Firefox URL Domain Name Buffer Overflow

http://secunia.com/advisories/16764/

Release Date: 2005-09-09

Critical: Highly critical

Solution Status: Unpatched

Description:
Tom Ferris has discovered a vulnerability in Firefox, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially to compromise a user's system.

The vulnerability is caused due to an error in the handling of an URL that contains the 0xAD character in its domain name. This can be exploited to cause a heap-based buffer overflow.

Successful exploitation crashes Firefox and may potentially allow code execution but requires that the user is tricked into visiting a malicious web site or open a specially crafted HTML file.

The vulnerability has been confirmed in version 1.0.6, and is reported to affect versions prior to 1.0.6, and version 1.5 Beta 1.

Solution:
Don't browse untrusted web sites.

Vulnerabilities in 2005
Firefox 1.x: 18 http://secunia.com/product/4227/?period=2005#statistics
IE 6.0: 11 http://secunia.com/product/11/?period=2005#statistics

Yup FF beats IE in this category.

Nothing ..........

The vulnerability is not yet fixed, but you can turn off idn support in about:config as a workaround (like turn off activex in ie until a patch come out).

Or you can install an xpi to turn off the idn support (how dump).

http://forums.mozillazine.org/viewtopic ... 15&start=0

原来昨天刚刚解决这个Bug
http://www.squarefree.com/burningedge/2 ... ch-builds/

我昨天访问这个页面两次，然后View Source就死掉了，今天就不死了～

Firefox的问题修复速度也许是微软Internet Explorer永远也追赶不上的：我们下午刚报道Firefox最新发现安全漏洞不到半天，Mozilla.org就发布了针对该漏洞的临时解决方案，并推出Firefox 1.0.6版补丁文件。

该安全隐患存在于Firefox处理超长IDN域名过程中。



fixed?

和楼上的情况一样，点了十来次了都没事

xiaonanhai：我点了一次，没有任何问题。
但是你再点一次就会crash了。回到原帖

我试了N次, 都没crash

我点了一次，没有任何问题。
但是你再点一次就会crash了。

路过。随手试试，没什么问题啊？

我的允许javascript 一样是正常的。如图：

允许javascript就crash

不过 overflow 溢出漏洞，问题都比较严重。

Fedora Core 4 Linux 下挂住，响应极慢，页面不显示。

这个 Don't browse untrusted web sites. 很难做到的，用户无法分辨。等 1.07 吧。

PS：楼主喜欢比 2005 年的漏洞数量，2005 年前的，过去的都让它过去吧。我呢，发扬楼主精神，喜欢比最后一个月的，2005 年 8 月 Firefox vs. IE 6 是 0:2 胜出

abc@home：Proof of concept demo which crashes FF. If your FF doesn't crash, try it again.

http://www.security-protocols.com/firefox-death.html回到原帖

<A HREF=https:�������������������������������������������� >