Netstat -vat by Sean Michael Kerner (bio )

A command line view of IT

« Linux achieves 1 second boot | Sean Michael Kerner Blog | Will the US State Dept please use Firefox? »

Firefox 3.5 at risk from 0-Day JavaScript and DNS flaws?

By Sean Michael Kerner on July 14, 2009 12:06 PM

From the 'shiny, new and broken' files:

US-CERT is warning today about a new un-patched 0-day Firefox 3.5 vulnerability. According to US-CERT, the vulnerability is due to an error in the way JavaScript code is processed.

There is proof of concept code for the exploit publicly available now and as such in my opinion this represents an immediate threat to Firefox 3.5 users. To the best of my knowledge this is the first 'critical' flaw publicly reported for the Firefox 3.5 release which came out two ago.

The code that I saw was written by security researcher Simon Berry-Byrne and is officially titled, "Firefox 3.5 Heap Spray Vulnerability. Berry-Byrne in his proof of concept code thanks security research H D Moore, "...for the insight and Metasploit for the payload." Metasploit is an open source security testing framework which can enable an attack to become 'weaponized' for testing and research purposes.

There is a second potential vulnerability that is making the rounds in the security research community involving a DNS leakage in Firefox 3.5.

Security researcher hevnsnt has reported a DNS leak, such that no matter how a user redirects their DNS (proxy etc) the Firefox 3.5 browser still leaks out the local DNS data. I contacted Mozilla on the DNS issue yesterday and so far have not yet had any response back from them.

The DNS leak issue is a bit different than the JavaScript issue, in that it's what I would classify as an 'information disclosure' flaw. The JavaScript issue in contrast could lead to a denial of service or arbitrary code execution.

Mozilla developers had already planned to issue a Firefox 3.5.1 update for the middle of July, so we might not have to wait long at all

Either way, let's hope Mozilla gets both these issues patched quickly.

Permalink | Comments (0) | TrackBacks (0) | Share