Echo Research and Development Center

Home · Echo.or.id · Ezine · FAQ · Discussion Forum · Photo Gallery · Contact Us · Advisories · Event · Mailing List

Tuesday, February 09, 2010

Navigation

Home

Todays Events

News Categories

Advisories

Hardware

Journal

Network

Echo News

Security

Software

Public Poll

Friendly Links

+ Aikmel.or.id
+ id-ubuntu
+ udaramaya.com
+ kecoak-elektronik
+ newhack.org
+ Opensource.id
+ Jasakom.com
+ Konsultan Linux
+ w[X]f project
+ klik-kanan.com
+ hyem.org
+ ilmuwebsite.com
+ y3dips blogs

Security Links

+ Phrack Magazine
+ The hacker`s choice
+ TESO team archive
+ Phenoelit
+ WarAxe
+ milw0rm
+ Insecure
+ Planet Web Security
+ Metasploit framework
+ Uninformed journal
+ Security tools
+ PacketStorm Security
+ Hack in the Box
+ DefCon

Users Online

Guests Online: 2
No Members Online

Registered Members: 7

Newest Member: K-159

Echo Badges

IRC Channel

Join our IRC channel at irc.dal.net/e-c-h-o

[ECHO_ADV_110$2009] Firefox (GNU/Linux version) <= 3.0.10 Denial Of Services

--------------------------------------------------------------------
[ECHO_ADV_110$2009] Firefox (GNU/Linux version) <= 3.0.10 Denial Of Services
--------------------------------------------------------------------------------

Author : Ahmad Muammar W.K (a.k.a) y3dips
Date Found : June, 4th 2009
Location : Indonesia, Jakarta
web : http://e-rdc.org/v1/news.php?readmore=137
Critical Lvl : Moderated
Impact : Browser will automatically shutdown
Where : From Remote
Disclosure Policy: Full Disclosure Policy (RFPolicy) v2.0
http://www.wiretrip.net/rfp/policy.html
--------------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Firefox is a popular Internet browser from the Mozilla Corporation.

Application : Firefox for GNU/linux
version : Firefox/3.0.10 (X11; Linux i686; U; en)
Also affected for lower version (tested for version 3.0.8 at
Ubuntu 9.0.4)

URL : http://firefox.com
Bugzilla entry : https://bugzilla.mozilla.org/show_bug.cgi?id=496265

Description :

Firefox 3.0.10 (previous version) for GNU/Linux Operating systems are unable to
handle GIF images when it becomes a body backgrounds.

--------------------------------------------------------------------------------

Exploit Code:
~~~~~~~~~~~~~~~~
live exploit :

http://y3dips.echo.or.id/tempe/ff310expl/

--------------------------------------------------------------------------------

Timeline:
~~~~~~~~~

- 20 - 05 - 2009 bug found
- 04 - 06 - 2009 vendor contacted and adding entry to bugzilla
- 04 - 06 - 2009 vendor response, and there`s a potential patch
- 09 - 06 - 2009 advisory release

--------------------------------------------------------------------------------
Shoutz:
~~~~~~~

~ my family (ana my wife and ali my son)

~ the_day, K-159, negative, hero, az001, rey, and also all echo staff
~ janex vind "waraxe", str0ke, chopstick
~ newbie_hacker[at]yahoogroups.com
~ #e-c-h-o @irc.dal.net

--------------------------------------------------------------------------------
Contact:
~~~~~~~~

y3dips || echo|staff || y3dips[at]echo[dot]or[dot]id
Homepage: http://y3dips.echo.or.id/

-------------------------------- [ EOF ] ---------------------------------------

Staff Login

Top 10 News

10 Celah yang mengakibatkan web anda terkuasai	9864
Seorang siswa membypass program filter seharga jutaan dollar	8287
Buku y3dips telah di rilis	7614
"Pernah di Tangkap", inilah Resumeku	6636
Aksi Deface massal oleh yl18.net	5695
Awas Account GMail anda melayang!	5467
STOP Aksi Deface !!!	5292
Lagi, Situs Kevin Mitnick di Deface	5292
Log; pintu lain menuju sistem.	5292
Kuasai (pwning) satu kota!	5287