Exploit code for the latest version of open-source browser Firefox
was published Wednesday, potentially putting users at risk of a
denial-of-service attack.
The exploit code takes advantage of a bug in the recently released
Firefox 1.5, running on Windows XP with Service Pack 2. Firefox,
which initially debuted over a year ago, has moved swiftly to
capture 8 percent of the browser market.
The latest Firefox flaw exists in the history.dat file, which
stores information from Web sites users have visited with the
Firefox 1.5 browser, according to a posting on the Internet Storm
Center, which monitors online threats.
"If the topic of a page is crafted to be long enough, it will crash
the browser each time it is started after going to such a page,"
according to the Internet Storm Center posting. "Once this happens,
Firefox will be unable to be started until you erase the
history.dat file manually."
In testing Firefox 1.5 without a system running McAfee security
software, the Firefox 1.5 browser would stall and not respond to a
user's mouse, said Johannes Ullrich, chief research officer for the
Sans Institute, which runs the Internet Storm Center.
"Users have to kill out of the browser and start over again. This
stalled browser creates a DOS (denial of service) condition,"
Ullrich said.
Packet Storm, the security group that initially published the
proof-of-concept exploit code, noted that in addition to the
potential denial-of-service attack that could follow a buffer
overflow, systems may also be subject to a malicious execution of
code.
Ullrich, however, said while the potential may exist, it has not
been proven either way that malicious code could be executed.
Mozilla Foundation, which released Firefox, said it was not able to
confirm the browser would crash or be at risk of a DOS attack,
after visiting certain Web sites. And Mozilla has not received any
reports from users of such a problem, said Mike Schroepfer, vice
president of engineering for Mozilla Corp.
He added that Firefox 1.5 can be slugglish on its next start-up,
due to a bug in the history.dat, but it is not a security
problem.
"We have gotten no independent verification that it crashes
(Firefox), but there have been a lot of attempts to try,"
Schroepfer said.
