Cudni
La Merma - Vigilado
Premium,MVM
join:2003-12-20
Someshire | reply to matunga
Re: Firefox 2 is vulnerable to ANI flaw
the poc listed below did not crash FF (on either XP or W2K)
»zert.isotf.org/tests/testani.htm
It closed IE7 but not IE6
Cudni |
|
CajunTek
Insane Cajun
Premium,MVM
join:2003-08-08
Arlington, TX | Hmm... with hardware DEP on... It didn't crash ff or cause IE7 to close...
--
da Cajun Darn I hate Malware |
|
Jrb2
Premium
join:2001-08-31
| reply to Cudni
Hi Cudni,
IMON (NOD32) immediately jumps up with a warning (see screenie) when clicking on that link.
Then I see: "you do not appear to be vulnerable to the ie ani cursor exploit" (etc etc). |
|
AB
Premium
join:2006-04-04
Leesburg, VA
| reply to Cudni
The screenshot is what I get with Firefox 2.0.0.3 at that link.
I notice they call it an "ie exploit". Just poor characterization on their part? |
|
somebodynew5
@direcpc.com
| I think the biggest problem with these Proof of Concept test pages is people think that just because they pass one particular test that says their system is safe they think they are safe.
These proof of concept pages often only test a limited subset of all possible attack vectors. So while one proof of concept page may only trigger the exploit under IE there may also be attack vectors available under Firefox that are simply not exploited by the particular POC test page. A simple change to the exploit code may be able to attack using other browsers or avenues of exploit.
Much like all pages do not render the same under all browser many core operating system exploits require some minor code changes to target other browsers.
So any time the flaw is located in the underlying operating system just using a different browser may not close all available attack vectors. It all depends on the actual exploit. In this case the exploit can be triggered by some CSS code to load a ANI cursor file, So with some tweaks I am sure it is quite possible to cause Firefox to attempt to load a ANI file into windows.
|
|
CajunTek
Insane Cajun
Premium,MVM
join:2003-08-08
Arlington, TX | Just an FYI folks.. there is a patch available at windows update... even as I type...
--
da Cajun Darn I hate Malware |
|
AB
Premium
join:2006-04-04
Leesburg, VA
| reply to somebodynew5
said by somebodynew5 :
I think the biggest problem with these Proof of Concept test pages is people think that just because they pass one particular test that says their system is safe they think they are safe.
These proof of concept pages often only test a limited subset of all possible attack vectors. . . .
. . In this case the exploit can be triggered by some CSS code to load a ANI cursor file, So with some tweaks I am sure it is quite possible to cause Firefox to attempt to load a ANI file into windows. I don't doubt this for a moment. |
|
fishmaster
Premium
join:2004-10-08
Rockford, IL
 ·Comcast
·Insight Communicat..
1 edit | 
after patch ani alert |
|
|
dadkins
Can you do Blu?
Premium,MVM
join:2003-09-26
Hercules, CA
·Comcast
1 edit | #1 SMALL picture even when clicked on... cannot read text.
#2 No problems here in IE 7 after patch.
--
Think outside the Fox... Opera |
|
