Firefox Zero-Day Code Execution Hoax?

Akon writes, "eWeek is running a follow-up story on the claim by two hackers that Firefox's implementation of JavaScript is critically flawed and could result in code-execution attacks. Turns out this is a possible hoax that was overblown for laughs." Mozilla's engineers say the risk is limited to a denial-of-service issue. From the article: "'As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has... I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code,' Spiegelmock said." Spiegelmock also stated that the claim that there were 30 other undisclosed exploits was made solely by his co-presenter, Andrew Wbeelsoi.

Not a funny joke

[loconet]

There is also a post about this on the Washington Post [washingtonpost.com]. Apparently, they were just having fun?

If I was Alistapart, I would have gotten rid of this "clown" immediately.

Re:NoScript

[gorre]

You obviously don't use GMail, Google Calendar, and the like.

With NoScript one can designate sites that are allowed to run javascript, it's just that it is disabled by default. I use NoScript and have simply whitelisted google.com and any other trusted sites that require javascript.

Re:he hasn't gotten it to do so?

[AlgorithMan]

The fact that one person was unable to go from overflow to arbitrary code execution

of course big, complex programs (like a JavaScript VM) have errors, if you want proof, you have to make a hoare calculus http://en.wikipedia.org/wiki/Hoare_logic [wikipedia.org] for the source code and beleive me, this is really really much work! - - - but this alleged error seems to be nothing but posing...

Re:Never believe anything without a second source

[Anonymous Coward]

From Mozilla Dev News Blog [mozilla.org]

We got a chance to talk to Mischa Spiegelmock , the Toorcon speaker that reported the potential javascript security issue referenced earlier [mozilla.org] . He gave us more code to work with and also made this statement and agreed to let me post it here:

The main purpose of our talk was to be humorous.

As part of our talk we mentioned that there was a previously known Firefox vulnerability that could result in a stack overflow ending up in remote code execution. However, the code we presented did not in fact do this, and I personally have not gotten it to result in code execution, nor do I know of anyone who has.

I have not succeeded in making this code do anything more than cause a crash and eat up system resources, and I certainly haven't used it to take over anyone else's computer and execute arbitrary code.

I do not have 30 undisclosed Firefox vulnerabilities, nor did I ever make this claim. I have no undisclosed Firefox vulnerabilities. The person who was speaking with me made this claim, and I honestly have no idea if he has them or not.

I apologize to everyone involved, and I hope I have made everything as clear as possible.

Sincerely,

Mischa Spiegelmock

Even though Mischa hasn't been able to achieve code execution, we still take this issue seriously. We will continue to investigate.

-Window Snyder

Follow that link at your own risk

[emurphy42]

It leads to a piece of JavaScript - either an attempted proof of concept, or just an annoying fork bomb - I didn't bother to work out which, but either way, I recommend sticking with "Save As" or wget or what have you.