Windows IT Pro is the authoritative and independent resource for windows nt, windows 2000, windows 2003, windows xp. Features a collection of resources and magazines for windows IT professionals.
  
  
  Advanced Search 


September 14, 2005

Critical Bug in Firefox, Mozilla, and Netscape Browser

A Web Exclusive from WinInfo
Mark Joseph Edwards
WinInfo
InstantDoc #47731
WinInfo
Email this Article
Printer Friendly
Reader Comments
Digg This
Del.icio.us
RSS
Subscribe to Windows IT Pro | See More Security Articles Here | Reprints | Or get the Monthly Online Pass—only $5.95 a month!
Last week Tom Ferris reported a buffer overflow vulnerability in Firefox Web browsers. The vulnerability exists due to faulty processing of URLs and could lead to the execution of remote code. Netscape and Mozilla browsers are also affected by the problem because they share the same code base as Firefox. The vulnerability has a wide-ranging effects on the Internet community as a whole since millions of people rely on Firefox, Mozilla, and Netscape as their browsers of choice.

Inexplicably, Ferris posted a simple demonstration of the vulnerablity on his Web site three days after notifying Mozilla Foundation. While the demonstration only crashed the browser and did not show how to launch a remote code execution attack, the Mozilla Foundation had not a had chance to formally respond to the problem by releasing a patch.

Ferris had previously reported a problem in a Microsoft product and gave no details to the public until a patch was available. Ferris gave no explanation for his differing methods of disclosure. The posting of demonstration code for the Firefox problem led to the development of an exploit by another researcher, Berend-Jan Wever, who has not released his working example to the public. Wever said it took him only three and a half hours to figure out how to exploit the problem based on Ferris' original disclosure.

The problem has been reported to affect Firefox 1.0.6, Firefox 1.5 beta, Netscape 8.0.3.3, and Mozilla 1.7.11. Previous versions of these browsers may also be affected. A simple workaround prevents the browsers from being exploited. Mozilla Foundation released a self-installing patch (XPI file) that contains a workaround that disables International Domain Name (IDN) processing. The workaround changes a configuration parameter, network.enableIDN, to false. People who do not want to install the patch can perform the same action contained in the XPI file by entering about:config into the address bar and then searching for the parameter, which should be reset to false. At least one person reported that the same workaround and XPI file can be applied to Netscape browser.

End of Article

Reader Comments

You must log on before posting a comment.

If you don't have a username & password, please register now.




Top Viewed ArticlesView all articles
WinInfo Short Takes: Week of November 24, 2008

An often irreverent look at some of the week's other news, including a Vista Capable dismissal request, Zune price reductions, Morrow musings, Novell and Microsoft sitting in a tree ... two years later, Yahoo!, IE 6 on Windows Mobile, and so much more ...

Command Prompt Tricks

One reader shares his tip for setting up the command prompt to reflect a remote path. ...

Next Version of Exchange Named Exchange 2010?

Microsoft apparently inadvertently announced the official name of the next version of Exchange Server. ...
Security Whitepapers The Impact of Messaging and Web Threats

Why SaaS is the Right Solution for Log Management

Protecting (You and) Your Data with Exchange Server 2007
Related Events Top 10 Email Security Challenges and Solutions

Introduction to Identity Lifecycle Manager "2"

SQL Server Security: How to Secure, Monitor & Audit Your Databases

Check out our list of Free Email Newsletters!
Security eBooks Spam Fighting and Email Security for the 21st Century

Understanding and Leveraging Code Signing Technologies

A Guide to Windows Certification and Public Keys
Related Security Resources Become a VIP member of the Windows IT Pro community!
Get it all with the VIP CD and VIP access. A $500+ value for only $279!

Subscribe to Windows IT Pro!
Solve your toughest technical problems with our experts and access 10,000 + articles online. 30% off

Monthly Online Pass - Only $5.95!
Get instant access to 10,000+ articles from Windows IT Pro Magazine!

TechNet Virtual Labs
Evaluate and test Microsoft's newest products.



ADS BY GOOGLE

Job Openings in IT SPONSORED LINKS FEATURED LINKS
Is Your Approach to VMware Server Recovery Outdated?
Is your data protected from server failure? Download this white paper to find the best way to back up, recover, and restore your VMware ESX Server 3.x.

Maximize speed, performance and reliablity of your PCs and servers—automatically!
Speed Up Your PC! Try Diskeeper 2008 with InvisiTasking Free Now!

GoGrid Offers FREE Trial for Windows Cloud Servers
Deploy Windows Server 2003 and 2008 with free load balancing through GoGrid’s award winning web-based GUI – all in less than 5 minutes

Order Your SQL Fundamentals CD Today!
Learn how to use SQL Server, understand Office integration techniques and dive into the essentials of SQL Express and Visual Basic with this free SQL Fundamentals CD.
You've Deployed SharePoint...Now What?
This one-day free online conference delivers the technical knowledge needed to kick MOSS up a notch. In one information-packed day, independent SharePoint experts will present practical, real-world information and provide take-away, ready-to-use solutions

Ease Your Scripting Pains with the Flexibility of PowerShell!
Paul Robichaux equips you with PowerShell basics in 3 introductory lessons, each followed by live Q&A—all on your own computer! Register today!

What Would You Do If You Ran Microsoft?
ITTV's 2008 inaugural video contest, "If I Ran Microsoft..." is your chance to tell it like it is. Be goofy or be serious, but don"t miss this chance to have fun, win prizes, and go viral in a major way.

Maximize Your SharePoint Investment
This web seminar discusses how true bi-directional replication of SharePoint content from one server to another enables branch offices to maintain access to current SharePoint content.

Rock Your Knowledge, and Compete with Friends and Colleagues!
Are you the Web Application Performance Guru in your office? It's time to have fun! Download now to access the crossword puzzle. Challenge yourself and complete this fun activity!
Windows IT Pro Home Register FAQ for Windows WinInfo News
Europe Edition About Us Contact Us/Customer Service Media Kit Affiliates / Licensing  
SQL Server Magazine Office & SharePoint Pro Windows Dev Pro IT Job Hound ITTV
IT Library Technology Resource Directory Connected Home Windows Excavator Windows SuperSite 
 
 Windows IT Pro is a Division of Penton Media Inc.
 Copyright © 2008 Penton Media, Inc., All rights reserved. Terms and Use | Privacy Statement | Reprints and Licensing