Firefox URL Domain Name Buffer Overflow

http://secunia.com/advisories/16764/

Release Date: 2005-09-09

Critical: Highly critical

Solution Status: Unpatched

Description:
Tom Ferris has discovered a vulnerability in Firefox, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially to compromise a user's system.

The vulnerability is caused due to an error in the handling of an URL that contains the 0xAD character in its domain name. This can be exploited to cause a heap-based buffer overflow.

Successful exploitation crashes Firefox and may potentially allow code execution but requires that the user is tricked into visiting a malicious web site or open a specially crafted HTML file.

The vulnerability has been confirmed in version 1.0.6, and is reported to affect versions prior to 1.0.6, and version 1.5 Beta 1.

Solution:
Don't browse untrusted web sites.

Vulnerabilities in 2005
Firefox 1.x: 18 http://secunia.com/product/4227/?period=2005#statistics
IE 6.0: 11 http://secunia.com/product/11/?period=2005#statistics

Yup FF beats IE in this category.

Solution:
Don't browse untrusted web sites.

Proof of concept demo which crashes FF. If your FF doesn't crash, try it again.

http://www.security-protocols.com/firefox-death.html

i start up netadrress,but my fx is fine!

我的FF一点事情都没有。
<A HREF=https:нннннннннннннннннннннннннннннннннннннннннннн >

我試了兩次就crash了@"@

abc@home：Proof of concept demo which crashes FF. If your FF doesn't crash, try it again.

http://www.security-protocols.com/firefox-death.html回到原帖

Nothing happen。

abc@home：Proof of concept demo which crashes FF. If your FF doesn't crash, try it again.

http://www.security-protocols.com/firefox-death.html回到原帖

<A HREF=https:�������������������������������������������� >

Fedora Core 4 Linux 下挂住，响应极慢，页面不显示。

这个 Don't browse untrusted web sites. 很难做到的，用户无法分辨。等 1.07 吧。

PS：楼主喜欢比 2005 年的漏洞数量，2005 年前的，过去的都让它过去吧。我呢，发扬楼主精神，喜欢比最后一个月的，2005 年 8 月 Firefox vs. IE 6 是 0:2 胜出

不过 overflow 溢出漏洞，问题都比较严重。

允许javascript就crash

我的允许javascript 一样是正常的。如图：

路过。随手试试，没什么问题啊？

我点了一次，没有任何问题。
但是你再点一次就会crash了。

xiaonanhai：我点了一次，没有任何问题。
但是你再点一次就会crash了。回到原帖

我试了N次, 都没crash