Mozilla claims Firefox 1.5 hole poses minor risk

The first security vulnerability in Firefox 1.5 identified Thursday is not as problematic as initially perceived, a Mozilla executive said.

The first Firefox 1.5 security vulnerability, made public Thursday, is not as critical as initially perceived, but a patch will be available to fix it early next year, a Mozilla executive said Thursday.

Mozilla plans to repair the hole in the latest version of its open-source browser when it releases its next regularly scheduled stability build of Firefox. That should happen in late January or early February, said Mike Schroepfer, vice president of engineering for Mozilla Firefox 1.5 was released Nov. 30.

"Based on the information we have, it's a low-severity issue, but we will address it anyway," he said in an interview Thursday.

Packet Storm Security on Wednesday released code that takes advantage of the vulnerability, which can cause a buffer overflow and put users at risk of a denial of service attack when running the browser, according to a posting Thursday by independent security consultant John Bambenek on the SANS Internet Storm Center Web site (http://isc.sans.org/diary.php?storyid=920).

According to the posting, the vulnerability is in the browser's history.dat file, which stores a user's history of Web sites visited. It can be exploited by crafting an abnormally long URL with perhaps a few million characters. If a user navigates to a site that exploits the hole, "it will crash the browser each time it is started after going to such a page," Bambenek wrote in the posting.

Security research company Secunia Thursday gave the bug a rating of "not critical" on its Web site (http://secunia.com/advisories/17934/).

Schroepfer said that a team of volunteers and Mozilla engineers never discovered a denial-of-service problem using the proof of concept code from Packetstorm. "We have no independent confirmation that it crashes, not for lack of trying," he said.

Schroepfer said that when engineers tried to recreate the problem, the browser worked sluggishly and took an exceptionally long time to load a Web page, but only after the browser was closed and then restarted after the first security breach. However, the browser will not crash. "Eventually, it will process and will start properly," he said.

Furthermore, Schroepfer said it would be extremely rare for someone to visit a site that exploits the hole during a typical Web-browsing session. "You'd have to browse to a malicious site, one that someone spent the time to create to cause people harm," he said. "Then you'd have to browse there, and the next time your browser would take longer to start."

Even if a user does encounter a malicious Web site that exploits the hole, clearing out the browser's history will remedy the problem, Schroepfer added.

Mozilla Corp., a spin-off of the open-source Mozilla Foundation, oversees the release of the Mozilla software products Firefox and Thunderbird, an e-mail client.

Firefox 1.5 runs on versions of Windows from Windows 98 to XP, as well as Mac OS X and various flavors of Linux. Since its initial release last year, Firefox has been downloaded more than 100 million times, according to Mozilla.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Elizabeth Montalbano

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?