Firefox 'firedrill' critical fix coming next week

Attack code targets browser vulnerability

Robert McMillan
Online attack code has been released targeting a critical, unpatched flaw in Mozilla's Firefox browser.
http://adserver.adtech.de/?adlink|2.0|340|123028|1|171|KEY=security;grp=98977108;loc=300;
The attack code, written by security researcher Guido Landi, was published on several security sites on Wednesday, sending Firefox developers scrambling to patch the issue. Until the flaw is patched, this code could be modified by attackers and used to sneak unauthorised software onto a Firefox user's machine.

Firefox 'firedrill' critical fix coming next week News - PC Advisor

 

[dk70]

Is fixed https://bugzilla.mozilla.org/show_bug.cgi?id=485217

They have a build 1 of 3.08 avail since yesterday Index of /pub/mozilla.org/firefox/nightly/3.0.8-candidates I assume this fix is in that build. If not, and worried, get todays build Index of /pub/mozilla.org/firefox/nightly/latest-mozilla1.9.0

 

[echrada]

Thanks DK70

 

[dk70]

I tried their proof of concept Mozilla Firefox XSL Parsing 'root' XML Tag Remote Memory Corruption Vulnerability and build 1 has the fix - or 3.07 crashes and 3.08 does not. Will most likely be final version in few days/hours.

 

[dk70]

More like days apparently, unless headlines go all crazy now a build 2 is available Index of /pub/mozilla.org/firefox/nightly/3.0.8-candidates/build2/unsigned

 

[dinesh]

I started hating firefox since its giving me a wierd problem.
I want to change the preferences in Google and it shows that i have cookies disabled. whereas i have already enabled all cookies. Moreover, i have tried reinstalling firefox but its still giving me this same error. Any clues?

 

[dk70]

Uninstalling/reinstalling dont help much if you use same profile. Make a new one to start over.

You use cookie blocking, like from Spybot (immunizing)? Sometimes I hang out in Firefox irc and quite often people complain about Firefox not remembering cookies, logins. 1. There was a bug about that, fixed in 3.07 2. Many times problem is corrupted sqlite files, like the one holding cookies. Using SQlite manager, an extension you can chech integrity of sqlite files. If corrupted you have answer. Some say sqlite cant become corrupted unless touched by 3rd party programs, like Spybot. There are debates about that Have no idea but a damn problem because hard to fix unless you know this.

Under privacy both cookie boxes are ticked? Kept until expire? and nothing in exception list? If yes, yes and no I think you could have corrupted file. Sqlite manager can tell in under 1 minute. No extension or userscript messes with Google I assume.

Sqlite manager https://addons.mozilla.org/en-US/firefox/addon/5817 at right side select cookie.sqlite, press go. In database menu chose Check integrity. If result not "ok" there is problem.

Can a cookie become corrupted? Dont know but if sqlite dont find errors may be try delete all Google cookies, click "Show cookies".

 

[dinesh]

Nice tip dk70. i will try that today and will let you know.
by the way, i do not use Spybot. but as you said that its a problem in the profile, is there a way i can create a new profile in firefox?

 

[dk70]

Firefox has a Profile Manager for this. Sadly they dont seem too eager to promote this feature. They should when bragging about reasons to switch, It's Time to Get Personal Extension mess is no. 1 problem for Firefox. Well, check knowledgebase which has answers for most things. Profile Manager - MozillaZine Knowledge Base so just add "-P" to command line. Much the same as the Safe mode entry they put in start menu, see -safe-mode parameter in shortcut. You can have several profiles, good idea to have a "Test" one. For the strange extension you must try. Can go crazy without risk if you use profiles.

You can run multiple profile at the same time as well. Must add more parameters. Lets say you have an untouched/clean profile for testing (as to confirm Firefox has problem not your setup), called "Clean" - start it up with -P "Clean" -no-remote Also how you can run Firefox 3.1 and Firefox 3.08 on same computer without screwing up. All that matters are profiles, not what is in program files.

If you get hooked on profiles then there could be a problem with bookmarks - but there is Foxmarks and Delicious. Latest Delicious now integrates with Awesomebar - dont really work that well but eventually it will

Spywareblaster then? Does not have to be 3rd party from what the wise say but other wise people say sqlite cannot become corrupted on its own. First wise group now have doubts about that, heh. Dont know, but I do think Firefox should have build-in integrity check of those squlite files which holds most important info. Think I have seen some actions towards that in 3.1/3.5 but not sure. I use Delicious because managing 100s or 1000s of bookmarks in Firefox blows. Has all the right features after vers. 3 but try deleting/moving/copying many bookmarks, harddisk goes crazy, like Vista x10. Whole computer is close to a halt. There is something wrong... Changing to sqlite format was done to make tags etc. possible, much faster, safer and no limits - and yet it is not perfect when you start to tinker.

The extensive use of restricted site has problems with IE8 also btw, http://forums.spybot.info/showthread.php?t=46906

 

[A7X808]

3.0.8 update is available now.

 

[Barnabas]

3.0.8 update is available now.

Mahalo A7X808...

 

[Barnabas]

No...but been there several times in the last 20 years.

 

[LukaszR]

Kinda scary, considering such mistakes can happen. Well good thing FireFox has fixed the issue though.