Read Up, Firefox Lovers

• ShutterBug

  9 Dec 05, 06:09

  
  Exploit code for the latest version of open-source browser Firefox was published Wednesday, potentially putting users at risk of a denial-of-service attack.
  
  The exploit code takes advantage of a bug in the recently released Firefox 1.5, running on Windows XP with Service Pack 2. Firefox, which initially debuted over a year ago, has moved swiftly to capture 8 percent of the browser market.
  
  The latest Firefox flaw exists in the history.dat file, which stores information from Web sites users have visited with the Firefox 1.5 browser, according to a posting on the Internet Storm Center, which monitors online threats.
  
  "If the topic of a page is crafted to be long enough, it will crash the browser each time it is started after going to such a page," according to the Internet Storm Center posting. "Once this happens, Firefox will be unable to be started until you erase the history.dat file manually."
  
  In testing Firefox 1.5 without a system running McAfee security software, the Firefox 1.5 browser would stall and not respond to a user's mouse, said Johannes Ullrich, chief research officer for the Sans Institute, which runs the Internet Storm Center.
  
  "Users have to kill out of the browser and start over again. This stalled browser creates a DOS (denial of service) condition," Ullrich said.
  
  Packet Storm, the security group that initially published the proof-of-concept exploit code, noted that in addition to the potential denial-of-service attack that could follow a buffer overflow, systems may also be subject to a malicious execution of code.
  
  Ullrich, however, said while the potential may exist, it has not been proven either way that malicious code could be executed.
  
  Mozilla Foundation, which released Firefox, said it was not able to confirm the browser would crash or be at risk of a DOS attack, after visiting certain Web sites. And Mozilla has not received any reports from users of such a problem, said Mike Schroepfer, vice president of engineering for Mozilla Corp.
  
  He added that Firefox 1.5 can be slugglish on its next start-up, due to a bug in the history.dat, but it is not a security problem.
  
  "We have gotten no independent verification that it crashes (Firefox), but there have been a lot of attempts to try," Schroepfer said.
  
  
• Mr Fugue

  9 Dec 05, 09:29

  hengz, I dun use FF~!!
• ndmmxiaomayi

  9 Dec 05, 09:39

  I don't keep history files, cache cleared every time firefox closes..........
  
  heng.....
• ceecookie

  9 Dec 05, 09:40

  Originally posted by ndmmxiaomayi:

  I don't keep history files, cache cleared every time firefox closes..........
  
  heng.....

  i do it manually to prevent ppl tracking where i go....+1
• stellazio

  9 Dec 05, 09:41

  woah i got history files leh,but cache always cleared..
• rainee

  9 Dec 05, 10:01

  use opera...it is the best
• The man who was death

  9 Dec 05, 10:28

  I dun use the latest version of FF
• HafizulKMS

  9 Dec 05, 10:40

  OMFG, that's sucks, thought FireFox will be 100% safe.
• hisoka

  9 Dec 05, 11:04

  my version is 1.07 leh................ 1.5 is what har? am i like super out of date?
• ndmmxiaomayi

  9 Dec 05, 11:08

  Originally posted by hisoka:

  my version is 1.07 leh................ 1.5 is what har? am i like super out of date?

  1.5 just released. You are still not out of date, although I believe most firefox users have already switched to 1.5.
• meltz

  9 Dec 05, 11:08

  i stil uisng verion 1.04
  
  nvn bother to update ..
• seow

  9 Dec 05, 11:13

  I'm using mozilla.
• hisoka

  9 Dec 05, 11:14

  Originally posted by meltz:

  i stil uisng verion 1.04
  
  nvn bother to update ..

  same here i also never update
• sohguanh

  9 Dec 05, 13:09

  If you all have been developing software for a while then you will know that in this field there is always security lapse and bugs fixes. This is part and parcel of software development life cycle.
  
  The fact that if a old software is used for many years without problem does not indicate it is perfect. It just runs fine with most typical scenarios. Once you are into developing software you will know what I mean.
  
  So be it FF or IE, as long as it is software, there will be bugs and security lapse. The debate is more on how frequent it is faulty or leaky or buggy among competitive products reported by users
• DriftingGuy

  9 Dec 05, 17:17

  
  ver 1.07 si boh?
• bismarck

  9 Dec 05, 17:20

  i am still using 1.03
• digicharat

  9 Dec 05, 17:37

  im still using version 1.0 leh....
  im the most out of date...
• launtpc

  9 Dec 05, 18:22

  See? See? Dun use Firefox. Use Opera.
• Shotgun

  9 Dec 05, 18:53

  As long as u are using windows, dun matter if u use firefox or IE, or netscape, u will still be vulnerable to exploits.
  
  Switch to linux ppls...
  ITS FREE
• chanff8

  9 Dec 05, 22:14

  Originally posted by HafizulKMS:

  OMFG, that's sucks, thought FireFox will be 100% safe.

  yr so wrong... NO software can be 100% safe. Unless yr disconnected from the internet and dun use ANY external devices
• oldbreadstinks

  10 Dec 05, 00:56

  mine's version 0.8.......
• launtpc

  10 Dec 05, 10:51

  What the exploit does is that it fills the Firefox window's titlebar with 2.5 million "A"s (AAAAAAAAA... so on)
  
  It will increase the history size to dramatically that Firefox hangs and crashes evertime you start it up.
  
  Only cure? Delete history manually.
• FadeToBlack

  10 Dec 05, 12:09

  I USE INTERNET EXLPORER LMFAO!
• chanff8

  10 Dec 05, 12:42

  Originally posted by FadeToBlack:

  I USE INTERNET EXLPORER LMFAO!

  ROFLMFAO! Internet Explorer is worse than Firefox in terms of security
• SBS9828X

  30 Dec 05, 23:31

  got opera link? i dun want chinese opera, i want Opera web explorer 1 hor