Unpatched Firefox 1.5 exploit made public

[Scarecrow Man]

The latest Firefox flaw exists in the history.dat file, which stores information from Web sites users have visited with the Firefox 1.5 browser, according to a posting on the Internet Storm Center, which monitors online threats.

"If the topic of a page is crafted to be long enough, it will crash the browser each time it is started after going to such a page," according to the Internet Storm Center posting. "Once this happens, Firefox will be unable to be started until you erase the history.dat file manually."

But...

Correction: This story incorrectly stated the affiliation of Mike Schroepfer, Mozilla's results in verifying the Firefox 1.5 flaw, and the nature of the problem. Schroepfer is vice president of engineering with Mozilla Corp., and Mozilla has not been able to verify its browser can crash and lead to a denial-of-service condition. The problem itself was not a security vulnerability but actually a flaw in the browser.

Check http://bugzilla.mozilla.com for bug problems.

So far, no fix has been released. (correct me if I am wrong)

Full story - http://news.com.com/Unpatched+Firefox+1.5+...ml?tag=nefd.top

[CurlyWhirly]

Crikey, it's difficult to decide which browser to use as they all seem to have vulnerabilities.

Even though this exploit could lead to a DOS attack, I still maintain that using Firefox is safer than using Internet Explorer as the browser isn't integrated into the operating system itself.

I await a Firefox update and hope it won't be too long before it is released?

[ɹəuəllıʍ ʇɐb]

mozilla.org Issues Security Advisory on Startup Unresponsiveness

http://www.mozillazine.org/talkback.html?article=7768