The first Firefox 1.5 security vulnerability, made public Thursday, is not as critical as initially perceived, but a patch will be available to fix it early next year, a Mozilla executive said Thursday.
Mozilla plans to repair the hole in the latest version of its open-source browser when it releases its next regularly scheduled stability build of Firefox. That should happen in late January or early February, said Mike Schroepfer, vice president of engineering for Mozilla Corp. Firefox 1.5 was released Nov. 30.
"Based on the information we have, it's a low-severity issue, but we will address it anyway," he said in an interview Thursday.
Packet Storm Security on Wednesday released code that takes advantage of the vulnerability, which can cause a buffer overflow and put users at risk of a denial of service attack when running the browser, according to a posting Thursday by independent security consultant John Bambenek on the SANS Internet Storm Center Web site (http://isc.sans.org/diary.php?storyid=920).
According to the posting, the vulnerability is in the browser's history.dat file, which stores a user's history of Web sites visited. It can be exploited by crafting an abnormally long URL with perhaps a few million characters. If a user navigates to a site that exploits the hole, "it will crash the browser each time it is started after going to such a page," Bambenek wrote in the posting.
Security research company Secunia Thursday gave the bug a rating of "not critical" on its Web site (http://secunia.com/advisories/17934/).
Schroepfer said that a team of volunteers and Mozilla engineers never discovered a denial-of-service problem using the proof of concept code from Packetstorm. "We have no independent confirmation that it crashes, not for lack of trying," he said.
Schroepfer said that when engineers tried to recreate the problem, the browser worked sluggishly and took an exceptionally long time to load a Web page, but only after the browser was closed and then restarted after the first security breach. However, the browser will not crash. "Eventually, it will process and will start properly," he said.
Furthermore, Schroepfer said it would be extremely rare for someone to visit a site that exploits the hole during a typical Web-browsing session. "You'd have to browse to a malicious site, one that someone spent the time to create to cause people harm," he said. "Then you'd have to browse there, and the next time your browser would take longer to start."
Even if a user does encounter a malicious Web site that exploits the hole, clearing out the browser's history will remedy the problem, Schroepfer added.
Mozilla Corp., a spin-off of the open-source Mozilla Foundation, oversees the release of the Mozilla software products Firefox and Thunderbird, an e-mail client.
Firefox 1.5 runs on versions of Windows from Windows 98 to XP, as well as Mac OS X and various flavors of Linux. Since its initial release last year, Firefox has been downloaded more than 100 million times, according to Mozilla.
This whitepaper explains the terminology and concepts behind Data Replication technologies and establishes some sizing rules through worked examples. Learn the new paradigm in disaster tolerance—protect data anywhere.
Download now »
Server virtualization is a popular option for dealing with mounting datacenter costs. Another equally promising approach is the use of an Application Delivery Controller. Citrix NetScaler provides a low-cost way for organizations to reduce their server count and accrue cost savings from a reduction in space, cooling, power and personnel.
Download now »
The emergence of WLANs has created a new breed of security threats to enterprise networks.
Included in HP ProCurve WLAN solutions is security technology that alleviates threats from WLANs through:
* Monitoring wireless activity inside and out of the enterprise
* Classifying WLAN transmissions into harmful and harmless
* Preventing transmissions that pose a security threat to the enterprise network
* Locating participating devices for physical remediation
Effectively address data protection challenges, implementing solutions that help store and protect business–critical data while cutting costs and improving efficiency and reliability.
Download now »
Sign up to receive Security Resource Alerts
This white paper provides guidance on how to develop a strategic approach to managing and monitoring logs, a key function required for compliance with many regulatory mandates and a critical defense against security threats.
Download now! »
Learn about the processes and technologies that support security information management (SIM) operations, as well as the business case for SIM. The series examines different options for implementing SIM and gives you evaluation criteria for selecting the best option for your organization.
Download now! »
Learn the strategies, actions, and capabilities that Best-in-Class organizations employ and technologies they choose to obtain superior performance against various security performance metrics. This report provides guidelines for identifying which security solutions to consume as a MSS and defines best practices for choosing and managing MSSPs.
Download now! »
Recommend This
