Posted on 02/19/2010 10:40:03 AM PST by ShadowAce
A Russian security researcher on Thursday said he has released attack code that exploits a critical vulnerability in the latest version of Mozilla's Firefox browser.
The exploit - which allows attackers to remotely execute malicious code on end user PCs - triggers a heap corruption vulnerability in the popular open-source browser, said Evgeny Legerov, founder of Moscow-based Intevydis. He recently added it as a module to Vulndisco, an add-on to the Immunity Canvas automated exploitation system sold to security professionals.
"We've played a lot with it in our labs - it was very reliable," Legerov wrote in an email to The Reg. "Works against the default install of Firefox 3.6. We've tested it on XP and Vista."
The report comes as Mozilla pushed out a Firefox update that tackles three critical vulnerabilities in version 3.5.7. One of those bugs is also described as a heap corruption vulnerability, but Legerov said the flaw is different from the one his code exploits.
Mozilla issued a statement that read in part: "Mozilla takes all security vulnerabilities seriously, and have as yet been unable to confirm the claim of an exploit. We value the contributions of all security researchers and encourage them to work within our security process, responsibly disclosing vulnerabilities to ensure the highest level of security and best outcome for users."
Legerov said his firm does not provide advanced notification to software makers under an arrangement often referred to as responsible disclosure.
If Legerov's claim pans out, it would be one of the few times in recent memory that a zero-day vulnerability for Firefox has circulated in the wild. While the exploit is currently available only to those who pay a hefty licensing fee, wider circulation can't be far behind. This story will be updated as more is learned.
More about the bug is here and here. ®
Absolutely, something major was enhanced. I immediately noticed a speed improvement. Thanks for the link.
Got it.
OK, thanks. The article reads like he is selling something illegal or illegally, and I appreciate the clarification.
My question would be, does it work on real operating systems?
Linux and OSX come to mind.
I tried Linux and gave it a fair chance. For the serious user Linux is more trouble than it’s worth. You need to have a lot of tinker time set aside.
Yes, altho I just assumed anyone in the know would know and people like me....well, we are just dumb!
Interesting viewpoint. When did you try it? I find it to be more useful than Windows in my work.
I recently gave it a whirl in the last 2 months on one of my machines. Ubuntu and Mint didn’t do it for me. The biggest negative is that the hard drive can’t be imaged and reinstalled with both OS side by side.(unless I’m missing something) I found that if you don’t put them side by side all your windows drivers that are already there can’t be converted into Linux easily. So far anyway.
That was last year...try Mint.
What is the requirement to convert the Windows drivers?
Mint is much more of a user friendly critter compared to Ubuntu, but still has it’s challenges.
Lots of intestinal fortitude and lots of patience. lol
Linux will convert drivers to a certain extent. BUT if it doesn’t you will need to learn a whole new language used in Linux. I’m taking it on as a challenge and with some free time I will plug along.
You can control both from one terminal and keyboard with a KVM switch....
There might still be occasions where you would need to browse with the Windows machine...but over time perhaps those occasions could be reduced.
Dual booting is a pain.
That is my next move. I will format my drive into separate partitions and see how that works for me.
That’s a lot of work...
Yes it is, but my main concern is to be able to image my drives for quick fixes rather than complete re-installs should something go haywire. Better to re-image my drive after a mishap rather than spend days getting things back to the way I had them.
Thanks for the link. “Linux for Dummies” LOL
I will go over it this weekend.
Only if Firefox is set to download updates automatically. That option can be turned off. Please don't give advice like that unless you know how the person's computer is set up.
brytlea -- in Firefox, go to Help -> Check for Updates, and see what it tells you. If it says no new updates are available, you're up-to-date. Otherwise, you might need to download an update.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.