Echo Research and Development Center

Home · Echo.or.id · Ezine · FAQ · Discussion Forum · Photo Gallery · Contact Us · Advisories · Event · Mailing List

Sunday, August 01, 2010

Navigation

Home

Todays Events

News Categories

Advisories

Hardware

Journal

Network

Echo News

Security

Software

Public Poll

Friendly Links

+ Aikmel.or.id
+ id-ubuntu
+ udaramaya.com
+ kecoak-elektronik
+ newhack.org
+ Opensource.id
+ Jasakom.com
+ Konsultan Linux
+ w[X]f project
+ klik-kanan.com
+ hyem.org
+ ilmuwebsite.com
+ y3dips blogs

Security Links

+ Phrack Magazine
+ The hacker`s choice
+ TESO team archive
+ Phenoelit
+ WarAxe
+ milw0rm
+ Insecure
+ Planet Web Security
+ Metasploit framework
+ Uninformed journal
+ Security tools
+ PacketStorm Security
+ Hack in the Box
+ DefCon

Users Online

Guests Online: 4
No Members Online

Registered Members: 7

Newest Member: K-159

Echo Badges

IRC Channel

Join our IRC channel at irc.dal.net/e-c-h-o

[ECHO_ADV_110$2009] Firefox (GNU/Linux version) <= 3.0.10 Denial Of Services

--------------------------------------------------------------------
[ECHO_ADV_110$2009] Firefox (GNU/Linux version) <= 3.0.10 Denial Of Services
--------------------------------------------------------------------------------

Author : Ahmad Muammar W.K (a.k.a) y3dips
Date Found : June, 4th 2009
Location : Indonesia, Jakarta
web : http://e-rdc.org/v1/news.php?readmore=137
Critical Lvl : Moderated
Impact : Browser will automatically shutdown
Where : From Remote
Disclosure Policy: Full Disclosure Policy (RFPolicy) v2.0
http://www.wiretrip.net/rfp/policy.html
--------------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Firefox is a popular Internet browser from the Mozilla Corporation.

Application : Firefox for GNU/linux
version : Firefox/3.0.10 (X11; Linux i686; U; en)
Also affected for lower version (tested for version 3.0.8 at
Ubuntu 9.0.4)

URL : http://firefox.com
Bugzilla entry : https://bugzilla.mozilla.org/show_bug.cgi?id=496265

Description :

Firefox 3.0.10 (previous version) for GNU/Linux Operating systems are unable to
handle GIF images when it becomes a body backgrounds.

--------------------------------------------------------------------------------

Exploit Code:
~~~~~~~~~~~~~~~~
live exploit :

http://y3dips.echo.or.id/tempe/ff310expl/

--------------------------------------------------------------------------------

Timeline:
~~~~~~~~~

- 20 - 05 - 2009 bug found
- 04 - 06 - 2009 vendor contacted and adding entry to bugzilla
- 04 - 06 - 2009 vendor response, and there`s a potential patch
- 09 - 06 - 2009 advisory release

--------------------------------------------------------------------------------
Shoutz:
~~~~~~~

~ my family (ana my wife and ali my son)

~ the_day, K-159, negative, hero, az001, rey, and also all echo staff
~ janex vind "waraxe", str0ke, chopstick
~ newbie_hacker[at]yahoogroups.com
~ #e-c-h-o @irc.dal.net

--------------------------------------------------------------------------------
Contact:
~~~~~~~~

y3dips || echo|staff || y3dips[at]echo[dot]or[dot]id
Homepage: http://y3dips.echo.or.id/

-------------------------------- [ EOF ] ---------------------------------------

Staff Login

Top 10 News

POLTEK TELKOM's Seminar & Hacking Competition	34367
ECHO Gathering - Hack In The Zoo 3	29252
CTF Online ECHO 2010	28925
RIPS : A static source code analyser for vulnerabilty in PHP	26861
HITZ3:Laporan dari Ragunan	19564
Gathering Echo-erz di Bekasi	14352
Kelompok Defacer "PakBugs" di tangkap	14214
Nikto 2.1.2 Telah di Rilis	11770
Bug Hunter ajari Apple tentang Bug	11381
10 Celah yang mengakibatkan web anda terkuasai	11376