Mozilla Offers Firefox Workaround

The Mozilla Foundation has released a workaround for a critical bufferoverflow vulnerability in the Firefox browser that was first madepublic early yesterday.

Mozilla developers yesterday posted a software patch and instructionsfor a workaround, both of which disable the buggy Firefox feature.Mozilla’s patch and workaround can be found online at:http://www.mozilla.org/security/idn.html.

The vulnerability, which was reported to the Mozilla team earlier thisweek, concerns the International Domain Name (IDN) feature that Mozillaproducts use to process Web pages that do not use Latin Alphabetcharacters in their names.

Links pointing to a host with a long name composed entirely of dashescan be crafted so that Firefox will execute arbitrary code of anattacker’s choosing, meaning that an attacker theoretically could usethe flaw to take control of a user’s machine.

No code that actually exploits this vulnerability has yet been seen,but all versions of Mozilla Firefox and the Mozilla Suite are affected,according to the Mozilla team.

“It’s something we take seriously because it could be used for badthings,” said Mike Schroepfer, director of engineering with the MozillaFoundation.

Because both the patch and the workaround simply disable IDN, users whorequire the feature to visit international Web sites should stick tovisiting Web sites they know and trust until the problem is actuallyrepaired in the browser, Schroepfer said.

When that will happen remains unclear. “We’re determining that now,” he said.

By Robert McMillan