[Resolved] Vulnerability in Firefox 3.5.1 Still bug with JavaScript
A few days ago, Firefox released version 3.5.1 to fix a JavaScript issue that could execute code without user action and potentially lose data in memory. The flaw arose in TraceMonkey, the new JavaScript engine introduced in version 3.5.
SANS Internet Storm Center has now reported a remaining flaw in Firefox 3.5.1’s Just-in-Time (JIT) compiler that could allow arbitrary code execution through a buffer overflow, triggered by sending a long Unicode string with JavaScript’s document.write.
As a temporary precaution, disable all JavaScript or use the NoScript add-on, since no solution is available yet.
To disable JavaScript, enter about:config in the URL bar, find javascript.options.jit.content, and set it to false.
Update 21/07/2009
Firefox has since stated that Firefox 3.5.1 does not allow unauthorized script execution, and has contacted the National Vulnerability Database report to correct the security information: this issue does not affect security.
Mozilla’s details for Windows users:
On Windows, Firefox 3.0.x and Firefox 3.5.x are terminated due to an uncaught exception during an attempt to allocate a very large string buffer; this termination is safe and immediate, and does not permit the execution of attacker code.
Mozilla’s details for Macintosh users:
On the Macintosh in Firefox 3.0.x and 3.5.x, a crash occurs inside the ATSUI system library (part of OS X), due to what appears to be a failure to check allocation results. This issue is likely to affect any application using the recommended text-handling libraries on OS X. We have reported this issue to Apple, but in the event that they do not provide a fix we will look to implement mitigations in Mozilla code. We recommend that other developers who use these libraries consider a similar practice, and we have added mitigations in the past for similar bugs in these libraries.
Mozilla’s details for Linux users:
On Linux, the problem is similar to that on Mac: there is an abort in system libraries (pango, glib, libc). Due to the wide variation of Linux libraries and versions deployed, and different compilation options chosen by Linux distributors for Firefox, the details of the crash report may vary between machines.
