- home
- reviews
- news
- downloads
- cnet tv
HOLIDAY HELP DESK: Broadcasting live at 1:00 p.m., PT
- log in
- join CNET
- welcome,
- my profile
- log out

Comments on: Unpatched Firefox flaw may expose users

The problem lies in the way the browser handles Web links that are overly long and contain dashes, a researcher says.

Add a Comment (Log in or register) (48 Comments)

Mozilla Firefox ''Host:'' Buffer Overflow DOESN'T WORK

by September 9, 2005 5:59 AM PDT

Well I just tested the proof of concept vulnerability on my rig and it did nothing. Didn't do anything unusual infact... Strange....

Like this Reply to this comment

It crashed my Firefox
by JorisEvers September 9, 2005 7:49 AM PDT: I am running Windows XP Pro and Firefox 1.0.6. Going to Ferris' proof of concept page crashes my browser and gives an error message:
http://www.security-protocols.com/firefox-death.html; Like this View reply Hide reply
Processing

Drat!
by Sboston September 9, 2005 8:17 AM PDT: I had to do it twice before it crashed FF. Mozilla will fix it soon I'm sure, but that just goes to prove what I've always said. There are no bug proof programs.; Like this

no crash. directed to google search page.
by September 9, 2005 10:17 AM PDT: i'm running firefox 1.0.6 on linux. i copy the proof of concept into this html file:

<html>
crash
</html>

when i click on the crash link, it directs me to the google "web" search page. the address bar is: "keyword:---------------------------------------------" and the google text field (where you enter your search terms) is: "---------------------------------------------". below that is: "The 'I'm Feeling LuckyTM' button automatically takes you to the first web page returned for your query.

An 'I'm Feeling Lucky' search means less time searching for web pages and more time looking at them."

no crashes. did i do something wrong in creating the html file?; Like this

Doesn't crash here
by SmokieUK September 9, 2005 1:00 PM PDT: I've loaded the page multiple times and nothing happens. Just a white page with "Done" in the Status Bar.; Like this

No joy here either
by September 9, 2005 3:15 PM PDT: I also just get google page with a lot of dashes in the search bar and no results, FireFox 1.06 on XP SP2 here as well.; Like this

Mozilla Firefox ''Host:'' Buffer Overflow DOESN'T WORK

by September 9, 2005 5:59 AM PDT

Well I just tested the proof of concept vulnerability on my rig and it did nothing. Didn't do anything unusual infact... Strange....

Like this Reply to this comment

It crashed my Firefox
by JorisEvers September 9, 2005 7:49 AM PDT: I am running Windows XP Pro and Firefox 1.0.6. Going to Ferris' proof of concept page crashes my browser and gives an error message:
http://www.security-protocols.com/firefox-death.html; Like this View reply Hide reply
Processing

Drat!
by Sboston September 9, 2005 8:17 AM PDT: I had to do it twice before it crashed FF. Mozilla will fix it soon I'm sure, but that just goes to prove what I've always said. There are no bug proof programs.; Like this

no crash. directed to google search page.
by September 9, 2005 10:17 AM PDT: i'm running firefox 1.0.6 on linux. i copy the proof of concept into this html file:

<html>
crash
</html>

when i click on the crash link, it directs me to the google "web" search page. the address bar is: "keyword:---------------------------------------------" and the google text field (where you enter your search terms) is: "---------------------------------------------". below that is: "The 'I'm Feeling LuckyTM' button automatically takes you to the first web page returned for your query.

An 'I'm Feeling Lucky' search means less time searching for web pages and more time looking at them."

no crashes. did i do something wrong in creating the html file?; Like this

Doesn't crash here
by SmokieUK September 9, 2005 1:00 PM PDT: I've loaded the page multiple times and nothing happens. Just a white page with "Done" in the Status Bar.; Like this

No joy here either
by September 9, 2005 3:15 PM PDT: I also just get google page with a lot of dashes in the search bar and no results, FireFox 1.06 on XP SP2 here as well.; Like this

wait for it,,,

by Scott W September 9, 2005 7:51 AM PDT

it won't be long, the flood of IE junkies will be here any minute. just as soon as they finish school :p

Like this Reply to this comment

oops
by Scott W September 9, 2005 7:52 AM PDT: commas instead of ...'s
man i'm dumb...; Like this

The only thing worse...
by David Arbogast September 9, 2005 10:15 AM PDT: The only thing worse than unfounded knee-jerk reactions to security threats are people who pre-empt the reactions with insults. Way to go. FireFox has a flaw. A big one. Just like every other web browser. Open-source is hardly proving to be secure. Suggestng that it is somehow "more" secure is flawed logic. It matters little how many security problems a software package has, when a hacker only needs to exploit one flaw.; Like this View all 3 replies Hide replies
Processing

wait for it,,,

by Scott W September 9, 2005 7:51 AM PDT

it won't be long, the flood of IE junkies will be here any minute. just as soon as they finish school :p

Like this Reply to this comment

oops
by Scott W September 9, 2005 7:52 AM PDT: commas instead of ...'s
man i'm dumb...; Like this

The only thing worse...
by David Arbogast September 9, 2005 10:15 AM PDT: The only thing worse than unfounded knee-jerk reactions to security threats are people who pre-empt the reactions with insults. Way to go. FireFox has a flaw. A big one. Just like every other web browser. Open-source is hardly proving to be secure. Suggestng that it is somehow "more" secure is flawed logic. It matters little how many security problems a software package has, when a hacker only needs to exploit one flaw.; Like this View all 3 replies Hide replies
Processing

Was OS are effected?

by September 9, 2005 8:31 AM PDT

I wish that these "security experts" would be a little more informitive. Does PC mean Windows PC, Intel machines, all personal computers? Does that exclude servers that man be running a X-Windows Fire fox client?

Like this Reply to this comment

true
by Scott W September 9, 2005 8:59 AM PDT: the page causes the fox to crash in linux, however, it's debatable whether code run could be run in linux...; Like this View reply Hide reply
Processing

RE
by unknown unknown September 9, 2005 10:38 AM PDT: Firefox is cross-platform so theoretically it effects any OS that can run Firefox. That said the code to be executed by exploiting this flaw would have to be written for the intented system.; Like this View reply Hide reply
Processing

Was OS are effected?

by September 9, 2005 8:31 AM PDT

Like this Reply to this comment

true
by Scott W September 9, 2005 8:59 AM PDT: the page causes the fox to crash in linux, however, it's debatable whether code run could be run in linux...; Like this View reply Hide reply
Processing

RE
by unknown unknown September 9, 2005 10:38 AM PDT: Firefox is cross-platform so theoretically it effects any OS that can run Firefox. That said the code to be executed by exploiting this flaw would have to be written for the intented system.; Like this View reply Hide reply
Processing

Sign petition to back out patch for Firefox Bug# 303806

by September 9, 2005 9:21 AM PDT

If you don't agree with the changes to the Winstripe theme please comment in http://forums.mozillazine.org/viewtopic.php?t=315361&postdays=0&postorder=asc&postsperpage=15&start=0 and sign the petition to back out the bug that brought us the excessive padding and the hideous flat look on classic systems http://www.petitiononline.com/fx303806/petition.html

Like this Reply to this comment

Reply
by unknown unknown September 9, 2005 11:18 AM PDT: Firefox is very customizable. It's UI is created through the use of an XML based UI markup language called XUL and Javascript. One could easily extract the contents of the jar files (which are just zip files with a different extension) located in the chrome folder which is under the folder one installed Firefox to.

One of the great things about open source software is if you don't like something you can change it.

In short, if you want something done right (at least according to your point of view) do it yourself. Mozilla's website has tutorials on XUL and the Javascript.; Like this

Sign petition to back out patch for Firefox Bug# 303806

by September 9, 2005 9:21 AM PDT

Like this Reply to this comment

Reply
by unknown unknown September 9, 2005 11:18 AM PDT: Firefox is very customizable. It's UI is created through the use of an XML based UI markup language called XUL and Javascript. One could easily extract the contents of the jar files (which are just zip files with a different extension) located in the chrome folder which is under the folder one installed Firefox to.

One of the great things about open source software is if you don't like something you can change it.

In short, if you want something done right (at least according to your point of view) do it yourself. Mozilla's website has tutorials on XUL and the Javascript.; Like this

Well, it blew mine up...
by reechwuzhere September 9, 2005 12:21 PM PDT: Windows XP SP2 and FireFox 1.0.6

It crashed so fast that it made me laugh; Like this Reply to this comment

Well, it blew mine up...
by reechwuzhere September 9, 2005 12:21 PM PDT: Windows XP SP2 and FireFox 1.0.6

It crashed so fast that it made me laugh; Like this Reply to this comment

Fix / workaround from Mozilla
by J. Warren September 9, 2005 10:03 PM PDT: See:

- https://addons.mozilla.org/messages/307259.html
"On September 9, the Mozilla team released a configuration change which, as a temporary measure to work around this problem, disables IDN in the browser..."; Like this Reply to this comment

Fix / workaround from Mozilla
by J. Warren September 9, 2005 10:03 PM PDT: See:

- https://addons.mozilla.org/messages/307259.html
"On September 9, the Mozilla team released a configuration change which, as a temporary measure to work around this problem, disables IDN in the browser..."; Like this Reply to this comment

Microsoft must have a hand in it!
by September 10, 2005 4:38 AM PDT: Another FireFox security issue. Not that it's not a great browser, I just get tired of people ripping on Microsoft for it's problems when many are attributed to it simply being the most used software. Now that FireFox is becoming more popular, we're finding that it has it's holes as well. All software has its problems. Give Microsoft a break!; Like this Reply to this comment

Microsoft must have a hand in it!
by September 10, 2005 4:38 AM PDT: Another FireFox security issue. Not that it's not a great browser, I just get tired of people ripping on Microsoft for it's problems when many are attributed to it simply being the most used software. Now that FireFox is becoming more popular, we're finding that it has it's holes as well. All software has its problems. Give Microsoft a break!; Like this Reply to this comment

(48 Comments)

Latest tech news headlines

Facebook, Twitter: How we chose to live in public
Posted in Technically Incorrect by Chris Matyszczyk

January 1, 2010 12:16 PM PST
Ex-Googler Lee sees Apple tablet debut in January
Posted in News - Apple by Jonathan Skillings

January 1, 2010 9:20 AM PST
U.S. trade agency eyes Samsung-Sharp spat
Posted in News - Business Tech by Vivian Yeo

January 1, 2010 7:31 AM PST
See all headlines