|
Highly Critical Vulnerability Reported by Secunia
SA16764 - Firefox URL Domain Name Buffer Overflow was just reported today by Secunia and is rated highly critical.
(For) Now Fx is rated as vulnerable as IE.
Description:
Tom Ferris has discovered a vulnerability in Firefox, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially to compromise a user's system.
The vulnerability is caused due to an error in the handling of an URL that contains the 0xAD character in its domain name. This can be exploited to cause a heap-based buffer overflow.
Successful exploitation crashes Firefox and may potentially allow code execution but requires that the user is tricked into visiting a malicious web site or open a specially crafted HTML file.
The vulnerability has been confirmed in version 1.0.6, and is reported to affect versions prior to 1.0.6, and version 1.5 Beta 1.
Secunia report:http://secunia.com/advisories/16764/
Test your browser for vulnerability:http://www.security-protocols.com/firefox-death.html
An xpi (for all Firefox versions and Seamonkey) has been made to apply this workaround for you:https://bugzilla.mozilla.org/attachment.cgi?id=195471
Click the link to download the file, then drag it into an open Firefox window to install it. All users should do this.
Should you ever want to uninstall this temporary fix, go to the folder Firefox is installed to, go into the defauts/pref subfolder, and delete the file 'bug307259.js'. Uninstalling it is not recommended.
You can also do this manually by changing the network.enableIDN peference to false.
|
