Firefox vulnerability could cause remote code excecution

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

Quote:
Title: Mozilla Firefox 3.5 Remote Code Execution Vulnerability
Severity: HIGH
Description:

Mozilla Firefox is a web browser available for various platforms.

Firefox is prone to a remote code-execution vulnerability due to an unspecified error. This issue arises during the processing of JavaScript and may present itself when certain string characters are escaped and subsequently copied to a buffer.

Successful exploits may allow an attacker to execute arbitrary code in the context of the user running the affected application. Failed attempts will likely result in denial-of-service conditions.

The issue affects Firefox 3.5; other versions may also be vulnerable.

The remote code execution was confirmed in Firefox 3.5 running on Microsoft Windows XP SP2. A crash was observed in Firefox 3.5 on Microsoft Windows XP SP3.
Affected Products:

* Mozilla Firefox 3.5.0
http://www.juniper.net/security/auto...vuln35660.html

In 2007 and 2008 FireFox was the most vulnerable browser which had the most critical level security issues. It looks like it's on track to get the title for a 3rd straight year!

If you like a secure browser and one with a minimal plug-in footprint:

IE7 or IE8 + http://www.ie7pro.com = The way to go

Killamus

Guest

Join Date: Oct 2008

Or, you know, just use noscript, like everyone who uses firefox does.

The Air Revenger

Lion's Arch Merchant

Join Date: Feb 2008

Looking For TA Guild!

W/

DONT get IE, just run no-script on firefox and your fine or get google crome.

Sindo

Sindo

Ascalonian Squire

Join Date: May 2008

West Kentshire Pony Club [Pony]

Me/

LOLZ!

IE is worse than Firefox without noscript.

MisterB

MisterB

Furnace Stoker

Join Date: Oct 2005

Planet Earth, Sol system, Milky Way galaxy

[ban]

W/

http://noscript.net/

What JavaScript vulnerability?

Braxton619

Braxton619

Desert Nomad

Join Date: Jul 2008

A/W

lmao IE has so many exploits is soooo funny... hahaahaha

btw firefox doesnt have many.. IE has tons and tons

Pretty much Firefox is unexploitable with No Script

gremlin

Furnace Stoker

Join Date: Oct 2006

GWAR

Me/Mo

I use firefox and have done for a number of years noscript are two essentials for me.

I was completely sold on firefox the first time I crashed it
Came back after a reboot to the message firefox was unexpectedly shut down would you like to go back to the page you were on.

It remembered that page, all the other tabs and let me continue downloading a file from where I left off.

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

Quote:
Originally Posted by gremlin View Post
I use firefox and have done for a number of years noscript and adblock plus are two essentials for me.

I was completely sold on firefox the first time I crashed it
Came back after a reboot to the message firefox was unexpectedly shut down would you like to go back to the page you were on.

It remembered that page, all the other tabs and let me continue downloading a file from where I left off.
IE7/8 has always done that!

Killamus

Guest

Join Date: Oct 2008

Quote:
Originally Posted by Kuntz View Post
IE7/8 has always done that!
Firefox has done that (At least on Linux) since IE5.

IE has a lot more holes, they're just patched faster then on Firefox.
Aside from the ease of use, that's the only difference.
Oh, and noscript, which stops 99% of the bugs that cause these anyways.

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

Quote:
Originally Posted by Killamus View Post
IE has a lot more holes, they're just patched faster then on Firefox.
But that is something you just made up and is not a fact. Firefox is the most vulnerable browser available to you, plug-ins or otherwise. It is amazing that if enough people lie in blogs about something, average people like you will believe it as fact, without ever doing your own research or asking any questions.

[LI] Firefox Security Superiority a Myth - Overclock.net - Overclocking.net

[INQ] Firefox fixes eight security flaws - Overclock.net - Overclocking.net

[TcMag] Mozilla Firefox comes up as most vulnerable application - Overclock.net - Overclocking.net

Quote:
Mozilla's popular internet browser Firefox has been recorded as the most vulnerable application amongst consumer software of 2007, says researchers from the Bit9. Both Firefox 2.x and Firefox 3.x were found to be open to attack from 40 well known severe vulnerabilities over the course of the 12 month analysis.
Quote:
There were 115 reported security vulnerabilities in Firefox last year [2008] -- almost twice as many as Internet Explorer and Apple's (Nasdaq: AAPL) Safari browser combined, according to a new report by the security researcher.
FireFox has 21% of the market share, but 50% of the security exploit share. It will get exponentially worse as the market share for FF increases.

Koji Murasame

Koji Murasame

Ascalonian Squire

Join Date: May 2009

Kentucky

Knights of Ravens War [mvm]

http://en.wikipedia.org/wiki/Compari...ulnerabilities

Yes, but you have to look at the whole picture. . .

gremlin

Furnace Stoker

Join Date: Oct 2006

GWAR

Me/Mo

Quote:
Originally Posted by Kuntz View Post
IE7/8 has always done that!
Really ?
Well sadly I jumped ship on IE years ago, they way I look at it is IE should be the best browser bar none and it isn't.
Windows media player should also be the best there is and it isn't.
Why ever not after all they are made by the people who wrote the operating system.

The only reason Microsoft make improvements is because everyone is deserting them for better options.
Then sometimes years later they catch up, if I use the alternatives I get the extras early.

jackers1234

jackers1234

Frost Gate Guardian

Join Date: Jun 2006

My House

N/A

Mo/Me

i love firefox fanchildren, they provide me with much amusement =P

having said that, i do agree that firefox is ahead of ie interms of features and security.

Killamus

Guest

Join Date: Oct 2008

Quote:
Originally Posted by Kuntz View Post
But that is something you just made up and is not a fact. Firefox is the most vulnerable browser available to you, plug-ins or otherwise. It is amazing that if enough people lie in blogs about something, average people like you will believe it as fact, without ever doing your own research or asking any questions.

[LI] Firefox Security Superiority a Myth - Overclock.net - Overclocking.net

[INQ] Firefox fixes eight security flaws - Overclock.net - Overclocking.net

[TcMag] Mozilla Firefox comes up as most vulnerable application - Overclock.net - Overclocking.net





FireFox has 21% of the market share, but 50% of the security exploit share. It will get exponentially worse as the market share for FF increases.
Out of all of the security flaws there, all of them were related to Javascript in some way. Which, if you're running noscript/adblock (As stated several times by myself, and every other person here defending FF) is a moot point. I honestly don't know why they don't release FF with noscript/adblock, it would make the browser so much more secure.

Also, I'll be petty here: At least Firefox is up to web standards.
http://en.wikipedia.org/wiki/Compari...rs#Acid_Scores
(Stupid wiki, I can't find the web browser standards comparison. I know it's there somewhere.)

Tarun

Tarun

Technician's Corner Moderator

Join Date: Jan 2006

The TARDIS

http://www.lunarsoft.net/ http://forums.lunarsoft.net/

Never cared for NoScript. And with what they did with Adblock Plus, I'll never trust, use, or recommend them to anyone.

Why are people freaking out about vulnerabilities anyways? Nothing is secure or 100%. Firefox 3.5.1 is already in build 1 of the release candidate stage, posted earlier this morning.

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

It will be interesting when Windows 7 comes along and people have to actually choose which browser to use.

Fril Estelin

Fril Estelin

So Serious...

Join Date: Jan 2007

London

Nerfs Are [WHAK]

E/

Quote:
Originally Posted by Snograt View Post
It will be interesting when Windows 7 comes along and people have to actually choose which browser to use.
Most people won't choose: they'll use the one(s) they were using before, market shares haven't moved significantly in a while.

As Tarun said, FF is completely safe as it's a push-update, people will see the update window as soon as the patch is ready, which should be soon.

Snow Bunny

Snow Bunny

Alcoholic From Yale

Join Date: Jul 2007

Strong Foreign Policy [sFp]

If chrome looked like Firefox, I'd use chrome.

SORRY GUYS ILL STILL USE FIREFOX3.

Also safari is a mac product which means hipster which means sucka deez nutz.

Rhododendron

Rhododendron

Frost Gate Guardian

Join Date: Jun 2009

Rt/

That's not nice Kuntz, as one of the "average people", i would have loved to see the links you posted as a well documented person, but they are broken.

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

Quote:
Originally Posted by Rhododendron View Post
That's not nice Kuntz, as one of the "average people", i would have loved to see the links you posted as a well documented person, but they are broken.
All links provided work, your work/school is blocking you if they do not, or you have a bunk internet connection.

dusanyu

Lion's Arch Merchant

Join Date: Nov 2007

Illusion of skillz [Iz]

W/E

Lets look at Three Browsers ad audited by Secunia PSI on my personal Machine

Bare in Mind PSI gives my Machine a Security Score of 100

Microsoft Internet Explorer 8.x (Assessment: Minimum 5 attack vectors exists when using this browser, see criticality rating below)

Mozilla Firefox 3.0.x (Assessment: Minimum 4 attack vectors exists when using this browser, see criticality rating below)

Opera 9.x (Assessment: Minimum 4 attack vectors exists when using this browser, see criticality rating below)

By the way Opera has been Cleener than the other two Brousers for months now

you want security use opera

but see for yourself
http://secunia.com/advisories/product/10615/

same auditors for Firefox
http://secunia.com/advisories/product/25800/

and IE 8
http://secunia.com/advisories/product/21625/

Tarun

Tarun

Technician's Corner Moderator

Join Date: Jan 2006

The TARDIS

http://www.lunarsoft.net/ http://forums.lunarsoft.net/

3.5.1 is already out, so this topic is pretty moot.

careyt

careyt

Lion's Arch Merchant

Join Date: Mar 2007

Order of the Immortal [Vamp]

Rt/

I use FireFox because it runs faster, loads faster, and parses HTML faster than IE on my computer. I also appreciate the fact that FireFox is Web Standards compliant unlike IE which has never been and doesn't ever plan to be. I'm a web designer and things like Web Standards in coding and scripting appeal to me, which is why IE will NEVER be an option for me as IE and Microsoft intend to kill any sort of standardization within HTML/Javascript.

Use IE if you don't mind a slow browser that doesn't support any sort of standard of programming other than it's own, and I'll stick to a well rounded, faster and standards compliant browser called FireFox.

ps, I know it said it "could" apply to older versions but I still use 3.0.11 as 3.5 has many bugs and problems that really annoy me.

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

IE has 80% (?) market share, it is the web/html standard, not Firefox, not Chrome, not WC3. A "standard" is what most people use, not some happy-go-lucky list of rules you conveniently make so your competition's browse isn't "compatible". Besides, I've been using IE since Windows 3.1 and I am still looking for just ONE page that doesn't display in IE. How many years of web browsing is that? And I still have yet to find ONE page that doesn't load for me. Jeez the way you FF fanboys spread lies, you'd think half the internet wouldn't load on IE.

Firefox does not load faster, run faster, or parse faster than IE. People design benchmarks to make IE lose, that's how badly they want FF or Chrome to look good. Show me a high speed camera test using non-cached pages that are loaded over the actual internet. AFAIK only Microsoft ever did such a test, and guess what it showed?! Yup, it showed the load times were so close together they had to measure them in milliseconds. Too bad no human can see that difference, it's just too tiny.

Riot Narita

Desert Nomad

Join Date: Apr 2007

Quote:
Originally Posted by Kuntz View Post
Firefox does not load faster, run faster, or parse faster than IE.
I find pages DO load faster in Firefox. But not plain vanilla Firefox - I use the adblock, flashblock, and noscript add-ons, and I think those are the reason: In other words, pages load faster because I'm not downloading or displaying all of the content in them. This is not a like-for-like comparison, and you're probably right that IE is generally just as fast as Firefox, if I actually loaded the full pages.

I did find that IE was faster on first startup... but that difference is now tiny, since I switched to a solid state drive. The thing is, I prefer Firefox, and I'll keep using it - until equivelents to adblock, noscript and flashblock are available for IE. Then I'll re-evaluate... I'm not blindly loyal to any browser - over the years, I've jumped ships several times, as various browsers have developed.

upier

upier

Grotto Attendant

Join Date: Mar 2006

Done.

[JUNK]

https://addons.mozilla.org/en-US/firefox/addon/6366

As long as can draw penises in the privacy of my FF and NOT just on GW's maps - FF it is!

Mesmer in Need

Mesmer in Need

Forge Runner

Join Date: Mar 2006

[ToA]

Quote:
Originally Posted by Kuntz View Post
IE has 80% (?) market share, it is the web/html standard, not Firefox, not Chrome, not WC3. A "standard" is what most people use, not some happy-go-lucky list of rules you conveniently make so your competition's browse isn't "compatible".
Just because more people use it doesn't mean it's better.

Quote:
Jeez the way you FF fanboys spread lies, you'd think half the internet wouldn't load on IE.
Set crashie.com as your homepage and none of it will load

Snograt

Snograt

rattus rattus

Join Date: Jan 2006

London, UK GMT??0 ??1hr DST

[GURU]GW [wiki]GW2

R/

Tut, crashie hasn't worked since IE7.

My point about Win7 and choosing browsers is that Windows has always come with IE so the vast majority of people haven't needed or bothered to get an alternative browser.

Windows 7 is coming without IE, which will make people consider the alternatives at the very least.

Quaker

Quaker

Hell's Protector

Join Date: Aug 2005

Canada

Brothers Disgruntled

Quote:
IE has 80% (?) market share, it is the web/html standard, not Firefox, not Chrome, not WC3. A "standard" is what most people use, not some happy-go-lucky list of rules you conveniently make so your competition's browse isn't "compatible".
A "standard" is NOT simply what "most people use". In the case of most technical standards - a standard would be a set of specifications which should be used, for among other things, to ensure compatibility.
For example, there is a "standard" design for the power outlets in your home. This is not a "standard" because everyone uses it - every one uses it because it is the standard.

In the case of web/html coding, there is "standard" laid out by some committee (forget which, atm), which is intended to be open to all to use and to enable all browser to display web pages properly. It is Microsoft who has continually deviated from this standard with some happy-go-lucky list of rules they conveniently make so their competition's browser, isn't "compatible".

Btw - All the links you posted are for Overclock.net. Are there other sites that support these findings? Who owns Overclock.net - MS?

Killamus

Guest

Join Date: Oct 2008

Quote:
Originally Posted by Snograt View Post
Windows 7 is coming without IE, which will make people consider the alternatives at the very least.
What browser is it packaged with then? If it doesn't have one, that will be very problematic at best. Also, it won't really cause people to consider alternatives, they'll just download IE and say "Screw it."

Also, just because I.E. has 65% of the market share doesn't make IT the standard, nor do people "Design" tests to make I.E. fail. Because it doesn't properly support CSS, XHTML, etc, who's standards are made by the people who DESIGNED the languages, it fails.

That's the equivalent of Microsoft saying
"Hey Steve, I don't like the way that C++ handles integers. This is the way I want it to handle integers."
"Hey Otherdude, you're right! Screw all coding conventions, code it your way, and because it'll be on 75% of all computers, they'll have to change the way that C++ handles integers just because of us! WE ROX!"

Yea, that's the way it works.

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

Quote:
Originally Posted by Hissy View Post
I find pages DO load faster in Firefox. But not plain vanilla Firefox - I use the adblock, flashblock, and noscript add-ons, and I think those are the reason: In other words, pages load faster because I'm not downloading or displaying all of the content in them. This is not a like-for-like comparison, and you're probably right that IE is generally just as fast as Firefox, if I actually loaded the full pages.

I did find that IE was faster on first startup... but that difference is now tiny, since I switched to a solid state drive. The thing is, I prefer Firefox, and I'll keep using it - until equivelents to adblock, noscript and flashblock are available for IE. Then I'll re-evaluate... I'm not blindly loyal to any browser - over the years, I've jumped ships several times, as various browsers have developed.
www.ie7pro.com

Works for IE8 too, though they are still fixing a few bugs in it. You can block scripting/flash/ads within IE7/8 without any plugins needed.

Tools -> Options -> Security Tab

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

Quote:
Originally Posted by Mesmer in Need View Post
Just because more people use it doesn't mean it's better.


Set crashie.com as your homepage and none of it will load
Nope:

http://img41.imageshack.us/img41/5361/oopst.png

Page loads fine.

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

Quote:
Originally Posted by Quaker View Post
A "standard" is NOT simply what "most people use". In the case of most technical standards - a standard would be a set of specifications which should be used, for among other things, to ensure compatibility.
For example, there is a "standard" design for the power outlets in your home. This is not a "standard" because everyone uses it - every one uses it because it is the standard.

In the case of web/html coding, there is "standard" laid out by some committee (forget which, atm), which is intended to be open to all to use and to enable all browser to display web pages properly. It is Microsoft who has continually deviated from this standard with some happy-go-lucky list of rules they conveniently make so their competition's browser, isn't "compatible".

Btw - All the links you posted are for Overclock.net. Are there other sites that support these findings? Who owns Overclock.net - MS?
But for the most part, IE and Netscape existed "first" and were the two most popular browsers by far back in the day. Aside from a few differences between them, they were the same. IE/MS supported some extra features to take advantage of extra features within Windows OS, but that was about it. Along came some more browsers and instead of adhering to the "standards" of IE, they chose to invent their own "standards" and complained when MS/IE didn't follow along with it. There will probably never be a web standard, because Microsoft has no reason to follow along with what other people do with their 80% market share, and everyone else doesn't want to go along with Microsoft's standard because they hate to admit it's correct. People would rather use/support broken software than admit Microsoft is right or best or whatever. If people truly wanted 1 web standard, then they'd go to Microsoft and ask them what they wanted and go along with it. Why should the 80% majority have to change for the 20% minority? It makes no sense.

Overclock.net just has links to the actual articles. The articles themselves are on various other websites. You can read quick quotes/overviews on OCN and/or then follow the links to read the full article if you feel the need.

Killamus

Guest

Join Date: Oct 2008

Quote:
Originally Posted by Kuntz View Post
But for the most part, IE and Netscape existed "first" and were the two most popular browsers by far back in the day. Aside from a few differences between them, they were the same. IE/MS supported some extra features to take advantage of extra features within Windows OS, but that was about it. Along came some more browsers and instead of adhering to the "standards" of IE, they chose to invent their own "standards" and complained when MS/IE didn't follow along with it. There will probably never be a web standard, because Microsoft has no reason to follow along with what other people do with their 80% market share, and everyone else doesn't want to go along with Microsoft's standard because they hate to admit it's correct. People would rather use/support broken software than admit Microsoft is right or best or whatever. If people truly wanted 1 web standard, then they'd go to Microsoft and ask them what they wanted and go along with it. Why should the 80% majority have to change for the 20% minority? It makes no sense.
Did you ignore my post or just not read it? I stated EXACTLY why this is BACKWARDS thinking.
Just because something is first, doesn't make it right.
Just because everyone does something, doesn't make it right. In the age old cleshe:
"If everyone else jumped off a cliff, would you do it too?"

Nerel

Nerel

Jungle Guide

Join Date: Jun 2008

Australia, what you want my home address?

[CAT]

Mo/

Quote:
Originally Posted by Kuntz View Post
IE has 80% (?) market share, it is the web/html standard, not Firefox, not Chrome, not WC3. A "standard" is what most people use, not some happy-go-lucky list of rules you conveniently make so your competition's browse isn't "compatible".
You clearly fail to understand what 'standards' are, and that international bodies are created for the sole purpose of creating and advancing 'standards' to ensure compatibility. IE is NOT the standard for HTML, IE has a long history of using non-standardized markup. THE HTML standard IS defined by the W3C.

It isn't a convenient list thrown together by Mozilla enthusiasts...

Misinformation is no way to evangelize your particular choice of software.

And, no... Mosaic was the web browser of choice 'back in the day', it is credited with popularizing the WWW. IE and Netscape were late comers to that field.

Nerel

Nerel

Jungle Guide

Join Date: Jun 2008

Australia, what you want my home address?

[CAT]

Mo/

Quote:
Originally Posted by Kuntz View Post
Along came some more browsers and instead of adhering to the "standards" of IE, they chose to invent their own "standards" and complained when MS/IE didn't follow along with it. There will probably never be a web standard, because Microsoft has no reason to follow along with what other people do with their 80% market share, and everyone else doesn't want to go along with Microsoft's standard because they hate to admit it's correct. People would rather use/support broken software than admit Microsoft is right or best or whatever.
Microsoft is a part of the W3C, they've (almost) always had a say in defining what the current standards are. Microsoft WASN'T the standard, people didn't AND shouldn't have followed IE as a standard, simply put the earliest standards PREDATE any effort by Microsoft to create a web browser...

There will probably never be a web standard? There are lots of them, for the various protocols and mark up languages... I think you're misusing the word 'standard' to make it mean 'follow Microsoft'.

Edit: I'm amazed that you're so blithely rewriting HISTORY. Internet Explorer 1995. Mosaic 92/93...

Lord Aro

Lord Aro

Frost Gate Guardian

Join Date: Jun 2006

/wiki user:aro

DBU

E/

Wonder how many browsers would run if one "flipped the switch" to turn off running code from 'memory allocated' addresses. How many exploits are partly based on the OS running the browser.

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

Quote:
Originally Posted by Nerel View Post
You clearly fail to understand what 'standards' are, and that international bodies are created for the sole purpose of creating and advancing 'standards' to ensure compatibility. IE is NOT the standard for HTML, IE has a long history of using non-standardized markup. THE HTML standard IS defined by the W3C.

It isn't a convenient list thrown together by Mozilla enthusiasts...

Misinformation is no way to evangelize your particular choice of software.

And, no... Mosaic was the web browser of choice 'back in the day', it is credited with popularizing the WWW. IE and Netscape were late comers to that field.
I'm pretty sure I know what a standard is. I am pointing out that you can't just invent rules and then complain when nobody follows them. This is the WC3 "standard". I've been programming web pages since 1995ish, give or take a year. Never had an issue with web development, but maybe that's because instead of fighting for the 20% minority I always developed for the 80% majority.

I vaguely remember what browser I used back then, if it wasn't Netscape then it would have been Mosaic (on the old Macs). It's not like I wrote that tid-bit of info on a pad of paper so I would remember it 14 years later...

Killamus

Guest

Join Date: Oct 2008

Quote:
Originally Posted by Kuntz View Post
I'm pretty sure I know what a standard is.
By dictionary.com:
Quote:
something considered by an authority or by general consent as a basis of comparison; an approved model.
Let's assume authority: Microsoft isn't the athority, W3 is. As given by every company, INCLUDING Microsoft.
Let's assume general consent: Microsoft is ONE entity. Now, general consent is majority, and I'm pretty sure that W3, Mozilla, and the creators of Opera, would also count. 3 > 1, so they have general consent. This isn't including every other browser that preforms to those standards.

Quote:
I am pointing out that you can't just invent rules and then complain when nobody follows them.
Except that's EXACTLY what Microsoft did, and not just with web standards. Copyright laws anyone?

Brett Kuntz

Brett Kuntz

Core Guru

Join Date: Feb 2005

It's not what MS did. Microsoft invented the "rules" for it's browser, sure, but they don't care if you follow or them or not lol. They have so much market share they can do whatever they want to, and you can either fight it and lose, or just go along with it.