New Firefox---Patch for security flaw--HOT---IMHO

[peanutty1]

i didn't like Firefox (v0.9) because there were a bunch of little quirks such as: pics rendering slightly slower (compared to IE), image size coming up smaller than they should've been, a simple HTML showing up blank (had to hit the refresh)....some real minor issues. anyone know if the latest version fixes these glitches?

basically, i just wish that Firefox acted more like IE (minus IE's security problems, of course).

 

[Mephistokur]

I had problems with everything between 0.8+ and 0.9 Final. 0.9.1 fixed most of the issues I was having.

 

[So]

Originally posted by: peanutty1
i didn't like Firefox (v0.9) because there were a bunch of little quirks such as: pics rendering slightly slower (compared to IE), image size coming up smaller than they should've been, a simple HTML showing up blank (had to hit the refresh)....some real minor issues. anyone know if the latest version fixes these glitches?

basically, i just wish that Firefox acted more like IE (minus IE's security problems, of course).

Umm...

0.9.1 & 0.9.2 were bugfix releases. 0.9.2 ONLY fixes a remote exploit problem. You may want to turn firefox's automaic image resing off tho' lol!

 

[Nick5324]

Downloaded 0.9.2... worked fine. Downloaded some extentions, browser no longer opens. Forget it, for me, this is cold.

 

[1Cheap2Crazy]

Thanks OP. You may want to add in your title that it's a fix for a securtiy flaw. Otherwise some people may ignore the update.

I'm staying away from extensions for now because so few seem to work with 0.9.1 and above. Otherwise great browser

 

[So]

Originally posted by: Nick5324
Downloaded 0.9.2... worked fine. Downloaded some extentions, browser no longer opens. Forget it, for me, this is cold.

What did you upgrade from?

 

[So]

http://reloadevery.mozdev.org/
http://dictionarysearch.mozdev.org/
http://dmextension.mozdev.org/

 

[So]

^--using those on 0.9.2 as I post.

 

[ncage]

Originally posted by: SolderSucker
Stupid Firefox posts. Can't u keep this in one thread.

You seen the subject. If you don't like it you don't have to read it. There are some post i don't like but i don't complain about them.

 

[usernamemax20charact]

Thanks. Good to know.

For those using Mozilla, here's the fix for the exploit.

 

[BadNewsBears]

Originally posted by: SolderSucker
Good reading. Luckily, i don't run this bug infested browser.

Bug infested? I hope that was sarcasm, because this patch was to correct a problem with windows NOT firefox. And have you seen the IE holes that are wide and gaping? Theve been out for nearly a week and NO PATCH YET

IE BLOWS WID

 

[jmunjr]

Lol, what a bunch of hypocrites. If someone had posted a thread about an IE flaw and fix there would be dozens of people replying about how this wasn't a hot deal..

This has nothing to do with hot deals people. If anything, this shows IE isn't alone in having security holes.

-John M

 

[cmed]

I'im evaluating Firefox. So far, I like IE better, but I am trying to force myself to use Firefox.

I realize it is cool to bash Microsoft, but as users move to Mozilla, won't the hackers move to?

 

[L1FE]

Not sure why this is in the hot deals section...BUT I find it odd how people are bashing on firefox for being insecure when it's a flaw inherent in Windows...as in a feature of Windows that firefox uses is the main security risk...:rolls eyes:

 

[RudeBoie]

I think hackers just hack whatever they can. And the whole thing about FireFox is that it is open source and everyone can try to hack it on their own and look for problems because they don't want to use something flawed and thus, they try to improve FireFox as much as they can. Same thing with Linux. Hand built by the community to be fast, stable, and secure.

 

[VirtualLarry]

Originally posted by: L1FE
Not sure why this is in the hot deals section...BUT I find it odd how people are bashing on firefox for being insecure when it's a flaw inherent in Windows...as in a feature of Windows that firefox uses is the main security risk...:rolls eyes:

Exactly. What I guess most people don't understand about this "exploit", is how applications and OSes are built, and what layers are responsible for what. In Windows', there is an OS-wide list of "protocol handlers", maintained in the registry. This is what allows, for example, you to browse a web page in Mozilla Firefox, and click on a "mailto:" link, and launch your favorite mail client to send an e-mail (ie. your OS-registered "mailto:" protocol-handler helper app). It could be Outlook Express (default installation), or anything else. It doesn't have to be Mozilla Thunderbird, they don't lock you into using their suite of apps exclusively, as MS tries to do to users.

Blocking all external protocol handlers by default, would have basically broken Mozilla as a browser, because it would have made it too difficult for the majority of end-users to use protocol-handler helper apps, and requiring a seperate Mozilla-specific method of registering external protocol-handler helper apps would have been unfeasable - other e-mail clients and whatnot wouldn't have bothered with it, what with Mozilla's miniscure market share (at the time).

Basically, if the protocol-handler is "external", meaning not handled internally to the browser, Mozilla does what every other Windows-compliant browser does - it runs the appropriate protocol-handler specified in the registry. Apparently, Windows has this default "shell:" protocol-handler that essentially gives wide-open access to a number of things. This is similar, in a way, to the "URL:" "location:" "ms-its:" "hcp:" and a number of other protocol-handler issues/exploits that IE has had to deal with for some time now.

One thing to be thankful about Mozilla's dev team though, is that they do put a lot of work into patching over a lot of Windows' own security issues within their application, to provide for the best end-user experience. Apparently they missed this one, or it was not well-known to them. But when they were made aware of it, they released a patch and an updated release, immediately. So don't listen to the trolls, that claim that Mozilla was lazy in fixing this, because IMO they were very quick to release a patch, much quicker than MS is. (Heck, MS still doesn't have a full set of patches, for the recent "scob" thing, do they?)

I just find it really funny, also, the number of IE users that don't understand the specifics of this issue, and point fingers and go "See! Mozilla has these awful exploits/holes too! Open-source sucks!", and at the same time use IE with ActiveX enabled...
(Every ActiveX CLSID specification is effectively equivalent to an external protocol-handler, even worse, most of them run as in-process COM objects, not in a seperate process address space, so they could do even more damage.)

Edit: Ok, perhaps I was slightly wrong here. Specifically, the "shell:" external protocol-handler exploit indeed was a new thing. However, after reading quite a few Mozilla BugZilla threads, it's clear that the possibility for such a thing happening, was known back in early 2002, except that no fully-agreed-upon solution was arrived at, so in fact, nothing was really done about it. Consensus-by-committee never works, it seems.

Here are some more links, if anyone is interested in the technical specifics and background on this issue:
http://bugzilla.mozilla.org/show_bug.cgi?id=163308
http://bugzilla.mozilla.org/show_bug.cgi?id=163767
http://bugzilla.mozilla.org/show_bug.cgi?id=167473
http://bugzilla.mozilla.org/show_bug.cgi?id=250180
http://bugzilla.mozilla.org/show_bug.cgi?id=163648
http://bugzilla.mozilla.org/show_bug.cgi?id=167475

Other interesting individual comments that I came across in my travels:
(Note that these are all from 2002)

Good comment from Georgi Guninski on external protocol-handler support, and why it is a Bad Thing if enabled by default.
http://bugzilla.mozilla.org/show_bug.cgi?id=163648#c20

Another comment, suggesting a user dialog to prompt for running an external protocol-handler. (This I personally tend to agree with, and am disappointed that Mozilla or Firefox hasn't implemented this yet.)
http://bugzilla.mozilla.org/show_bug.cgi?id=163648#c22

Another excellent comment by George, pointing out that overall security is only as good as the strength of the weakest link, and unless external procotol-handlers are controlled, then that "weakest link" is an arbitrary quantity.
http://bugzilla.mozilla.org/show_bug.cgi?id=163648#c30

Another post from George - "I vote for an empty whitelist. The fact that this bug is open shows that there is a bug with vbscript and mozilla. If the next IE install a protocol msbar: , should mozilla release a new version to blacklist it? If a worm takes an advantage of IE's bugs and owns mozilla users, what shall mozilla.org tell - "it is not our fault, just our blacklist is a bit incomplete" ?"
http://bugzilla.mozilla.org/show_bug.cgi?id=163648#c36

 

[SolderSucker]

If you guys didn't go to so many warez and porno sites, you wouldn't have to worry about having your browsers exploited. I go to reputable websites and have no problems with IE. This isn't a hot deal. I didn't know this was the hot patches forum.

 

[BadNewsBears]

Originally posted by: VirtualLarry

Originally posted by: L1FE
Not sure why this is in the hot deals section...BUT I find it odd how people are bashing on firefox for being insecure when it's a flaw inherent in Windows...as in a feature of Windows that firefox uses is the main security risk...:rolls eyes:

Exactly. What I guess most people don't understand about this "exploit", is how applications and OSes are built, and what layers are responsible for what. In Windows', there is an OS-wide list of "protocol handlers", maintained in the registry. This is what allows, for example, you to browse a web page in Mozilla Firefox, and click on a "mailto:" link, and launch your favorite mail client to send an e-mail (ie. your OS-registered "mailto:" protocol-handler helper app). It could be Outlook Express (default installation), or anything else. It doesn't have to be Mozilla Thunderbird, they don't lock you into using their suite of apps exclusively, as MS tries to do to users.

Blocking all external protocol handlers by default, would have basically broken Mozilla as a browser, because it would have made it too difficult for the majority of end-users to use protocol-handler helper apps, and requiring a seperate Mozilla-specific method of registering external protocol-handler helper apps would have been unfeasable - other e-mail clients and whatnot wouldn't have bothered with it, what with Mozilla's miniscure market share (at the time).

Basically, if the protocol-handler is "external", meaning not handled internally to the browser, Mozilla does what every other Windows-compliant browser does - it runs the appropriate protocol-handler specified in the registry. Apparently, Windows has this default "shell:" protocol-handler that essentially gives wide-open access to a number of things. This is similar, in a way, to the "URL:" "location:" "ms-its:" "hcp:" and a number of other protocol-handler issues/exploits that IE has had to deal with for some time now.

One thing to be thankful about Mozilla's dev team though, is that they do put a lot of work into patching over a lot of Windows' own security issues within their application, to provide for the best end-user experience. Apparently they missed this one, or it was not well-known to them. But when they were made aware of it, they released a patch and an updated release, immediately. So don't listen to the trolls, that claim that Mozilla was lazy in fixing this, because IMO they were very quick to release a patch, much quicker than MS is. (Heck, MS still doesn't have a full set of patches, for the recent "scob" thing, do they?)

I just find it really funny, also, the number of IE users that don't understand the specifics of this issue, and point fingers and go "See! Mozilla has these awful exploits/holes too! Open-source sucks!", and at the same time use IE with ActiveX enabled...
(Every ActiveX CLSID specification is effectively equivalent to an external protocol-handler, even worse, most of them run as in-process COM objects, not in a seperate process address space, so they could do even more damage.)

Or better yet when the IE devs released a patch to correct a hole, but they didn't even do it right.

 

[SolderSucker]

Still not a hot deal. Didn't your mothers tell you if you play with dirty girls you'll catch something?

 

[L1FE]

Originally posted by: SolderSucker
Still not a hot deal. Didn't your mothers tell you if you play with dirty girls you'll catch something?

The problem with "dirty girls" as you like to put it, is that you don't know where most girls have been. Hence why in the past few weeks there have been security releases about exploits on REPUTABLE ("clean if you will") sites that steal your credit card information. If you want to take your analogy further, if you're not using protection (patches, other software, whatever) then you're just waiting to catch something, regardless if you don't play with "dirty girls."

What I don't see the point is for you to crap on a thread over and over, if you think it's such a waste of time. That's like saying fire burns, yet continually reaching into it (to get burned).

 

[SolderSucker]

Originally posted by: L1FE

Originally posted by: SolderSucker
Still not a hot deal. Didn't your mothers tell you if you play with dirty girls you'll catch something?

The problem with "dirty girls" as you like to put it, is that you don't know where most girls have been. Hence why in the past few weeks there have been security releases about exploits on REPUTABLE ("clean if you will") sites that steal your credit card information. If you want to take your analogy further, if you're not using protection (patches, other software, whatever) then you're just waiting to catch something, regardless if you don't play with "dirty girls."

What I don't see the point is for you to crap on a thread over and over, if you think it's such a waste of time. That's like saying fire burns, yet continually reaching into it (to get burned).

Now thats a hot deal. I love pain. Hmmm. Well, you shouldn't be giving those porn sites your credit # then you wouldn't have a problem. Reputable, is a nice way to put it.

 

[BadNewsBears]

Thats why my Ie got hijacked thru msn two weeks ago.

 

[L1FE]

Originally posted by: SolderSucker

Originally posted by: L1FE

Originally posted by: SolderSucker
Still not a hot deal. Didn't your mothers tell you if you play with dirty girls you'll catch something?

The problem with "dirty girls" as you like to put it, is that you don't know where most girls have been. Hence why in the past few weeks there have been security releases about exploits on REPUTABLE ("clean if you will") sites that steal your credit card information. If you want to take your analogy further, if you're not using protection (patches, other software, whatever) then you're just waiting to catch something, regardless if you don't play with "dirty girls."

What I don't see the point is for you to crap on a thread over and over, if you think it's such a waste of time. That's like saying fire burns, yet continually reaching into it (to get burned).

Now thats a hot deal. I love pain. Hmmm. Well, you shouldn't be giving those porn sites your credit # then you wouldn't have a problem. Reputable, is a nice way to put it.

"Among the sites targeted by the attack are some owned by Citibank, Deutsche Bank and Barclays Bank.

The attack is rather complex and appears to use a known flaw in Internet Explorer (IE) to drop a Trojan horse program on vulnerable machines. The Trojan is delivered through a malicious pop-up ad that loads a file called "img1big.gif" onto the machine. The file is in fact a compressed Win32 executable that contains the Trojan and a DLL.

The DLL is installed on the PC as a BHO (Browser Helper Object), a type of DLL that normally is used to let developers control IE in certain circumstances.

When IE runs on a machine infected with the malicious BHO, the file monitors IE's activities for any HTTPS sessions with URLs that have any of a large number of banking-related strings in them. " - from eWeek

Yes, because Citibank, Deutsche Bank and Barclays Bank owns only the most reputable porn sites I visit. In your effort to seem witty, you just seem uninformed. Thanks.

edit: Don't see you going around all the other threads crying "this is not a hot deal" so really, stop with this "I'm all innocent just informing everyone that this isn't a hot deal" attitude.

 

[ActuaryTm]

Originally posted by: SolderSucker
Still not a hot deal.

Am forced to agree with the above. Fortunately, there is an entire segment of the Anandtech user forum devoted to such exploits (no pun intended). Found here.

 

[Ookami]

Firefox is HOT HOT HOT! Awesome browser...