Firefox flaw found: remote exploit possible

Computers running the Firefox browser could be open to remote attack as a result of a buffer overflow vulnerability reported Friday by security researcher Tom Ferris.

Vulnerable versions of Firefox include all those up to 1.06, and even version 1.5 Beta 1 (Deer Park Alpha 2), released on Thursday, he wrote in a posting to his Web site, Security Protocols, and to the Full Disclosure security mailing list just after 6 a.m. GMT Friday.

Ferris said he reported the bug to staff of the Mozilla Foundation, the organization behind the Firefox browsers, on Sept. 4, but had no idea whether they were working on a fix for the problem.

The problem is caused by a bug in the code Firefox uses to process HTML (Hypertext Markup Language) links in Web pages, Ferris said. Links pointing to a host with a long name composed entirely of dashes can be crafted so that Firefox will execute arbitrary code of an attacker's choosing, he said. He also supplied a piece of code demonstrating the flaw.

Last month, Ferris reported a critical flaw in fully patched versions of Microsoft's Internet Explorer 6 running on Windows XP Service Pack 2. The flaw was acknowledged by Microsoft, but in that instance, Ferris did not reveal any details of the flaw or how it could be exploited.