12 ms·

Mozilla patches Firefox zero-day abused in the wild

• amaccuish 7y ago
  It's in moments like this where I really dislike running Ubuntu and having to wait for the new build to be released.
  • jlgaddis 7y ago
    You could download the 64-bit Linux build [0] and use it until a new Ubuntu package is available. [0]: https://download.mozilla.org/?product=firefox-latest-ssl&os=linux64&lang=en-US https://download.mozilla.org/?product=firefox-latest-ssl&os=...
    • amaccuish 7y ago
      Thanks, for some reason I thought they only provided source and not builds.
  • beatgammit 7y ago
    They're usually pretty quick, as in nearly as quick as rolling releases (and sometimes faster). Sure, they're not as fast as Mozilla, but usually it's out within a day or so if release, often quicker.
  • Daniel_sk 7y ago
    It takes days on Linux Mint. I just installed the binary directly from Firefox website and I get instant updates.
  • AnaniasAnanas 7y ago
    Consider trying the debian package until it is updated in your system.
    • pja 7y ago
      Currently in incoming btw: https://incoming.debian.org/debian-buildd/pool/main/f/firefox/firefox_67.0.3-1_amd64.deb https://incoming.debian.org/debian-buildd/pool/main/f/firefo...
  • simosx 7y ago
    $ snap info firefox ... channels: stable: 67.0.3-1 2019-06-18 (230) 221MB - It is already available to use.
    • amaccuish 7y ago
      I've looked at moving to the snap before but last I heard there's no way to import your current profile? And netflix doesn't work? If those two things are fixed I'd happily change over!
      • kd913 7y ago
        Netflix for me works fine. You just need to tick the 'Play DRM content' setting. My personal reason to use the snap is because it limits access to the home directory. So I can disconnect my home directory, camera and microphone and have a second layer of confidence that my browser won't leak any personal data. That and it avoids Firefox leaking config files in my home directory. If I want to upload a file, I simply move the file into a Downloads folder in it's SNAP home directory. This way, Im in control of what the browser can access.
      • mdaniel 7y ago
        For the former, I would imagine `rsync -Pav $whatever_old_ff_profile/ $HOME/snap/firefox/whatever/` would do that, since AFAIK snaps store user-specific persistent state outside of privileged directories The alternative, and likely why no one has applied a great deal of pressure to that workflow, is to use the Firefox Sync account they've been pushing so hard
      • simosx 7y ago
        By default, a snap package cannot touch your dot directories in your $HOME. That is good for your security. You would need to copy once (or `rsync`) from `~/.mozilla/firefox/` to `~/snap/firefox/current/.mozilla/firefox/`.
  • zcid 7y ago
    It should be available pretty soon. Void has already released the new version and they're a very small group.
  • kikoreis 7y ago
    Updates have been out for a while now for both snaps and debs; here's the USN: https://lists.ubuntu.com/archives/ubuntu-security-announce/2019-June/004966.html https://lists.ubuntu.com/archives/ubuntu-security-announce/2...
• beezle 7y ago
  Really unhappy with Mozilla. Does this effect all versions of Firefox? Quantum only? The bug report itself is not viewable publicly either.
  • amaccuish 7y ago
    True they could have been clearer on the versions affected, but tbh you should keep with the latest supported anyway. Security bug reports are often restricted for some time after a new release to help prevent reverse engineering to find the bug.
    • beezle 7y ago
      Please do not assume people are not running current release just because they are lazy and have not upgraded. The user experience was degraded at FF57 for many individuals who need extensions that will not work with ff>56 or that developers have abandoned out of frustration with Mozilla. When all the extensions I find necessary are functional (or with suitable replacements) I will switch.
      • amaccuish 7y ago
        Well you are running an unsupported version, so Mozilla doesn't have to concern themselves with backports. If you still want to use your extensions AND receive browser updates, you should move to a different browser (maybe waterfox?)
      • tonny747 7y ago
        I would be more concerned about all the other vulnerabilities in FF56 then just this one. https://www.cvedetails.com/vulnerability-list.php?vendor_id=452&product_id=3264&version_id=247526&page=1&hasexp=0&opdos=0&opec=0&opov=0&opcsrf=0&opgpriv=0&opsqli=0&opxss=0&opdirt=0&opmemc=0&ophttprs=0&opbyp=0&opfileinc=0&opginf=0&cvssscoremin=0&cvssscoremax=0&year=0&month=0&cweid=0&order=3&trc=129&sha=28863b172d3049516253c74838fd83a11a5a61fe https://www.cvedetails.com/vulnerability-list.php?vendor_id=...
      • Zardoz84 7y ago
• cozzyd 7y ago
  Let's see how long it takes Fedora to deploy an update...
  • viraptor 7y ago
    Being built already: https://koji.fedoraproject.org/koji/buildinfo?buildID=1289780 https://koji.fedoraproject.org/koji/buildinfo?buildID=128978...
    • metta2uall 7y ago
      I'm grateful to QubesOS for being able to easily browse in a disposable VM whilst waiting for the build. Even without QubesOS starting a disposable VM manually is probably worth the effort..
  • AdmiralAsshat 7y ago
    It's easy to get mad at Fedora when we don't have the latest-greatest at the time the announcement drops. But they hold the packages so that they can do additional QA beyond what Mozilla has already done and protect their users. I'm sometimes disappointed, but after seeing some of the bugs they've caught during the Fedora-specific testing/QA builds, I can understand why they do it.
    • jamesgeck0 7y ago
      Delaying zero-day security patches for any length of time doesn't protect users.
      • AdmiralAsshat 7y ago
        I don't like dealing in absolutes. There are valid reasons to hold a security patch for some period of time if the cure is worse than the poison. See, for example, some of the early Spectre/Meltdown mitigations that caused a 20% performance hit.
  • lunchables 7y ago
• ademup 7y ago
  "A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw." I'm at a loss imagining how this might work, can anyone expound on this? How might this actually occur?
  • dang 7y ago
    This quote is from https://www.mozilla.org/en-US/security/advisories/mfsa2019-18/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-1.... We merged that thread (https://news.ycombinator.com/item?id=20220804 https://news.ycombinator.com/item?id=20220804) into this one.
    • deleted 7y ago
      [deleted]
    • akerro 7y ago
      > You are not authorized to access bug 1544386. To see this bug, you must first log in to an account with the appropriate permissions.
  • TazeTSchnitzel 7y ago
    One possibility would be that Array.prototype.prop incorrectly assumes `this` is an Array.
  • verroq 7y ago
    One of the most obvious attacks is if two different typed objects have similar memory layouts you can use it to read/write fields. Say you had class A and class B and they are confused with each other. Suppose they have the following layout: struct A { int x void *f() } struct B { int x int y int z } Then if you have a class A and you make the program think it's actually class B. You can imagine that if you control an object B you can update the fields x, y of a object B. Once this is prepared you can then use the object as type A and then run some code to trigger the call to A.f() Obviously this is a trivial example but with depending on the vulnerability you can perhaps use it call protected functions and all kinds of memory corruption. Attacks on JavaScript arrays tend to edit the 'size' field and change it to a really really large number, thus by simply indexing the array you can have unrestricted read/write access to a large section of memory.
• deleted 7y ago
  [deleted]
• AnaniasAnanas 7y ago
  https://bugzilla.mozilla.org/show_bug.cgi?id=1544386 https://bugzilla.mozilla.org/show_bug.cgi?id=1544386 I find it really gross that they do not allow others to access it. This behavior damages the forks.
  • auscompgeek 7y ago
    The source code for the fix is public. Presumably the bug report includes working exploit code. I don't see how this is "damaging" for forks.
    • AnaniasAnanas 7y ago
      It is important to also understand what causes the issue, how it was exploited, etc. Plus I am pretty sure that they had the bug report before the fix was released.
      • lifthrasiir 7y ago
        Are there any fork that modifies Firefox so thoroughly that one needs a context to patch SpiderMonkey?
  • icebraining 7y ago
    Mozilla can still give access for the developers of forks without opening it to the public before they (and the forks!) have managed to rollout a full update.
    • AnaniasAnanas 7y ago
      Anyone can run a fork though, I right now might be running my personal fork. This is part of the point of free software. Plus, you assume that the select few developers that are given the exploit information are trustworthy. The exploit being public from the first day is better than if even a single developer is untrustworthy or compromised.
      • 7y ago
• CryptoBard 7y ago
  Someone I know was hit by this in a very targeted attack on June 6th. They managed to capture the binary it dropped on their mac with some other gatekeeper bypass vulnerability (perhaps https://www.bleepingcomputer.com/news/security/new-unpatched-macos-gatekeeper-bypass-published-online/ https://www.bleepingcomputer.com/news/security/new-unpatched...). It is a mac port of the binary discussed in this research paper by Exatel: https://exatel.pl/advisory/paranoicy-raport-socexatel.pdf https://exatel.pl/advisory/paranoicy-raport-socexatel.pdf
  • sterlind 7y ago
    Sounds extremely targeted, if an attacker is porting the attack to Macs (presumably a lot of work), and combining it with other loaders... I wonder how long this 0-day was in the wild. Your friend should probably be browsing as a non-admin in a continuously-reimaged VM, separate from an air-gapped machine, if you have those kinds of attackers after you. Spooky..
    • admax88q 7y ago
      What about that makes it sound targeted? Seems like standard vulnerabilities chained together, nothing specific to the "target"
    • FDSGSG 7y ago
      > presumably a lot of work How come?
    • fabianhjr 7y ago
      Just jail outside facing processes like firefox. (BSD Jails, Firejail in Linux and probably another solution on Mac)
    • kchr 7y ago
      Just speculation, but "targeting" in this case may be as trivial as checking the user agent header, or other "device recognition" tricks common in web development nowadays. I am sure there are hundreds of libraries that do this for you...
    • 7y ago
• factismo 7y ago
  It's a JIT bug, you can see the fix here: https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2a2a7859b10508b6f05e99780c5e2dc68 https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2...
  • pdkl95 7y ago
    Assuming this[1] test for sparse indexes with extra properties in the unfixed version of the file as part of the bugged code, the annotations suggest that the bug MIGHT have been (partially?) introduced by this[2] changeset. If so, that means all versions of Firefox >= 38.0a1 (21 Apr 2015) might be vulnerable to the bug. If the bug is really that old, it's certainly possible it might have been abused in the wild, perhaps in more ways than the just the "targeted attacks" mentioned the report. [1] https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2a2a7859b10508b6f05e99780c5e2dc68#l1.62 https://hg.mozilla.org/releases/mozilla-release/rev/99a829d2... [2] https://hg.mozilla.org/releases/mozilla-release/rev/6bfcb81d3716bfcdcd0045d0fb80153159513a83 https://hg.mozilla.org/releases/mozilla-release/rev/6bfcb81d...
  • fiveoak 7y ago
    "This simplifies the code a bit because ElementAccessHasExtraIndexedProperty checks for length-overflow and sparse-indexes so the callers don't have to do that anymore." simple code best code, the less opportunity you give people to shoot themselves in the foot the better
• deleted 7y ago
  [deleted]
  • deleted 7y ago
    [deleted]
• ga-vu 7y ago
  This seems like an ideal vulnerability for exploits kits, to be honest. Crash and run code to drop malware on a system.
• snaky 7y ago
  The last Nightly Firefox build for Android to date is 68.0.a1 from 2019-05-04. https://www.mozilla.org/en-US/firefox/android/nightly/all/ https://www.mozilla.org/en-US/firefox/android/nightly/all/ Does it contain the fix?
  • gruez 7y ago
    Looks like nightly builds aren't being published. Even if you browse the directories manually, they're not there[1]. On google play[2] it's showing as updated, though. [1] https://download-installer.cdn.mozilla.net/pub/mobile/nightly/2019/06/ https://download-installer.cdn.mozilla.net/pub/mobile/nightl... although the ESR builds are coming in fine, so maybe something broke the build script? [2] https://play.google.com/store/apps/details?id=org.mozilla.fennec_aurora https://play.google.com/store/apps/details?id=org.mozilla.fe...
    • snaky 7y ago
      While official ESR FAQ say there's no ESR for Android ever. > Is Mozilla Firefox ESR available for Android and iOS? > No. Firefox ESR will only be offered for Windows, macOS and Linux for desktop computers. Play Store is confusing, because the actual version is "depends on your device".
      • robotbikes 7y ago
        F-droid has a program called Firefox Updater which downloads the latest apk from Mozilla directly.
  • sp332 7y ago
    I asked on twitter and they said nightly was not affected. https://mobile.twitter.com/FirefoxNightly/status/1141112052389306368 https://mobile.twitter.com/FirefoxNightly/status/11411120523...
    • snaky 7y ago
      That's kind of strange, especially considering the fact Nightly Android and Nightly Desktop are different versions.
• thesorrow 7y ago
  How to know if you have been infected ?
  • user17843 7y ago
    it looks like it specifically targets cryptocurrency owners. If one has critical personal data on a computer and use it to casually browse the web, one should probably rethink that approach and use different physical devices for different purposes.
• est31 7y ago
  Firefox is supposed to have sandboxing, right? Does this sandboxing help against such attacks? As in: is there a second attack on the sandbox needed to get RCE?
  • lorenzhs 7y ago
    From the article: "Following a request for additional details from ZDNet, Groß said "the bug can be exploited for RCE [remote code execution] but would then need a separate sandbox escape" in order to run code on an underlying operating system."
  • mises 7y ago
    Some one mentioned this is being used against crypto owners; get in and perhaps read session cookies for a web wallet? Or combine with another zero-day. Any one with this has serious resources and probably a good team.
  • est31 7y ago
    Replying to myself: the sandbox escape got fixed in 67.0.4: https://www.mozilla.org/en-US/security/advisories/mfsa2019-19/ https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...
• im3w1l 7y ago
  Took me a good while to find out how to check my version and update, as that functionality has moved around in the UI.
  • moontear 7y ago
    The quickest way is and always was Help > About Firefox
  • wlesieutre 7y ago
    If anybody else is hunting for this: Hamburger menu -> Help -> About Firefox Your version number is listed under the big heading, and if there’s an update available there should be a button next to that. My question, I'm on beta channel and updated to 68.0b11 today and don't see detailed release notes. 67.0.3 (normal channel) lists "Security fix" https://www.mozilla.org/en-US/firefox/67.0.3/releasenotes/ https://www.mozilla.org/en-US/firefox/67.0.3/releasenotes/ But beta channel only says 68.0beta released May 22nd, no info on newer beta versions. This is the link in the about box: https://www.mozilla.org/en-US/firefox/68.0beta/releasenotes/ https://www.mozilla.org/en-US/firefox/68.0beta/releasenotes/ I totally get not wanting to write fine grained release notes on every single beta version, but 0-day fixed feel the kind of thing that ought to be explicitly pointed out. I'm assuming that the same fix from release channel was also pushed in the 68.0b11 update but a release note about that would be swell.
    • the_jeremy 7y ago
      On mac, it's Firefox menu -> About Firefox, then wait for it to download the update and click restart
  • fencepost 7y ago
    Can't really test from my phone, but isn't pressing and releasing the Alt key still a shortcut for displaying a menu bar if one exists?
    • ygjb 7y ago
      Yes, on Windows.
• user17843 7y ago
  How useful is blocking third party scripts and frames against this?