Firefox URL Domain Name Buffer Overflow

http://secunia.com/advisories/16764/

Release Date: 2005-09-09

Critical: Highly critical

Solution Status: Unpatched

Description:
Tom Ferris has discovered a vulnerability in Firefox, which can be exploited by malicious people to cause a DoS (Denial of Service) or potentially to compromise a user's system.

The vulnerability is caused due to an error in the handling of an URL that contains the 0xAD character in its domain name. This can be exploited to cause a heap-based buffer overflow.

Successful exploitation crashes Firefox and may potentially allow code execution but requires that the user is tricked into visiting a malicious web site or open a specially crafted HTML file.

The vulnerability has been confirmed in version 1.0.6, and is reported to affect versions prior to 1.0.6, and version 1.5 Beta 1.

Solution:
Don't browse untrusted web sites.

Vulnerabilities in 2005
Firefox 1.x: 18 http://secunia.com/product/4227/?period=2005#statistics
IE 6.0: 11 http://secunia.com/product/11/?period=2005#statistics

Yup FF beats IE in this category.

Proof of concept demo which crashes FF. If your FF doesn't crash, try it again.

http://www.security-protocols.com/firefox-death.html

The vulnerability is not yet fixed, but you can turn off idn support in about:config as a workaround (like turn off activex in ie until a patch come out).

Or you can install an xpi to turn off the idn support (how dump).

http://forums.mozillazine.org/viewtopic ... 15&start=0