Stopgap Fix for Critical Firefox 3.5 Security Hole

ronjor · Jul 14, 2009

Instructions showing hackers how to exploit an unpatched, critical security hole in Mozilla's new Firefox 3.5 Web browser have been posted online. So, until Mozilla can ship an update to quash this bug, Security Fix is posting instructions to help readers protect themselves from this vulnerability.
Click to expand...

Brian Krebs

Rmus · Jul 14, 2009

Other References

Critical JavaScript vulnerability in Firefox 3.5
http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability-in-firefox-35/

First Zero Day Exploit for Firefox 3.5
http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/news/113761

PoC code exploiting the vulnerability has been posted, and Javascript is indeed required:
Code:
<html>
<body>
<[B]script language= " JavaScript[/B]">
var shellcode = unescape( "....
----
rich

Joeythedude · Jul 16, 2009

Does this attempt to download an exe file ?

tlu · Jul 17, 2009

Fixed in 3.5.1 which is already available.

Log in or Sign up

Stopgap Fix for Critical Firefox 3.5 Security Hole

ronjor Global Moderator

Rmus Exploit Analyst

Joeythedude Registered Member

tlu Guest

Log in or Sign up

Stopgap Fix for Critical Firefox 3.5 Security Hole

ronjor Global Moderator

Rmus Exploit Analyst

Joeythedude Registered Member

tlu Guest

Useful Searches