Web Dev Ireland

I posted about this on boards.ie but thought I should put this up here too for all you firefox users.

Simple yet very effective buffer overflow bug vunerability found in FF 1.0.6(probably all 1.0.x) releases and Beta 1.5.

originally posted here

Technical Details:
The problem seems to be when a hostname which has all dashes causes the NormalizeIDN
call in nsStandardURL::BuildNormalizedSpec to return true, but is sets encHost to an
empty string. Meaning, Firefox appends 0 to approxLen and then appends the long
string of dashes to the buffer instead. The following HTML code below will reproduce
this issue:

A HREF=https:———————————————

I’m assuming that this is already being exploited since it would take all of 10 seconds to post a URL somewhere.

Mozilla have a fix/workaround

This entry was posted on Thursday, September 15th, 2005 at 4:23 pm and is filed under Technical, The Internet. You can follow any responses to this entry through the RSS 2.0 feed. You can skip to the end and leave a response. Pinging is currently not allowed.