We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Mozilla claims Firefox 1.5 hole poses minor risk

Low-severity issue

The first Firefox 1.5 security vulnerability, made public yesterday, is not as critical as initially perceived, but a patch will be available to fix it early next year, a Mozilla executive said.

Mozilla plans to repair the hole in the latest version of its open-source browser when it releases its next regularly scheduled stability build of Firefox. That should happen in late January or early February, said Mike Schroepfer, vice president of engineering for Mozilla. Firefox 1.5 was released 30 November.

"Based on the information we have, it's a low-severity issue, but we will address it anyway," he said in an interview yesterday.

Packet Storm Security released code on Wednesday that takes advantage of the vulnerability, which can cause a buffer overflow and put users at risk of a DoS (denial of service) attack when running the browser, according to a posting yesterday by independent security consultant John Bambenek on the SANS Internet Storm Center website.

According to the posting, the vulnerability is in the browser's history.dat file, which stores a user's history of websites visited. It can be exploited by crafting an abnormally long URL with perhaps a few million characters. If a user navigates to a site that exploits the hole, "it will crash the browser each time it is started after going to such a page," Bambenek wrote in the posting.

Security research company Secunia Thursday gave the bug a rating of "not critical" on its website.

Schroepfer said that a team of volunteers and Mozilla engineers never discovered a DoS problem using the proof of concept code from Packetstorm. "We have no independent confirmation that it crashes, not for lack of trying," he said.

Schroepfer said that when engineers tried to recreate the problem, the browser worked sluggishly and took an exceptionally long time to load a web page, but only after the browser was closed and then restarted after the first security breach. However, the browser will not crash. "Eventually, it will process and will start properly," he said.

Furthermore, Schroepfer said it would be extremely rare for someone to visit a site that exploits the hole during a typical web-browsing session. "You'd have to browse to a malicious site, one that someone spent the time to create to cause people harm," he said. "Then you'd have to browse there, and the next time your browser would take longer to start."

Even if a user does encounter a malicious website that exploits the hole, clearing out the browser's history will remedy the problem, Schroepfer added.

Mozilla, a spin-off of the open-source Mozilla Foundation, oversees the release of the Mozilla software products Firefox and Thunderbird, an email client.

Firefox 1.5 runs on versions of Windows from Windows 98 to XP, as well as Mac OS X and various flavors of Linux. Since its initial release last year, Firefox has been downloaded more than 100 million times, according to Mozilla.

IDG UK Sites

Best camera phone of 2015: iPhone 6 Plus vs LG G4 vs Galaxy S6 vs One M9 vs Nexus 6

IDG UK Sites

In defence of BlackBerrys

IDG UK Sites

Why we should reserve judgement on Apple ditching Helvetica in OS X/iOS for the Apple Watch's San...

IDG UK Sites

Retina 3.3GHz iMac 27in preview: Apple cuts £400 of price of Retina iMac with new model