Recommended Posts

  Quote
washingtonpost.com weblog Security Fix is reporting that an exploit for a Mozilla security bug has been released. The PwnZilla 5 code takes advantage of the international domain name (IDN) link buffer overflow flaw, details of which were published earlier this month. The weblog post says that the exploit code "could let attackers take complete control over computers cruising the Web with unpatched versions of the Firefox Internet browser". Previous public exploits for the vulnerability have been basic proof-of-concepts that simply crash the browser.

The exploit, created by Berend-Jan "SkyLined" Wever, can be used against vulnerable versions of Mozilla Firefox, the Mozilla Application Suite and Netscape Browser 8. The latest Firefox 1.0.7 and Mozilla 1.7.12 releases, which have been made available over the past few days, are not affected as they both include a fix for the flaw. However, there is no fix available for Netscape Browser 8 (currently on version 8.0.3.3), though the exploit apparently works less reliably with this browser.

Security Fix author Brian Krebs says that "the code is designed to be embedded in a Web site so that anyone computer (sic) visiting the evil site with Firefox or Netscape would open up a line of communication with another Internet address of the attacker's choice, effectively letting the bad guys control the victim computer from afar." He cites the French Security Incident Response Team (FrSIRT) as the source for this analysis but FrSIRT's copy of the PwnZilla 5 code does not appear to include this information.

Exploit author SkyLined credits several people with assisting him in the creation of PwnZilla 5. In his description of the code, he says, "Since Netscape has not replied to reports about this vulnerability I've chosen to release it." However, he goes on to qualify this by stating that the exploit is optimised for Firefox (which has a fixed version available) and rarely works with Netscape (which does not).

Any Firefox 1.0.x and Mozilla 1.x users who have not upgraded to versions 1.0.7 and 1.7.12 respectively are advised to do so immediately (see our article on the release of Firefox 1.0.7 and our article on the release of Mozilla 1.7.12 for more details). It should be noted that Firefox 1.5 Beta 1 is vulnerable to the flaw, so users should either revert to an end-user release of Firefox (that is, 1.0.7) or update to a more recent Firefox nightly build from the 1.8 branch. SeaMonkey 1.0 Alpha is not affected by the vulnerability (but the Linux version is at risk from the Linux command line URL parsing security bug).

Last week, CNET News.com warned that hackers were probably working on exploits for the IDN flaw. The vulnerability was originally reported to the Mozilla Foundation by Tom Ferris, who elected to make it public before fixed versions of Firefox and the Mozilla Application Suite were released. SecurityProNews reporter John Stith interviewed Tom Ferris about the IDN vulnerability last week, providing more insight into why Ferris chose to publish details of the flaw. Stith's article states: "He [Ferris] also commented that when he initially submitted all his information to Mozilla, they seemed at odds and he felt put out by them... Microsoft has always 'treated him more like a professional.' He said he felt the folks over at Mozilla treated him more like a kid."

http://www.mozillazine.org/

Question, paging supernova_00, I remember reading of a second discovered flaw too affecting 1.5 B1 and not 1.0.6 that was exploitable even with IDN disabled, is 1.5 B1 still safe to use with IDN disabled or do you reccomend an update to a newer nightly branch ?

Had to search for a bit but I knew I saw it somewhere. Second vulnerability discovered affecting only 1.5 Beta 1 and not 1.0.6, even with IDN disabled.

  Quote
Another Firefox flaw?

Even with the fix that disables IDN installed, a buffer overflow vulnerability exists in Firefox 1.5 beta 1, Ferris wrote on his Security Protocols Web site. The problem is a variant of the original IDN bug, he wrote.

http://news.com.com/New+Firefox%2C+Mozilla..._3-5865882.html

  Quote
Versions Affected:

Firefox 1.5 Beta 1 (Deer Park Alpha 2) build 1.8b4 with IDN disabled.

Overview:

A buffer overflow vulnerability exists within Firefox 1.5 Beta 1 with IDN

disabled allows for an attacker to remotely execute arbitrary code on a

affected host.  Firefox 1.0.6 and all prior versions are not affected by this

particular variant of the 'Host:' issue.

http://www.security-protocols.com/modules....rticle&sid=2920

Thanks. I have the latest branch build (Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8b5) Gecko/20050923 Firefox/1.4 ID:2005092307) and it still crashes it. So updating to a branch (nightly of 1.5) wouldn't help any, so far. I would stick to trusted sites till they get this fixed or maybe use the public version 1.0.7. This one doesn't affect the 1.0.7 version ,which is what most should use.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • I have the Pixel 9 Pro XL...Unless this thing is "leaps and bounds" faster than the 9, I'll pass. And by leaps and bounds, I don't mean on benchmarks. "Real world" faster. Most people don't even come close to topping out the performance of their phones. Tensor G5 is Google's most powerful chip to date, boasting a staggering 36 percent performance leap over G4.
    • MIT's stunning 'bubble wrap' device squeezes water out from thin air even in deserts by Sayan Sen Image by Matteo Roman via Pexels Massachusetts Institute of Technology (MIT) engineers have built a new kind of device that can pull clean drinking water straight out of the air—no electricity needed. It’s designed for areas where water is scarce and traditional sources like rivers or lakes aren’t reliable. Right now, more than 2.2 billion people globally don’t have access to safe drinking water. In the United States alone, 46 million face water insecurity, with either no running water or water that’s not safe to drink. This new device, called an Atmospheric Water Harvesting Window (AWHW), uses a unique hydrogel panel that looks like black bubble wrap. These dome-shaped bubbles soak up water vapor from the air, especially at night when humidity is higher. During the day, sunlight makes the vapor inside evaporate. That vapor then condenses on a glass surface and drips down through a tube, turning into drinkable water. The AWHW doesn’t rely on power sources like batteries or solar panels. It’s completely passive, meaning it works on its own. The team tested a meter-sized panel in Death Valley, California, one of the driest places in North America, and got between 57.0 and 161.5 milliliters of water per day even with humidity as low as 21 percent. That’s more than what other similar passive devices have managed. “We have built a meter-scale device that we hope to deploy in resource-limited regions, where even a solar cell is not very accessible,” said Xuanhe Zhao, a professor at MIT. “It’s a test of feasibility in scaling up this water harvesting technology. Now people can build it even larger, or make it into parallel panels, to supply drinking water to people and achieve real impact.” Another cool part of the design is how they kept the water safe to drink. Usually, these kinds of hydrogels use salts like lithium chloride to absorb more vapor but that can lead to salt leaking into the water, which isn’t ideal. To solve this, MIT’s team mixed in glycerol, a compound that helps keep salt locked inside the gel. In testing, the lithium ion concentration in the harvested water stayed below 0.06 ppm (parts per million), which is way below the safe limit. The hydrogel domes also give the material more surface area, letting it collect more vapor. The outer glass panel is coated with a special polymer film that helps cool the glass, making it easier for vapor to condense. “This is just a proof-of-concept design, and there are a lot of things we can optimize,” said lead author Chang Liu, now a professor at the National University of Singapore. “For instance, we could have a multipanel design. And we’re working on a next generation of the material to further improve its intrinsic properties.” Published in Nature Water, the study says the AWHW could last at least a year and shows promise for making safe, sustainable water in places with harsh climates. The researchers believe an array of vertical panels could one day supply water to individual households, especially in remote or off-grid locations. Source: MIT News, Nature This article was generated with some help from AI and reviewed by an editor. Under Section 107 of the Copyright Act 1976, this material is used for the purpose of news reporting. Fair use is a use permitted by copyright statute that might otherwise be infringing.
    • Clear Linux is open source, indeed, so its source code is available for anyone. They're just shutting down its support from them, they're not forbidding anyone else from taking over.
    • Linux Mint is also my favorite distro, but I fear what will happen with it if Clem were to disappear tomorrow, to be honest.
    • Yeah, I totally get your point, which is possible it could happen. I just hope there is a few people around him who are similar to where if they took over things would run pretty much the same. if not, then yeah, it could start to decline rapidly etc. but I figure something that's been around for a longer period of time with a decent backing, and probably more users than most Linux distro's (which I would 'imagine' Mint is one of the more used Linux desktop distro's by volume of people who use it), is less likely to just disappear. but like you said, nothing is guaranteed. but I do think you are probably right in that Clem is probably the core of what keeps Mint, Mint. I like how it tends to stay pretty much the same with some slight tweaks here and there (but is largely the same) instead of that crap some people go for with change for the sake of change trying to create a overly fancy interface and other unnecessary stuff etc. I also feel Mint keeps a nice balance of things out-of-the-box where it's not too bloated, nor too striped down. p.s. but I see Mint as a better Ubuntu basically. but I get your point like if it was more of a really serious choice of needing a 'safe bet' to use long term, then yeah something like official Ubuntu would be one of the better choices for sure given what you said with it being backed by an actual company which makes it a safer bet than Mint which is smaller and 'could' potentially be more fragile.
  • Recent Achievements

    • First Post
      leoniDAM earned a badge
      First Post
    • Reacting Well
      Ian_ earned a badge
      Reacting Well
    • One Month Later
      Ian_ earned a badge
      One Month Later
    • Dedicated
      MacDaddyAz earned a badge
      Dedicated
    • Explorer
      cekicen went up a rank
      Explorer
  • Popular Contributors

    1. 1
      +primortal
      505
    2. 2
      ATLien_0
      209
    3. 3
      Michael Scrip
      202
    4. 4
      Xenon
      144
    5. 5
      +FloatingFatMan
      121
  • Tell a friend

    Love Neowin? Tell a friend!