A respected industry trade journal - AMD lawyers
|
|
|
Zero day flaw in Firefox 3.6
A RUSSIAN insecurity outfit has managed to create a zero day exploit for Firefox 3.6 under Windows.
The exploit allows attackers to remotely gain control of a Windows PC thanks to a previously unknown flaw in the Windows version of the Firebadger 3.6 browser software.
Intevydis develops the commercial VulnDisco add-on for the Canvas exploit toolkit that's marketed by the vendor Immunity.
Writing at the company's online forum, Intevydis developer Evgeny Legerov said that his exploit for Windows XP (SP3) and Vista is quite reliable. He said it was an interesting challenge to find the buffer overflow flaw and work out a way to exploit it.
The Mozilla Foundation knows about the exploit but has not made an official statement on it yet and has not released a patch for Firefox 3.6 so far. Secunia says the problem is critical.
It is not clear whether the exploit was behind an increase in the number of Firefox 3.6 crashes that was noted on February 12th and 13th. While those might not have been caused by a real life exploit, they could have been due to the exploit being tested. µ
Share this:
Share
What I find far more troubling here is that Secunia seems to be taking this exploit on faith alone. A number of threads (search for them, they're out there) paint VulnDisco's vendor as uncooperative with "responsible disclosure" procedures, and why not? After all, this is a commercial vendor with a product to sell; though, perhaps it's worth noting that apparently someone *already purchased the product and was unable to reproduce the issue on 3.6*. The impropriety of this operation is already being called into question. Perhaps if I submit a report to Secunia of - let's say - Opera being critically insecure with a potential remote execution vector via a buffer overflow, I can get it published too? After all, I sell a commercial vulnerability discovery pack and can't POSSIBLY be in it for the money. This seems to be going awfully far for not having any real proof.
http://secunia.com/advisories/38608/
http://secunia.com/community/forum/thread/show/3592
Does that mean it's real, or are they taking it on trust from the original report by A. Random Hacker?
To all you linux experts. I'm running Linux ubantu on top of or within Win7 using WUBI. Is that safe enough to by pass all these exploits when running FFox in Linux.
Since it is a 'windows' only flaw, having to do with buffer overflow...
with its history of never having really fixed the buffer over flow problem (windows, that is)
should this not be another WINDOWS BUFFER OVERFLOW PROBLEM??
Firefox just happened to be the one that triggered the rediscovery.
Good thing i still use 3.0.xx then, seems this won't effect me!