655 FF bugs and 71 security leaks 

polonus · 2006-09-08T12:51:35.000Z

Hi Mikey,

This is one of these typical null pointer dereferences bugs:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046107.html

Some add-ons bring FF to its knees. Let us say that some coders aren’t trained to have these potential problems at mind, race conditions included.
Mangling of code is such a way, here with K7, analysis with dependecy walker, fuzzing etc. can bring a lot of weaknesses to light.
If you are getting the message “Some code is running”, you have to seriously start to consider to save your profile and other settings. Also using the browser without session manager plug-in is unwise.

Why didn’t they secure code with splint?, inexpensive and free: http://www.splint.org/

If you are working with a multi-threaded or otherwise asynchronous environment, ensure that proper locking APIs are used to lock before the if statement; and unlock when it has finished.

polonus

system · 2006-09-08T13:21:55.000Z

polonus post:3:

Hi Mikey,

This is one of these typical null pointer dereferences bugs:
http://lists.grok.org.uk/pipermail/full-disclosure/2006-May/046107.html

Some add-ons bring FF to its knees. Let us say that some coders aren’t trained to have these potential problems at mind, race conditions included.
Mangling of code is such a way, here with K7, analysis with dependecy walker, fuzzing etc. can bring a lot of weaknesses to light.
If you are getting the message “Some code is running”, you have to seriously start to consider to save your profile and other settings. Also using the browser without session manager plug-in is unwise.

polonus

Hmm thanks for the link, i have IE Tab installed over here too and it’s good to know how you can make it crash …
As far as session manager goes , it’s the first extension i usually install on Flock/FF

szc · 2006-09-08T14:45:20.000Z

I’m just amazed and wondering how can you people wait so long for your Firefox to fire up with all those extensions and stuff. Your Firefox must be 2 tons heavy, lol. I have never installed even one single extension for Firefox in my life, and it works perfectly without some unnecessary stuff on my computer (not saying that all extensions are waste of time, but in general). One day after all those extensions installed, it may happen that your Firefox will start up so slow that will “beat” unbelievable heavy Photoshop ;D

I personally never had any security related problems, nor even program related issues. IE6 plain as it is, and my Firefox as a backup browser (when checking my web design work) are working as a charm. I just keep them up to date and that’s it.

system · 2006-09-08T16:16:18.000Z

LOL Sasha you don’t have to have a ton of extensions installed for FF to open up slowly(slow even without them). It’s slow to boot up let’s face it(try it in linux though and tell me if you notice a difference ). A little off the topic but since you mention all those extensions i wanted to give my thoughts on all those script blocking extensions Polonus keeps recommending… I don’t have NoScript installed because it drives me insane with all that blocking(doing some stuff with javascript myself and i don’t have the time to click and click at those popups i just want to see my darn page that’s all i want). If i go to a site that has dangerous scripts which crash your browser fine just let it crash no big deal(i’m not gonna cry cause i have Session Manager ;D ) ! BTW hasn’t ever happened to me before(only when clicking on links Polonus provides hihihi ;D )! And i don’t need any adblocking extension too , infact it seems i am one of the few people that actually doesn’t mind looking at some ads now and then(the ones the built in popup blocker desn’t block). And blocking Flash? Are you crazy(if you are on dial up i understand)? Flash is one of the BEST things that could have happend to the web(and web design) !!! …

I said many times if you are worried about all those scripts and flash and who knows what else just use Lynx(it’s a real browser yeah) !!!
It’s a console web browser(yeah that ugly dos box) and it doesn’t display graphics , flash movies , no popups NOTHING! Just plain old text! And it asks you every time if you want to accept cookies.
You see where i am getting here? If you block Flash and Java, Javascript etc. you are not viewing the web page as the author meant it you’ll just be reading some text so you’re better off using a text mode browser like Lynx at least it will load faster …

BTW Sasha all those extensions i have installed are there for a reason and there isn’t a single one there that i don’t use or is unnecessary(for me at least)

Made some screenshots(lynx in action while browsing THIS forum):

http://img474.imageshack.us/img474/936/lynxle8.png

Sasha this is a screenshot of the extensions i use in Flock:

http://img486.imageshack.us/img486/5303/extensionsjp8.png

Cheers,

Mikey

DavidR · 2006-09-08T16:48:09.000Z

My firefox with 18 extensions takes 8-9 seconds to load, but I’m not in that much of a rush, it only gets loaded once per day.

As M2 said even without extensions it is still slow probably a whole 6 secs on my system, which isn’t by any means fast. I think we get a little spoilt with speed, in this instant internet age, internet pages have to load instantly, we forget what it used to be like on a 8086 CPU computer, 9600 or 14400 modems, windows 3.1, etc. so 9 seconds in the greater scheme of things doesn’t make me consider going back to IE (no thanks).

szc · 2006-09-08T16:52:34.000Z

No way, going back… I meant on going forward to IE7 ;D

system · 2006-09-08T17:21:52.000Z

Well Firefox is optimized for Linux(so i have read somewhere) but it would certainly be nice if the developers could optimize it a little more for windows too, so that it starts a little faster(it’s really blazing fast on linux) …

polonus · 2006-09-08T19:23:08.000Z

Hi M2,

How can szc state that all those extensions are making FF or Flock that heavy to fire up, some have 45 kb, the heaviest has a meagre 450 kb. No it must have something to do with the allocation table, and the uneconomical way it does its work. It has to do with the lay-out of the browser, and it has to do with coding (race conditions etc.), idle code running.
As I said in other postings they have to go through the coding with a fine comb and brush, security scanning the codes, run it through a recompiler. Give it the sec consult.
But there is a lot the coders are not to be blamed for. DLL errors, the main route to letting a browser crash, can be a version thing, one version of the DLL has another functionality, or even worse lacks some vital functionality.
An example with the Browzar crapola briwser shell weighing nothing was a MSHTML.DLL error, because you make a call to a redirect in another domain, and some versions of this Microsoft DLL cannot handle that, the shell make IE crash. Also MFC42.DLL import crashes in Browzar are heard of.
FF makes some 73 imports inside the NSPR4.DLL.
JAR50.DLL can make errors in opening NSPR4.DLL, DLC4.DLL, PLDS4.DLL & XPCOM_CORE.DLL, this leads to errors opening files, allocation errors, profile corruption things cause it.
The thing should be compiled with a huge memory model.
Extensions can have compatibility issues, not overload issues.

polonus

system · 2006-09-08T20:15:26.000Z

Mozilla already use Coverity http://gemal.dk/blog/2006/05/18/mozilla_and_coverity/ Not to blame anyone but they are probably aware of most bugs and wont go "THANKS we newer knew… " See Bugzilla. Use that instead of blog of “researcher”.

I know up to 50-60 extensions runs just fine but to keep the “original” stability/speed you really need to put more effort in installation than just click away at Add-on site. They do a poor job at informing users that it can go wrong. So is extension developed actively, what are known bugs, does it conflict with FF or other extension and so on. Most of the top 10 or so extensions have had or still have memory leaks or worse problems. Starting to get better thanks to tools like Leak Monitor http://dbaron.org/mozilla/leak-monitor/ (dont run any extension which tricker it - bad QA) but still much “crap” to install. Too bad 1.5.0.x or Flock is part of that “crap” 8) Try Gmail or any Vbulletin forum just for a start. 2.0 is big step forward I think though it might not appear to be a revolution. That is what bug-hunting is about, being done every day.

Size in kb of extension have nothing to do with memory use or how “heavy” it feels btw.

Someone at Mozillazine wrote in a forumpost that they (Mozilla) should do what his company did. Once in a while they did a version of their whatever software with zero new features - only cleanup and optimizations. Who will disagree with that when it comes to Firefox? Known problem but guess unavoidable due to the way it is made. Patchwork, many inputs from many different people etc. And of course the competition, release demand. I still believe they are on top of things and that espeically 2.0 shows it. The somewhat broken/strange new theme is a minor and probably temporary problem, engine room is more important.

polonus · 2006-09-08T21:20:06.000Z

Hi dk70,

Fully agree with you that there can be unknown compatibility problems with some extensions (MacAfee SiteAdvisor was an example recently with all the jar50.dll crashes), and how these add-ons and plug-ins work out on each other. There are also code discrepancies as well, and secure code issues (race conditions).
But I cannot understand the users of the closed software browsers, when they rather like to feel secure not knowing what insecurities they have not heard of (security through obscurity).
With FF or Flock security one is to know more or less where you/we stand. With IE7 you take a blank check on the future.

And when you know where the main vectors are to infect your computer (mainly script and Flash). When you can pre-scan links, or you have some indication of the insecurity of a possible search query hyperlink (GeoTrust, SiteAdvisor), and avast Webshield running inside, the rest of your vulnerability window that is left open is made up by the online risks you run (surfing habits/attitude).
The major problems left are made up by instability issues.
Too much of firefox -p or flock -P?
No I think honesty is the best policy, and will render best results.

polonus

szc · 2006-09-08T21:53:23.000Z

Spending so much time thinking about security deals with paranoia my friend. If users spend all their free time on the internet searching on how to lock their computers and securing themselves from who knows who (maybe Cylons), not much time will left for them to at least try to be creative and do something creative using their computers. Why not simply unplug the internet cable and problem solved ?

Now about the Flash… just because it uses ActiveX (sometimes, not always especially not if developer doesn’t want to use it), what damage can my web site possibly give to you or your computer ? Here is one of those I made: www.peepers.ca

polonus · 2006-09-08T22:06:09.000Z

Hej Sasha,

Everybody is got to do what he likes to do. You wanna be creative on the Net, others like dk70 and little old me like to delve into security issues, because it is interesting to look for solutions. You want to know why things work or not, and why? You do not have this inclination. If I can see something interesting in a nice patch.
Now in this thread dk70 mentioned mem leaks, then polonus finds that memory leaks in FF can add up to a nice total of 500 MB daily. And we have something to discuss.
That is all the Flash Sasha needs to make some nice Avatars. How many Avatars would that be, Sasha?
I know security has it limits, and that the best firewall runs through the open fireplace, and the best security tool is a pair of pliers. But then everybody is entitled to his or her hobbies, right?

pozdravi,

the old pol

szc · 2006-09-08T22:22:30.000Z

Except I could never use Flash to make avatars, simply because this forum doesn’t support Flash even though we have INSERT FLASH tag when posting in this forum. Avatars are not my priority nor hobbi, I just do that on people’s request to make them happy if possible. I use simple graphic editing tools to create avatars, everyone could do it in no minutes if I show him how… if they would look exactly the same as mine, or better or worse, that depends on individuals.

My work span spreads far more than just simple avatars. When I am really, really, really tired of the primary work I do, then I close my eyes and do some avatars to release the pressure.

system · 2006-09-08T22:27:41.000Z

hey szc and the old polonus…do you know if they are ANY themes available for flock and the google toolbar extension seems very unstable…had to uninstall it-do you know of this problem?

http://extensions.flock.com/themes/

polonus · 2006-09-08T22:40:50.000Z

Look at the other one I posted in the general about add-ons.

I made a bookmarklet with the crunchator, and copied the leak of the wrong hanging pointer from Leak Monitor here:

Leaks in window 0x33b5c08:
[+] [leaked object] (1a13348) = [object Object]
[-] wrappedJSObject (1a13348) = [object Object]
type = insert
action = newbookmark
[+] item (1a13368) = [xpconnect wrapped nsIRDFResource]
[+] 0 (198c230) = [xpconnect wrapped nsIRDFResource]
Value = rdf:#$C4hvU
[-] QueryInterface (198c340) = function QueryInterface() {
[native code]
}
[-] EqualsNode (198c348) = function EqualsNode() {
[native code]
}
ValueUTF8 = rdf:#$C4hvU
[-] Init (198c398) = function Init() {
[native code]
}
[-] EqualsString (198c3b0) = function EqualsString() {
[native code]
}
[-] GetDelegate (198c3d8) = function GetDelegate() {
[native code]
}
[-] ReleaseDelegate (198c438) = function ReleaseDelegate() {
[native code]
}
[+] parent (1a13370) = [xpconnect wrapped nsIRDFResource]
[+] 0 (1a212e0) = [xpconnect wrapped nsIRDFResource]
Value = NC:BookmarksRoot
[-] QueryInterface (198c1a8) = function QueryInterface() {
[native code]
}
[-] EqualsNode (198c1b0) = function EqualsNode() {
[native code]
}
ValueUTF8 = NC:BookmarksRoot
[-] Init (198c1c8) = function Init() {
[native code]
}
[-] EqualsString (198c1d0) = function EqualsString() {
[native code]
}
[-] GetDelegate (198c1d8) = function GetDelegate() {
[native code]
}
[-] ReleaseDelegate (198c200) = function ReleaseDelegate() {
[native code]
}
[+] index (1a13380) = 6
0 = 6
[+] removedProp (1a13398) =
0 = null
[+] Properties (1a20e58) = [xpconnect wrapped nsIRDFResource],[xpconnect wrapped nsIRDFResource],[xpconnect wrapped nsIRDFResource],[xpconnect wrapped nsIRDFResource],[xpconnect wrapped nsIRDFResource],[xpconnect wrapped nsIRDFResource]
[+] 0 (1a200b8) = [xpconnect wrapped nsIRDFResource]
[-] QueryInterface (1944d38) = function QueryInterface() {
[native code]
}
[-] EqualsNode (1944d48) = function EqualsNode() {
[native code]
}
Value = http://home.netscape.com/NC-rdf#Name
ValueUTF8 = http://home.netscape.com/NC-rdf#Name
[-] Init (1945010) = function Init() {
[native code]
}
[-] EqualsString (1945298) = function EqualsString() {
[native code]
}
[-] GetDelegate (1945398) = function GetDelegate() {
[native code]
}
[-] ReleaseDelegate (19453b0) = function ReleaseDelegate() {
[native code]
}
[+] 1 (1a200c8) = [xpconnect wrapped nsIRDFResource]
[-] QueryInterface (19457c0) = function QueryInterface() {
[native code]
}
[-] EqualsNode (18a2190) = function EqualsNode() {
[native code]
}
Value = http://home.netscape.com/NC-rdf#URL
ValueUTF8 = http://home.netscape.com/NC-rdf#URL
[-] Init (18a21b0) = function Init() {
[native code]
}
[-] EqualsString (18a21b8) = function EqualsString() {
[native code]
}
[-] GetDelegate (18a21c0) = function GetDelegate() {
[native code]
}
[-] ReleaseDelegate (18a21d0) = function ReleaseDelegate() {
[native code]
}
[+] 2 (1a200d8) = [xpconnect wrapped nsIRDFResource]
[-] QueryInterface (18a2290) = function QueryInterface() {
[native code]
}
[-] EqualsNode (18a22b0) = function EqualsNode() {
[native code]
}
Value = http://home.netscape.com/NC-rdf#ShortcutURL
ValueUTF8 = http://home.netscape.com/NC-rdf#ShortcutURL
[-] Init (18a22d8) = function Init() {
[native code]
}
[-] EqualsString (18a22e0) = function EqualsString() {
[native code]
}
[-] GetDelegate (18a2300) = function GetDelegate() {
[native code]
}
[-] ReleaseDelegate (18a2320) = function ReleaseDelegate() {
[native code]
}
[+] 3 (1a200e8) = [xpconnect wrapped nsIRDFResource]
[-] QueryInterface (18a23e0) = function QueryInterface() {
[native code]
}
[-] EqualsNode (18a23e8) = function EqualsNode() {
[native code]
}
Value = http://home.netscape.com/NC-rdf#Description
ValueUTF8 = http://home.netscape.com/NC-rdf#Description
[-] Init (18a2d38) = function Init() {
[native code]
}
[-] EqualsString (18a2dd0) = function EqualsString() {
[native code]
}
[-] GetDelegate (18a2dd8) = function GetDelegate() {
[native code]
}
[-] ReleaseDelegate (18a2de0) = function ReleaseDelegate() {
[native code]
}
[+] 4 (1a200f8) = [xpconnect wrapped nsIRDFResource]
[-] QueryInterface (18a30e0) = function QueryInterface() {
[native code]
}
[-] EqualsNode (18a3100) = function EqualsNode() {
[native code]
}
Value = http://home.netscape.com/NC-rdf#WebPanel
ValueUTF8 = http://home.netscape.com/NC-rdf#WebPanel
[-] Init (18a32b8) = function Init() {
[native code]
}
[-] EqualsString (18a33a0) = function EqualsString() {
[native code]
}
[-] GetDelegate (18a33b0) = function GetDelegate() {
[native code]
}
[-] ReleaseDelegate (18a3408) = function ReleaseDelegate() {
[native code]
}
[+] 5 (1a20108) = [xpconnect wrapped nsIRDFResource]
[-] QueryInterface (18a3c18) = function QueryInterface() {
[native code]
}
[-] EqualsNode (18a3c20) = function EqualsNode() {
[native code]
}
Value = http://home.netscape.com/NC-rdf#FeedURL
ValueUTF8 = http://home.netscape.com/NC-rdf#FeedURL
[-] Init (18a3cb0) = function Init() {
[native code]
}
[-] EqualsString (18a3cc0) = function EqualsString() {
[native code]
}
[-] GetDelegate (18a3cd0) = function GetDelegate() {
[native code]
}
[-] ReleaseDelegate (18a3d00) = function ReleaseDelegate() {
[native code]
}
[+] container (1a13360) = [xpconnect wrapped nsIRDFContainer]
[+] QueryInterface (d3ca58) = function QueryInterface() {
[native code]
}
prototype (1a134e0) = [object Object]
DataSource = null
Resource = null
[+] Init (17efff8) = function Init() {
[native code]
}
prototype (1a133d0) = [object Object]
[+] GetCount (1952f48) = function GetCount() {
[native code]
}
prototype (1a13340) = [object Object]
[+] GetElements (17c1310) = function GetElements() {
[native code]
}
prototype (1a132e8) = [object Object]
[+] AppendElement (17c1478) = function AppendElement() {
[native code]
}
prototype (1a132c8) = [object Object]
[+] RemoveElement (17c1ec0) = function RemoveElement() {
[native code]
}
prototype (1a13290) = [object Object]
[+] InsertElementAt (17c1ee8) = function InsertElementAt() {
[native code]
}
prototype (1a13260) = [object Object]
[+] RemoveElementAt (17c1f00) = function RemoveElementAt() {
[native code]
}
prototype (1a131e0) = [object Object]
[+] IndexOf (17c1f18) = function IndexOf() {
[native code]
}
prototype (1a131b8) = [object Object]

polonus

szc · 2006-09-08T22:43:57.000Z

Hey Polonus the Damian my friend ! ;D ;D

Have you found any security threat coming from the Flash page I posted link for in one of those previous links ? I am really interested what’s happening in the background even though I have no clue what could be happening when my intention was just to please my wonderful client from Vancouver and give her small but still beatiful web site.

Cheers !

EDIT: All I know is that I never ever enabled anything in Flash that would by any way try to breach my site visitor’s security.

system · 2006-09-08T22:46:07.000Z

Haha that was a good one ;D

system · 2006-09-08T23:05:50.000Z

Not sure what you made to tricker Leak Monitor but try again with 2.0 or even in 1.5.0.7 RC5 http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/1.5.0.7-candidates/rc5/

Anyway, what we dont know is the bookmarks of Polonus 8) Certain type of sites are more likely to increase demand for tighter security than others. My feeling is if you can manage so much security stuff you either do visit risky sites or you dont really have actual need for them. Awareness or human factor is good enough protection. Not so much awareness among those Myspace users who recently got in trouble with their not updated most likely “cheap” XPs - still SP1 but they knew. Some dont care and just reformat or fix themself up with Anti-Spyware programs. People are different.

Matter of definition of course, if you count tracking cookies as a form of spyware/evil that must go away start protecting. And trust! I trust Opera, Firefox and IE7 to have high security as a goal. Dont think they can even compete on this issue any more. There will be single events showing a hole from time to time but I think it will be closed before it becomes a general problem. Goes for all 3 of them - though we might only hear most about Firefox “thanks” to open source policy. No bug is too small for Bugzilla which is good. When Microsoft give away a tool like Windows Defender they are aware and when Microsoft are aware rest have been since long. Not like you need 3rd party tools to avoid getting attacked. Can increase security for sure.

If it helps I remember a problem some had with Google toolbar or rather the phishing database. If you chose active protection during installation, each url send to Google, then it can get weird. Or at least some probably now fixed version could. Can also eat some cpu cycles. If you chose passive protection, only local database used, you should avoid most problems. Google toolbar itself should be pretty stable. Could be a Flock only problem, dont know…

polonus · 2006-09-08T23:18:50.000Z

Hi dk70,

The bookmarklet of Polonus? Just a demo from the page on Memory Leaking in Wikipedia, patched the piece of demo code there in the Crunchator, and Leak Monitor leaked the results. Nothing to do with risky surfing. Just to demonstrate a point,

polonus

system · 2006-09-08T23:43:33.000Z

Yeah Leak Monitor works and author is a known figure and contributor to Firefox code/fixes. Think I read some Mozilla Chief Engineer something giving him much credit for 2.0 improvements (bug-hunting I assume). I can tell you many a website/javascript triggered it when I used 1.5.0.x Now on 2.0 it hardly ever happens. Some extensions still make it go crazy. I dont think Mozilla Add-on site should approve extensions which triggers monitor but they obviously do and some extension makers still dont test that much.

I somehow doubt every leak means 500mb used or no one would be able to use Gmail for long but it probably have some negative impact on “memory management”. In some cases may be even stability.

Announcements