RE: [Full-disclosure] FireFox Host: Buffer Overflow is not justexploitable on FireFox

From: Peter Kruse (kruse_at_krusesecurity.dk)
Date: 09/14/05

  • Next message: Martin Schulze: "[SECURITY] [DSA 811-1] New common-lisp-controller packages fix arbitrary code injection"
    To: "'Juha-Matti Laurio'" <juha-matti.laurio@netti.fi>
    Date: Wed, 14 Sep 2005 12:42:05 +0200
    
    

    Hi Juha!

    > I have informed the vendor Netscape being affected on 9th
    > September 2005.

    I did the same on the 10th of September - still no reply nor official
    statement from Netscape which makes me a little worried.
     
    > 2)
    > Disabling IDN support via about:config (or prefs.js file) is
    > possible in Netscape Browser 8 too. Xpi file for Firefox and
    > Mozilla Suite works in Netscape 8.0.3.3 too. Test was
    > successful and even UA was changed to include
    > ....Gecko/20050729 (No IDN) Netscape/8.0.3.3.
    > However, the manual method is recommended.
    > I.e. there is a workaround for Netscape. Vendor developer
    > team contacted during a weekend, no reply yet.

    Correct. I reported that workaround on the 10th of September.

    I did so using both the security address at netscape.com and the "submission
    form" on Netscape's official webpage. I never got any reply/respons from
    netscape.

    Netscape uses the same rendering engine as Firefox (unless explicitly told
    to use IE) and as such, will also be vulnerable. The workaround, covered by
    the Mozilla Team, will correct the problem simply by disabling IDN.

    Regards
    Peter Kruse


  • Next message: Martin Schulze: "[SECURITY] [DSA 811-1] New common-lisp-controller packages fix arbitrary code injection"

    Relevant Pages

    • Re: No More Netscape?
      ... Since AOL is getting rid of the Netscape browser, ... Firefox was developed by Mozilla Suite from ground up ...
      (rec.arts.tv)
    • Re: Im lost
      ... It put an icon on the desktop, but clicking the icon doesn’t seem to do ... Firefox is the latest of the mozilla suite - the successor to netscape. ...
      (alt.linux)
    • Re: Hyperlinks in OE messages open in Incorrect Browser
      ... there is no workaround for the problem. ... save the message and change the file extension to htm or html and double ... The problem has been around since the beginning of Netscape and IE (or have ... just going to have to live with a "clumsy workaround" since you cannot ...
      (microsoft.public.windows.inetexplorer.ie6_outlookexpress)
    • netscape GPL question
      ... i love firefox and even thunderbird. ... like the mozilla suite, and use all the apps included. ... is going to stop with the mozilla suite i thought i'd look to netscape ... before it was available to Linux/Unix Mac and windows. ...
      (comp.os.linux.misc)
    • Re: Im lost
      ... It put an icon on the desktop, but clicking the icon doesn’t seem to do ... Firefox is the latest of the mozilla suite - the successor to netscape. ...
      (alt.linux)