Firefox security hole was "just a joke"

By em_te
in Back Page News

 Share

Recommended Posts

Veteran

em_te

Posted
Posted

http://developer.mozilla.org/devnews/index...ted-at-toorcon/

We got a chance to talk to Mischa Spiegelmock, the Toorcon speaker that reported the potential javascript security issue referenced earlier. He gave us more code to work with and also made this statement and agreed to let me post it here:
The main purpose of our talk was to be humorous.

As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has.

I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven?t used it to take over anyone else?s computer and execute arbitrary code.

I do not have 30 undisclosed Firefox vulnerabilities, nor did I ever make this claim. I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not.

I apologize to everyone involved, and I hope I have made everything as clear as possible.

Sincerely,

Mischa Spiegelmock

Even though Mischa hasn?t been able to achieve code execution, we still take this issue seriously. We will continue to investigate.

-Window Snyder

Grand Master

zeroday

Posted
Posted

The allegedly critical hole reported yesterday in Firefox's JavaScript implementation has turned out, not surprisingly, to be a hoax. Mischa Spiegelmock, who made the claim at the Toorcon hacker conference, told Mozilla's security chief Window Snyder, "The main purpose of our talk was to be humorous."

While it is possible to create a stack overflow, the only result he has been able to produce is a browser crash. Neither he, nor anyone else, has managed to execute code via this hole. Spiegelmock claims to know nothing about the other 30 holes reported in the media. The Mozilla team nevertheless plans to look into the matter in order to detect and remedy any flaws.

Source

Moz Dev Centre Entry:

We got a chance to talk to Mischa Spiegelmock, the Toorcon speaker that reported the potential javascript security issue referenced earlier. He gave us more code to work with and also made this statement and agreed to let me post it here:

The main purpose of our talk was to be humorous.

As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has.

I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven’t used it to take over anyone else’s computer and execute arbitrary code.

I do not have 30 undisclosed Firefox vulnerabilities, nor did I ever make this claim. I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not.

I apologize to everyone involved, and I hope I have made everything as clear as possible.

Sincerely,

Mischa Spiegelmock

Even though Mischa hasn’t been able to achieve code execution, we still take this issue seriously. We will continue to investigate.

-Window Snyder

Moz Dev Entry

Veteran

halcyoncmdr

Posted
Posted

As it said:

While it is possible to create a stack overflow, the only result he has been able to produce is a browser crash. Neither he, nor anyone else, has managed to execute code via this hole.

So while they can reproduce the crash is beside the point, no code is able to be executed through this hole, yet :shiftyninja:

Mentor

someware

Posted
Posted

hmmm, whether or not there was a hole I don't think it really matters

It's just quite funny the effect the media has, not even the media, the internet!, the spread of word by individuals posting the same content from one forum to another. The untruthful content ends up on hundreds of sites... millions of people read it and believe it to be gospel.

There are probably thousands of people walking around today thinking their Firefox is insecure lol! :)

Then again only geeks use firefox and tbh the sensible people out there will be running virus scanners and firewalls.

When I saw the announcement of the '30 exploits' I thought ah well, they'll prolly fix it soon enough who cares :)

Grand Master

Malisk

Posted
Posted

Three of my major news sources, Slashdot, Ars, and bit-tech had reported this flaw, and now its fake? lol

Yes.

I've seen it before, and I think this is a kind of new problem with the fast travelling unverified news getting mirrored on news sites, major or not. Don't go believe e.g Slashdot has much of a quality control in place.

Grand Master

The_Decryptor Veteran

Posted
  • Veteran
Posted

Yes.

I've seen it before, and I think this is a kind of new problem with the fast travelling unverified news getting mirrored on news sites, major or not. Don't go believe e.g Slashdot has much of a quality control in place.

They reported the combined statement by Mozilla and these guys, Mozilla said it knew of the flaw they were talking about (the DoS one), and the "report" included what the guys said.

I would rather them report on it, than just ignore it (even if it turns out to be a non-issue)

This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.

  • Posts

    • Mafia: The Old Country expansion Man of Honor announced, brings back Salieri from original

      By leonsk29 · Posted

      Most boring game ever. Repetitive, empty, predictable, and full of cliches. Total waste of time and money, IMO.
    • Mafia: The Old Country expansion Man of Honor announced, brings back Salieri from original

      By LoneWolfSL · Posted

      Mafia: The Old Country expansion Man of Honor announced, brings back Salieri from original by Pulasthi Ariyasinghe During Summer Game Fest, 2K and Hanger 13 brought out a new Mafia: The Old Country trailer, revealing the game's first expansion. Named Man of Honor, this is slated to add two new chapters to the Enzo storyline that the game follows. There is an iconic character returning to the series with this expansion, with players set to run into Ennio Salieri, the future Don of the Salieri crime family. Fans of the original Mafia, or its Definitive Edition remake, may remember that name as one of the biggest characters in the storyline. This expansion is set prior to his rise to being the kingpin in the City of Lost Heaven. "Set in Sicily during the winter of 1905, Enzo Favara has proven himself a reliable soldier of the Torrisi crime family in the months since his initiation," says the studio about the new chapters. "Now, the Don entrusts him and Cesare with a delicate assignment of assisting Ennio Salieri, a man of honor recently released from prison and intent on reclaiming what is his." Working at Salieri's side, players will be heading into fresh environments as they return to the role of Enzo as a high-ranking soldato. The studio also promises brand-new weapons, fresh vehicles, and charms to collect in this expansion. Moreover, the expansion will add new content to the updated Free Ride mode. Alongside new collectibles and locations, this will add more challenges to beat alongside Salieri, which are described as runs that will "test the skills of even the most elite mafiosi." The Mafia: The Old Country Man of Honor story expansion will release on August 14, 2026, across PC, Xbox Series X|S, and PlayStation 5. It will cost $10 for owners of the base game to jump into.
    • Nearly 70% of Steam users now run Windows 11

      By moog19 · Posted

      Try installing Logitech Options
    • Telltale returns with The Wolf Among Us, re-revealing the sequel and a new remaster

      By LoneWolfSL · Posted

      Telltale returns with The Wolf Among Us, re-revealing the sequel and a new remaster by Pulasthi Ariyasinghe Telltale Games, the studio known for its episodic games from the 2000s, had a surprise appearance at the Summer Game Fest showcase today. The studio has gone through a collapse, an acquisition, and a revival but has largely gone silent in recent years. Today's sudden announcement was for the popular The Wolf Among Us series, with news about the sequel and a remaster dropping. Set after the events of the 2013-released title, the sequel will bring back Biby Wolf for a new adventure in Fabletown. This town of fairy tale characters is becoming unstable, with Snow White not being able to keep order as before. "When a brutal series of crimes threatens to fracture the fragile balance holding Fabletown together, Bigby Wolf, sheriff of Fabletown, finds himself drawn into a dangerous conspiracy that reaches deep into the city’s criminal underworld," says the studio. "As suspicion spreads across the city and powerful forces work against him, Bigby must uncover the truth and decide what kind of sheriff - and what kind of wolf - he is willing to become." At the same time, Telltale also announced The Wolf Among Us Remastered, bringing back the classic with a fresh coat of paint. This will include all five episodes from the original game plus over an hour of extra content that will offer behind-the-scenes videos, cast interviews, image galleries, and deleted scenes. The remaster will also have updated visuals and improved UI elements and accessibility features, alongside upgrades to the animations, audio, and frame rates. Telltale has been working on this project for almost a decade now, but if the new release schedule holds, fans will be able to jump into The Wolf Among Us 2 sometime in 2027. As for The Wolf Among Us Remastered, this is slated to release during this holiday season.
    • Nearly 70% of Steam users now run Windows 11

      By Snake Doc · Posted

      I use a Linux laptop every day. I have tried to switch to Linux on my gaming PC which has a 5070 ti. It was not a great experience

  • Recent Achievements

    • Rookie
      moog19 went up a rank
      Rookie
    • Mentor
      grik went up a rank
      Mentor
    • Dedicated
      JKR earned a badge
      Dedicated
    • One Year In
      CHUNWEI earned a badge
      One Year In
    • Conversation Starter
      FBSPL earned a badge
      Conversation Starter

  • Popular Contributors

    1. 1
      +primortal
      488
    2. 2
      PsYcHoKiLLa
      270
    3. 3
      Skyfrog
      77
    4. 4
      Steven P.
      68
    5. 5
      FloatingFatMan
      63
    Show More

  • Tell a friend

    Love Neowin? Tell a friend!