关键字:Firefox flaw 漏洞
安全研究专家Tom Ferris星期四稍微接受即时通讯（Instannt messaging）采访时，称Firefox在处理包含破折号的超长网络连接地址时，存在漏洞，导致安全问题出现。
他在Full Disclosure安全邮件列表中及自己的Security Protocols（安全协议）网站里均刊登了安全告示，并附上了概念证明（proof of concept）相关信息。
本月初，微软将发现Windows里面RDP（Remote Desktop Protocol，远程桌面协议）中安全漏洞的功劳记在Ferris名下。这个漏洞使得攻击者可以远程重新启动Windows系统。
September 9, 2005
Joris Evers,Staff Writer, CNET News.com
A new, unpatched flaw in that affects all versions of Firefox could let attackers surreptitiously run malicious code on users’ PCs, a security researcher has warned.
The problem lies in the way Firefox handles Web links that are overly long and contain dashes, security researcher Tom Ferris said in an interview via instant messaging late Thursday.
He posted an advisory and a proof of concept to the Full Disclosure security mailing list and to his Security Protocols Web site.
The security vulnerability is a buffer overflow flaw that “allows for an attacker to remotely execute arbitrary code” on a vulnerable PC, Ferris said. An attacker could host a Web site containing the malicious code to exploit the flaw, he said. Though his proof of concept only crashes Firefox, Ferris claims he has been able to tweak it to run code.
Buffer overflows are a commonly exploited security problem. They occur when a program allows data to be written beyond the allocated end of a buffer in memory. A computer can be made to execute potentially malicious code by feeding in extra data that is designed to flood the buffer.
Ferris reported the bug to the Mozilla Foundation on Sunday, intending to go through the organization’s bug-reporting process, he said. However, in an example of the uneasy alliance between security researchers and software makers, he decided to publicly disclose the flaw after a run-in with Mozilla staff, he said.
Mozilla, which coordinates development of Firefox and distributes the software, could not immediately comment on the flaw disclosure. However, a source close to the organization confirmed that Ferris had filed several bug reports, including this specific one.
Since the debut of Firefox 1.0 in November, usage of the open-source browser has grown. Security has been a main selling point for Firefox over Microsoft’s Internet Explorer, which has begun to see its market share dip slightly–for the first time in years.
However, Firefox has had its own security woes. Several serious holes in the browser have been plugged since its official release, and experts have said that safe Web browsers don’t exist.
The public bug disclosure comes just as Mozilla released the first beta of Firefox 1.5. The final release of the next Firefox update, which includes security enhancements, is due by year’s end, according to the Firefox road map.
Ferris has found bugs in Microsoft software before, including a yet-unpatched flaw in Internet Explorer that Microsoft still has under investigation.
Earlier this month Microsoft credited Ferris with reporting a bug in a Windows feature called Remote Desktop Protocol that could allow an attacker to remotely restart Windows systems.