Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mozilla patches Firefox zero-day abused in the wild

zdnet.com

Post reply on HN
Print view View original

41–50 of 111 posts

Re: Mozilla patches Firefox zero-day abused in the wild

#41

Post by gdfasfklshg4 »

beezle wrote: post #8
amaccuish wrote: post #5

Earlier quoted context omitted.

True they could have been clearer on the versions affected, but tbh you should keep with the latest supported anyway. Security bug reports are often restricted for some time after a new release to help prevent reverse engineering to find the bug.

Please do not assume people are not running current release just because they are lazy and have not upgraded. The user experience was degraded at FF57 for many individuals who need extensions that will not work with ff>56 or that developers have abandoned out of frustration with Mozilla. When all the extensions I find necessary are functional (or with suitable replacements) I will switch.

I get the annoyance with deprecating extensions. But seriously the main person you are harming by running vulnerable un-patched software is yourself.

EDIT: s/the only person/the main person/

Re: Mozilla patches Firefox zero-day abused in the wild

#42

Post by verroq »

ademup wrote: post #11

"A type confusion vulnerability can occur when manipulating JavaScript objects due to issues in Array.pop. This can allow for an exploitable crash. We are aware of targeted attacks in the wild abusing this flaw." I'm at a loss imagining how this might work, can anyone expound on this? How might this actually occur?

One of the most obvious attacks is if two different typed objects have similar memory layouts you can use it to read/write fields.

Say you had class A and class B and they are confused with each other.

Suppose they have the following layout:

    struct A {
        int x
        void *f()
    }

    struct B {
        int x
        int y
        int z
    }
Then if you have a class A and you make the program think it's actually class B. You can imagine that if you control an object B you can update the fields x, y of a object B. Once this is prepared you can then use the object as type A and then run some code to trigger the call to A.f()

Obviously this is a trivial example but with depending on the vulnerability you can perhaps use it call protected functions and all kinds of memory corruption.

Attacks on JavaScript arrays tend to edit the 'size' field and change it to a really really large number, thus by simply indexing the array you can have unrestricted read/write access to a large section of memory.

Re: Mozilla patches Firefox zero-day abused in the wild

#47

Post by snaky »

floatingatoll wrote: post #24
amaccuish wrote: post #5

Earlier quoted context omitted.

True they could have been clearer on the versions affected, but tbh you should keep with the latest supported anyway. Security bug reports are often restricted for some time after a new release to help prevent reverse engineering to find the bug.

Mozilla was, Zdnet was not. https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...

What about mobile versions? What about Beta, Developer, Nightly versions?

Re: Mozilla patches Firefox zero-day abused in the wild

#48

Post by campuscodi »

CryptoBard wrote: post #23

Someone I know was hit by this in a very targeted attack on June 6th. They managed to capture the binary it dropped on their mac with some other gatekeeper bypass vulnerability (perhaps https://www.bleepingcomputer.com/news/security/new-unpatched... ). It is a mac port of the binary discussed in this research paper by Exatel: https://exatel.pl/advisory/paranoicy-raport-socexatel.pdf

Additional details about the Firefox zero-day:

https://twitter.com/campuscodi/status/1141279052893999104

Re: Mozilla patches Firefox zero-day abused in the wild

#49

Post by notafrog »

snaky wrote: post #47
floatingatoll wrote: post #24

Earlier quoted context omitted.

Mozilla was, Zdnet was not. https://www.mozilla.org/en-US/security/advisories/mfsa2019-1...

What about mobile versions? What about Beta, Developer, Nightly versions?

Firefox app on my Android phone was updated yesterday to 67.0.3, and the release notes mention the security fix.

Re: Mozilla patches Firefox zero-day abused in the wild

#50

Post by ga-vu »

CryptoBard wrote: post #23

Someone I know was hit by this in a very targeted attack on June 6th. They managed to capture the binary it dropped on their mac with some other gatekeeper bypass vulnerability (perhaps https://www.bleepingcomputer.com/news/security/new-unpatched... ). It is a mac port of the binary discussed in this research paper by Exatel: https://exatel.pl/advisory/paranoicy-raport-socexatel.pdf

wow... so I've had a comment downvoted because I've pointed out the obvious "conspiracy theory" in your comment. Glad you just attributed some random hack to a Firefox zero-day with zero proof and I'm the one told to fuck off. HN... jesus christ... this site.
Post reply on HN