Stories
Slash Boxes
Comments

SoylentNews is people

posted by janrinok on Saturday January 11 2020, @09:13PM   Printer-friendly
from the time-to-update dept.

Mozilla Patches Firefox Zero-Day Exploited in Targeted Attacks:

Updates released by Mozilla on Wednesday for its Firefox browser address a zero-day vulnerability that has been exploited in targeted attacks.

The vulnerability, tracked as CVE-2019-17026 and classified as having critical impact, has been described by Mozilla as an "IonMonkey type confusion with StoreElementHole and FallibleStoreElement." IonMonkey is the Just-in-Time (JIT) compiler for Firefox's SpiderMonkey JavaScript engine.

"Incorrect alias information in IonMonkey JIT compiler for setting array elements could lead to a type confusion," Mozilla explained in its advisory.

Mozilla says it's aware of targeted attacks exploiting this zero-day, but no other information has been made available.

A Current Activity bulletin released by the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA) says the vulnerability could allow an attacker to take control of an affected system.

The flaw has been patched with the release of Firefox 72.0.1 and Firefox ESR 68.4.1, and users have been advised to update their installations.

Also at Ars Technica


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 2) by jasassin on Saturday January 11 2020, @10:26PM (7 children)

    by jasassin (3566) <jasassin@gmail.com> on Saturday January 11 2020, @10:26PM (#942323) Homepage Journal

    What exactly do they mean targeted attacks in this context? I fail to see how this can be anything but a drive by attack.

    --
    jasassin@gmail.com GPG Key ID: 0xE6462C68A9A3DB5A
    Starting Score:    1  point
    Karma-Bonus Modifier   +1  

    Total Score:   2  
  • (Score: 1, Insightful) by Anonymous Coward on Saturday January 11 2020, @10:50PM (1 child)

    by Anonymous Coward on Saturday January 11 2020, @10:50PM (#942329)

    Targeted advertisement lets you pick who you want to have see your ads. You do the following:
    1. Start an ad campaign with innocuous looking advertisement that includes stuff being pulled from one of your own servers
    2. Get the campaign approved by GOOG or FB or whomever (*)
    3. Flip the innocuous advertisement for an exploit.
    4. PROFIT!

    Ever heard of Google CustomerMatch? Search for it (here you go, you're welcome [duckduckgo.com]) and feel creeped out: it even lets you target whom you want to serve your ads to by e-mail address. E-MAIL address... let that sink in... not gmail, E-mail!

    (*) There's so many middle-men that in the end, it can't be traced down anymore...

    • (Score: 0) by Anonymous Coward on Saturday January 11 2020, @10:57PM

      by Anonymous Coward on Saturday January 11 2020, @10:57PM (#942330)

      Demonstrated once again: targeted advertisement is a scourge and it must be removed from society. There is nothing good that comes from it!

  • (Score: 0) by Anonymous Coward on Saturday January 11 2020, @11:15PM (4 children)

    by Anonymous Coward on Saturday January 11 2020, @11:15PM (#942335)

    I think it's an in-memory attack. I had a safesearch interstitial page show up on a windows machine at work the other day, safesearch is a known hijacker. The first time I thought I'd simply followed a broken forum link and the second time I realized something was wrong and my adblocker had stopped working. I disabled and reenabled the adblocker, closed and restarted firefox (which had updated) and no problem. I'm guessing it was a drive-by delivered via a scummy advertiser on a legit news site, but Bugzilla is censored so I can't confirm any of this.

    • (Score: 0) by Anonymous Coward on Sunday January 12 2020, @12:36AM (3 children)

      by Anonymous Coward on Sunday January 12 2020, @12:36AM (#942353)

      Exactly why I run my browser in a disposable VM that gets relaunched every morning. If Mozilla reallocated 10% of their diversity budget on security engineers we wouldn't have these problems.

      • (Score: 1, Interesting) by Anonymous Coward on Sunday January 12 2020, @01:45AM (2 children)

        by Anonymous Coward on Sunday January 12 2020, @01:45AM (#942369)

        Browser?

        Because I've been having a talk with outside developers for a couple of years, but nobody is willing to invest in properly forking Mozilla, either financially or developmentally without enough community support and commitment to make it worthwhile.

        If enough people were interested, I have a rough draft laid out for doing staged updates of Firefox and Seamonkey, dating from the last Win9x, 2k, XP, and ESR52 versions and doing security bugfixes, nss, and nspr backports to provide secure browser versions for all eras of hardware platforms and operating system versions so we can finally bring everyone into the 21st century, even if their platform is from the 20th.

        One of the side effects of doing it this way would be the opportunity to find and plug a lot of the major memory leaks that have plagued Mozilla for decades by looking for them while the codebase was much smaller, then using those discoveries to develop automated methodologies to look for the kinds of common programming flaws and developer names leading to these leaks, in order to patch, reorganize, or revert changes made by those developers or flawed development methodologies.

        One all of this is complete and both html 4 and html 5 support are verfied complete as well as privacy conscious, we can move on to new developments or html features added in the years since. But this requires both money and development mindshare, even if it's just a show us this feature and we'll show you the money kind of agreement.

        As far as the Mozilla Foundation, not unlike the Wikipedia Foundation or The Red Cross, are more about lining their executives pockets than actually meeting with their stated non-profit or not-for-profit charters.

        • (Score: 1, Interesting) by Anonymous Coward on Sunday January 12 2020, @02:21AM

          by Anonymous Coward on Sunday January 12 2020, @02:21AM (#942383)

          And what would keep your foundation from existing to line your pockets?

          I only use browser software where the developer's interests are clearly aligned with the users, so it's Lynx for me.

        • (Score: 0) by Anonymous Coward on Monday January 13 2020, @02:02AM

          by Anonymous Coward on Monday January 13 2020, @02:02AM (#942610)
          but only if it didn't run javascript until it could do so 100% safely.

          .

          So if that was never I'd be ok with it.

          .

          Start your project and attract volunteers before you go looking for major support. I'll join.