Gentoo Forums
Gentoo Forums
Gentoo Forums
Quick Search: in
FF 17 vulnerability
View unanswered posts
View posts from last 24 hours

 
Reply to topic    Gentoo Forums Forum Index Networking & Security
View previous topic :: View next topic  
Author Message
wolfieh
n00b
n00b


Joined: 17 Nov 2009
Posts: 52

PostPosted: Sun Aug 04, 2013 11:48 pm    Post subject: FF 17 vulnerability Reply with quote

There was a recent Tor attack that used a Firefox 17 0day (current stable in gentoo). Someone should do a version bump on it.

http://www.twitlonger.com/show/n_1rlo0uu
Back to top
View user's profile Send private message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 6657
Location: almost Mile High in the USA

PostPosted: Mon Aug 05, 2013 12:28 am    Post subject: Reply with quote

Ouch, probably should put a high priority bugs.gentoo.org security bug. Not good.

The only saving grace (which is NOT security) is that it appears to be targeting Windows... But don't breathe easy because of it, it's easy enough to change it to Linux.
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
broken_chaos
Guru
Guru


Joined: 18 Jan 2006
Posts: 370
Location: Ontario, Canada

PostPosted: Mon Aug 05, 2013 5:02 am    Post subject: Reply with quote

According to the bug reports filed over at Mozilla, this is already fixed in 17.0.7esr. The Tor Browser Bundle people just didn't update their released version (edit: or, if they did, they broke the fix, or many of their users failed to update). Long story short, when a security update is released, people who rebundle and make use of the code/program in some capacity should probably apply the update ASAP themselves.

https://bugzilla.mozilla.org/show_bug.cgi?id=901365#c23 (the Tor-specific bug report) and http://www.mozilla.org/security/announce/2013/mfsa2013-53.html (the probable security advisory which related to the exploit).

(This also means that anyone who keeps Gentoo up to date is immune. 17.0.7 is in stable and has been for some time.)
Back to top
View user's profile Send private message
eccerr0r
Watchman
Watchman


Joined: 01 Jul 2004
Posts: 6657
Location: almost Mile High in the USA

PostPosted: Mon Aug 05, 2013 1:27 pm    Post subject: Reply with quote

Ah so this is not a true 0 day as it appears the discoverer mentioned it didn't work on latest or something like that... Untested against 17.0.7 which is fine, so I guess things are hunky dory. It is weird that 17.0.7 has been released for quite a while and they didn't grab it. Oh well.

17.0.7 is timestamped at the end of June in portage so most people should have it by now.
_________________
Intel Core i7 2700K@ 4.1GHz/HD3000 graphics/8GB DDR3/180GB SSD
What am I supposed watching?
Back to top
View user's profile Send private message
broken_chaos
Guru
Guru


Joined: 18 Jan 2006
Posts: 370
Location: Ontario, Canada

PostPosted: Mon Aug 05, 2013 6:36 pm    Post subject: Reply with quote

eccerr0r wrote:
It is weird that 17.0.7 has been released for quite a while and they didn't grab it.

I looked into it and apparently there was a 17.0.7-based TBB released late June. Either they didn't implement the fix properly or, more likely, many of their users just weren't very diligent at updating.
Back to top
View user's profile Send private message
Display posts from previous:   
Reply to topic    Gentoo Forums Forum Index Networking & Security All times are GMT
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum