Mozilla Denies Firefox 3.5 Bug Is Exploitable

The New Acunetix V12 Engine


Ah a bug in our beloved Firefox, after the latest 3.5 update (which sees some definite improvements).

The last one I recall was the Clickjacking Vulnerability, which also effected Chrome.

It seems like it’s not too serious of an issue and will only cause crashing, there’s no room for remote exploitation or code execution. So it may be an annoyance, but if it’s true – it’s not that serious.

Mozilla is denying that a bug that crashes Firefox 3.5 is a security vulnerability, countering earlier reports that the company’s latest browser contained a flaw even though it had just been patched.

In a Sunday post to Mozilla’s security blog, Mike Shaver, the company’s vice president of engineering, said that the bug, which had originally been disclosed on the milw0rm hacker site, is not a vulnerability. “The reports by press and various security agencies have incorrectly indicated that this is an exploitable bug,” Shaver said. “Our analysis indicates that it is not, and we have seen no example of exploitability.”

Exploit code hit milw0rm last Wednesday. Firefox developers immediately logged the bug into Bugzilla, Mozilla’s change- and bug-tracking database. The bug, continued Shaver, does crash Firefox 3.5 — and the recently-released 3.5.1 — in some situations. But there’s no way for an attacker to exploit that by injecting malicious code on the machine. The bug can crash Windows, Mac and Linux editions of Firefox, including Firefox when it’s being run on the still-unfinished Windows 7.

I guess they will fix it soon enough in the next release (3.5.2) which should come along fairly shortly. I’d have to say I believe the Mozilla developers if they say it’s not exploitable.

So it’s not too big of an issue to worry about, just wait for the next patch roll out and you should be saved from any random crashes caused by malicious sites.

Both Shaver in his blog post and developers on Bugzilla noted that the Firefox crash on Macs was due to a flaw in Apple’s operating system, specifically the ATSUI system library. “We have reported this issue to Apple, but in the event that they do not provide a fix we will look to implement mitigations in Mozilla code,” Shaver said.

Mozilla developer Vladimir Vukicevic countered that it was unlikely Apple would fix the problem. “We’ve reported this and similar bugs in the past to Apple; they have so far had no interest in fixing such bugs in their font rendering subsystems, especially if they’re in ATSUI and not CoreText,” said Vukicevic on Bugzilla.

Another Mozilla hand suggested that the Mac OS X bug may affect other browsers as well. “Chances are more applications use the same buggy API (Safari? Chrome?),” Andreas Gal said. Gal, a project scientist at the University of California-Irvine, was a key contributor to the TraceMonkey JavaScript engine that Mozilla added to Firefox with Version 3.5.

Just last Thursday, Mozilla patched Firefox 3.5 for the first time, issuing a fix for a critical vulnerability in TraceMonkey’s just-in-time (JIT) compiler. In the run-up to creating a fix for that flaw, Mozilla developers speculated that the hacker had dug through Bugzilla to find information that helped him exploit the vulnerability.

I’ve said for quite a while that open source is a double edged sword, especially when resources such as Bugzilla are public and allow people with malicious intent to dig through the archives and look for bugs that could be exploitable.

With the code being open and the bugs being open too, it makes it much easier to develop exploits.

Thankfully it also leads to less bugs and them being fixed faster, I know which I prefer any day.

You can find the exploit on milw0rm here:

Firefox 3.5 unicode stack overflow

Source: Network World

Posted in: Exploits/Vulnerabilities, Hacking News

, , , ,


Latest Posts:


Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.
testssl.sh - Test SSL Security Including Ciphers, Protocols & Detect Flaws testssl.sh – Test SSL Security Including Ciphers, Protocols & Detect Flaws
testssl.sh is a free command line tool to test SSL security, it checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws and more.
Four Year Old libSSH Bug Leaves Servers Wide Open Four Year Old libssh Bug Leaves Servers Wide Open
A fairly serious 4-year old libssh bug has left servers vulnerable to remote compromise, fortunately, the attack surface isn't that big as neither OpenSSH or the GitHub implementation are affected.
CHIPSEC - Platform Security Assessment Framework CHIPSEC – Platform Security Assessment Framework For Firmware Hacking
CHIPSEC is a platform security assessment framework for PCs including hardware, system firmware (BIOS/UEFI), and platform components for firmware hacking.


One Response to Mozilla Denies Firefox 3.5 Bug Is Exploitable

  1. David July 21, 2009 at 7:26 pm #

    Hope they don’t get the bad return from denying an exploit…