[ insider_reports_insider ] Firefox Accused Of JavaScript Mess
David Utter Staff Writer
2006-10-02
Insider Reports RSS Feed
A "complete mess" in the implementation of JavaScript in the Firefox browser leaves its users vulnerable to an assortment of stack overflow attacks, according to accusations made at the ToorCon hacker and security conference in San Diego.
 | | Firefox Accused Of JavaScript Mess |  |
Presenters Mischa Spiegelmock and Andrew Wbeelsoi claim to have an arsenal of around 30 Firefox problems that they plan to keep under wraps.
But as CNET reported from their presentation, a vulnerability they did discuss during their presentation may become a zero-day exploit for Firefox users, according to Mozilla chief security officer Window Snyder:
Snyder said she isn't happy with the disclosure and release of an apparent exploit during the presentation. "It looks like they had enough information in their slide for an attacker to reproduce it," she said. "I think it is unfortunate because it puts users at risk, but that seems to be their goal."
At the same time, the presentation probably gives Mozilla enough data to fix the apparent flaw, Snyder said. However, because the possible flaw appears to be in the part of the browser that deals with JavaScript, addressing it might be tougher than the average patch, she added. "If it is in the JavaScript virtual machine, it is not going to be a quick fix," Snyder said.
The two hackers also dismissed a request from another Mozilla security staffer, Jesse Ruderman, to hand over the flaws in exchange for Mozilla's Bug Bounty rewards for such discoveries:
"I do hope you guys change your minds and decide to report the holes to us and take away $500 per vulnerability instead of using them for botnets," Ruderman said.
The two hackers laughed off the comment. "It is a double-edged sword, but what we're doing is really for the greater good of the Internet, we're setting up communication networks for black hats," Wbeelsoi said.
Although Mozilla has had more vulnerabilities to patch in Firefox in 2006 than Microsoft has had with Internet Explorer, Firefox generally gets the nod as being more secure due to the speed in which the browser receives security updates.
Should the problem be as Snyder feared, Firefox could be in for a massive rewrite.
---
Tag: Firefox
Add to Del.icio.us | Digg | Yahoo! My Web | Furl
Bookmark SecurityProNews -
About the Author:
David Utter is a business and technology writer for SecurityProNews and WebProNews.
More insider_reports_insider Articles
Insider Reports RSS Feed
|
|