Firefox[all versions]: Vulnerability, Patch & Workaround

Thanks, but I have switched to Opera. [wink]

Hmm.. trouble in Paradise?

Quote:

However, in an example of the uneasy alliance between security researchers and software makers, he (the researcher who found the bug) decided to publicly disclose the flaw after a run-in with Mozilla staff, he said.

The faster disclosed, the faster patched. It's alright with me.

Quote:

Original post by kSquared Hmm.. trouble in Paradise? Quote: However, in an example of the uneasy alliance between security researchers and software makers, he (the researcher who found the bug) decided to publicly disclose the flaw after a run-in with Mozilla staff, he said.

According to Michalson, this is quite a common occurance and has been for some time. I've never bothered to research it on my own, because I don't really care, but I'm sure he can provide additional information.

CM

Quote:

Original post by xMcBaiNx The faster disclosed, the faster patched. It's alright with me.

The last time a critical vulnerability was leaked while Mozilla was still working on a patch it took just over 7 days before the patch was made available (so as you can imagine, the initial Slashdot response was "oh, they'll have this fixed in 24 hours". The response when it was finally released was "See how fast that was"). It's unknown how long Mozilla knew about the issue before that.

Quote:

Original post by Conner McCloud According to Michalson, this is quite a common occurance and has been for some time. I've never bothered to research it on my own, because I don't really care, but I'm sure he can provide additional information.

I assume you're referring to secrecy. In the past (basically everything pre-FireFox 1.0) secrecy was very tight. Mozilla kept a disclosure list, but it was always kept 2 versions back, and there was only one link to that page, with the link itself being hidden away in the middle of an obscure page. That was matched with how they announced fixes for vulnerabilities: They didn't.

They relied entirely on security through obscurity (while at the same time encouraging their OSS supporters to make accusations of that sort against their competitors [IE and Opera]). If you were not downloading the nightly builds you where totally at the mercy of whether or not a black hat happened to find any of the dozen or more vulnerabilities that existed in each minor version. All because Mozilla wanted to create a false sense of security and take advantage of the fact that Opera and Microsoft, as businesses, where forced to act in the consumers favor to avoid any threat liability.

Now as I said that was the past. Post 1.0 things started to change. With Firefox mostly feature frozen (at 1.0 it was a "complete" product) and real feature improvement work going into 1.5 (which is available now in beta form) it became harder and harder to camouflage security fixes, because there wasn't any real new features to justify a release. 1.0.1 and 1.0.2 didn't go too badly, most people bought vague claims of performance improvements, despite the fact that Mozilla, now trying to operate as a public company (starting the campaign to get ordinary consumers, and not just dateless geeks, to use their browser) was having to actually disclose what was in the update. While the disclosure page was still obscured, it was now being updated in sync with release versions. People who knew what they where looking for could see how many fatal flaws 1.1 and 1.2 where really patches for.

The first public breaking point was 1.0.3 – while there was no hype leading up to it, several online news sources, now wise to the in sync disclosure list (or just copying off their buddies, as online news often does) did make it obvious to everyone that it was a security update by listing what 1.0.3 “fixed”. 1.0.4 was when it become obvious to even the layman – someone leaked the existence of one of the vulnerabilities being fixed a week before the patch came out. Everyone knew that 1.0.4, continuing in a trend of one new “release” every month (~though Mozilla didn’t schedule them for Tueday~), was a security fix. Of course 1.0.5 was pretty much the same – in addition to fixing vulnerabilities, it was a fix for the stuff 1.0.4 broke.

Of course the cat is now out of the bag now. The idea that FireFox is magically “secure” has been disproven (FireFox’s usage for the first time went down). In the last two updates Mozilla has been grudgingly forthright about saying what was fixed (everyone knows they’re vulnerability patches now, trying to pass them off as anything else would be a PR nightmare), though it doesn’t mean they have to be happy about giving up their special veil of secrecy, having to play on a fair field with IE and Opera instead of resting on a crunch of Slashdot fueled propaganda.

While purely speculation, the “run in” with Mozilla was likely either the researcher asking for a fix schedule (when will I be able to announce this) or telling them where and how he planned to explain the vulnerability after it was fixed (probably saying he would give a lot of detail). The Mozilla response to such an inquiry would have likely been “you don’t need to know” and “you’ll keep your mouth shut, only we will explain the vulnerability, and in obscure enough words to prevent any criticism of us”. The effect of the “we don’t like anyone snooping around our glorious product” would upset anyone who makes a living doing just that.

However all this has interestingly brought down the patching speed. We have now even seen a “high” vulnerability (“Content-generated event vulnerabilities”) being reported while Mozilla was still working one version (1.0.3), kept secret right through the release of the next version (1.0.4) and then finally fixed in the next version, 1.0.5.

For a better look into how fast Mozilla is working on keeping you safe, here is a breakdown of the last three releases and how quickly they went from a vulnerability being reported to them, to them releasing the updated version and revealing it exists:

1.0.3
Number of Vulnerabilities: 9
Average Time to Fix: 8.33 days
Mix/Max: 3-16 days
Low: N/A
Moderate: 4 / 8.25 days / 3-15 days
High: 2 / 11.5 days / 7-16 days
Critical: 3 / 6.33 days / 4-11 days

1.0.4
Number of Vulnerabilities: 3
Average Time to Fix: 21.67 days
Min/Max: 18-24 days
Low: N/A
Moderate N/A
High: N/A
Critical: 3 / 21.67 days / 18-24 days

1.0.5
Number of Vulnerabilities: 12
Average Time to Fix: 48.5 days
Low: 3 / 50.67 days / 16-71 days
Moderate 3 / 39 days / 36-45 days
High: 4 / 59.25 days / 15-92 days
Critical: 2 / 38 days / 22-54 days

As you can see, the time to fix is going up by a lot. Most of the vulnerabilities from 1.0.5 where actually ones that where reported before 1.0.4 came out (and the one high one reported before 1.0.3 came out).

Quote:

Original post by Michalson 1.0.3 Number of Vulnerabilities: 9 Average Time to Fix: 8.33 days Mix/Max: 3-16 days Low: N/A Moderate: 4 / 8.25 days / 3-15 days High: 2 / 11.5 days / 7-16 days Critical: 3 / 6.33 days / 4-11 days 1.0.4 Number of Vulnerabilities: 3 Average Time to Fix: 21.67 days Min/Max: 18-24 days Low: N/A Moderate N/A High: N/A Critical: 3 / 21.67 days / 18-24 days 1.0.5 Number of Vulnerabilities: 12 Average Time to Fix: 48.5 days Low: 3 / 50.67 days / 16-71 days Moderate 3 / 39 days / 36-45 days High: 4 / 59.25 days / 15-92 days Critical: 2 / 38 days / 22-54 days

Thanks for that good stats as well as nice avatars!

I may be pro microsoft on most points, but when it comes to security updates, frankly in a world where you can get addon, all sorts of diffrent file types, and basically how advanced browsers are now, it is just impossible to cover every corner.

the only diffrence I think between mozilla team and microsoft is the fact that on one they tell of the problems before they release the updates. Everything has problems! it just takes time to surface, and generally I think that Microsoft is much better at patching.

Quote:

Original post by wilhil the only diffrence I think between mozilla team and microsoft is the fact that on one they tell of the problems before they release the updates. Everything has problems! it just takes time to surface, and generally I think that Microsoft is much better at patching.

Keep in mind an important fact - Microsoft has a been a company directly responsible for their products for a lot longer (as I mentioned before Mozilla didn't really become one until FireFox was no longer just some 0.x beta).

Like any established tech company they have a whole lot more experience and groundwork for properly dealing with problems ranging from something as simple as a bad looking character in an obscure font, to a critical vulnerability. Mozilla is still a baby in that respect - their update mechanism doesn't even work yet [a) its buggy and often says there is a patch when there is not and b) they don't even have patches yet. Every "patch" is a full 4-9MB installer].

It's the same thing I've been telling friends about Mac OS X when they claim superior security. It's easy to boast of security when only ~5% of the market uses your product. As that number goes up, though, so do the holes. Then it becomes an issue of who can deal with issues faster. Microsoft has this down at this point.

I still prefer Firefox over IE. The integration Explorer has with the operating system has always bothered me.

Quote:

Original post by Michalson Quote: Original post by wilhil the only diffrence I think between mozilla team and microsoft is the fact that on one they tell of the problems before they release the updates. Everything has problems! it just takes time to surface, and generally I think that Microsoft is much better at patching. Keep in mind an important fact - Microsoft has a been a company directly responsible for their products for a lot longer (as I mentioned before Mozilla didn't really become one until FireFox was no longer just some 0.x beta). Like any established tech company they have a whole lot more experience and groundwork for properly dealing with problems ranging from something as simple as a bad looking character in an obscure font, to a critical vulnerability. Mozilla is still a baby in that respect - their update mechanism doesn't even work yet [a) its buggy and often says there is a patch when there is not and b) they don't even have patches yet. Every "patch" is a full 4-9MB installer].

please do not get me wrong, I understand this, but at the same time I think it is wrong for anyone to defend them like that, when it is advertised as the secure browser, the browser you can trust e.t.c.

it is a good browser, but in the same way, so is internet explorer, but at the end of the day, someone will find a bug in the best coded software!