
using google it's easy to get the correct page. But why would you want to
know?

 

[Chakolate]

The exploit that FF 1.0.2 fixes has to do with animated GIF images.
Since the exploit is in the old legacy code from Mozilla/Netscape
days, any Gecko based browser that has not been patched will be
vulnerable. This would include the brand new Netscape beta 8. The
exploit was discovered last week by IIS, and was patched in Firefox
before it was ever publicized.

Thank you for a very clear explanation.

Chakolate

 

[Chakolate]

Bullshit. Firefox does not compromise IE. Prove it or shut up.

As I see it, you have two problems. The first is that you don't read
well (I never said Firefox compromised IE) and the second is that you are
abominably rude. I suspect a little more maturity will correct both.

Chakolate

 

[Mike Andrade]

I just dl'ed FF 1.0.2 because it was labelled 'critical update',
but I've somehow missed reading anything about what the critical
update corrected. Are they referring to the business about
Firefox allowing IE to be compromised?

I downloaded it and installed it. My bookmarks toolbar shows up, but
no bookmarks show up and I cannot add any.

Seems to be that FF is eternally buggy.

 

[bambam]

I downloaded it and installed it. My bookmarks toolbar shows up, but
no bookmarks show up and I cannot add any.

Seems to be that FF is eternally buggy.

Funny how it works perfectly well for the majority.
The fault is obviously at your end! What have you done to try and remedy
this situation? Reinstalled? Redownloaded? Searched usenet and Firefox
forums?

 

[Mike Andrade]

What have you done to try and remedy
this situation?

Uninstalled it and stuck with a browser that actually works.

 

[elaich]

Thank you for a very clear explanation.

Chakolate

You're welcome.

 

[elaich]

Uninstalled it and stuck with a browser that actually works.

Good for you. Nobody is forcing you to use Firefox. Maybe you should demand
your money back?

Actually, I just switched to Mozilla 1.7.6 because of a similar issue when
I upgraded Firefox. In my case, all my extensions got broken when I
updated. Mozilla's path for the future is not clear, but MoFo has offered
that they will continue to issue the same critical upgrades for 1.7 that
they do for Firefox, at least for the near future. Mozilla is more stable.