------=_Part_10103_25079004.1126427967549
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

Hi all,
 Research and development has let to a ~90% reliable working exploit for th=
e=20
IDN Heap Buffer overrun in FireFox on WinXP and Win2k3 as long as DEP is=20
turned off and JavaScript is enabled. Some tweaking might yield an even=20
higher success ratio. It has also revealed that not only FireFox is=20
vulnerable to this vulnerability, but the exact same exploit works on the=
=20
latest releases of all these products based on the Mozilla engine:
 - Mozilla FireFox 1.0.6 and 1.5beta,
- Mozilla Browser 1.7.11,
 - Netscape 8.0.3.3 <http://8.0.3.3>.
 Recommendations for this vulnerability:
- FireFox and Mozilla: Install the workaround for (
https://addons.mozilla.org/messages/307259.html).
- Netscape: hope they'll respond to this email and release a workaround.
- Wait for a patch and install it asap.
 Recommendations to make it harder to exploit any FireFox vulnerability:
- Turn on DEP (Data Execution Prevention),
- Turn off JavaScript,
- Switch to another browser,
- Do not browse untrusted sites,
- Do not browse the web at all,
- Unplug your machine from the web,
- Wear a tinfoil hat.
 Cheers,
SkyLined

 On 9/10/05, Berend-Jan Wever <berendjanwever@gmail.com> wrote:=20
>=20
> (Just a little heads up, no details or PoC attached)
>  The security vulnerability in Mozilla FireFox reported by Tom Ferris is=
=20
> exploitable on Windows.
> I developed a working exploit that seems to be 100% stable, though I've=
=20
> only tested it on one system.
> The exploit will not be released publicly untill patches are out.
>  On a side note: it took only about 3 hours and 30 minutes to develop the=
=20
> exploit, so I might not be the only one able to write it.
>  Cheers,
> SkyLined
>=20
> --=20
> Berend-Jan Wever <berendjanwever@gmail.com>
> http://www.edup.tudelft.nl/~bjwever=20
>=20



--=20
Berend-Jan Wever <berendjanwever@gmail.com>
http://www.edup.tudelft.nl/~bjwever

------=_Part_10103_25079004.1126427967549
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline

<div>Hi all,</div>
<div>&nbsp;</div>
<div>Research and development has let to a ~90% reliable working exploit fo=
r the IDN Heap Buffer overrun in FireFox on WinXP and Win2k3 as long as DEP=
 is turned off and JavaScript is enabled. Some tweaking might yield an even=
 higher success ratio. It has also revealed that not only FireFox is vulner=
able to this vulnerability, but the exact same exploit works on the latest =
releases of all these products based on the Mozilla engine:
</div>
<div>&nbsp;</div>
<div>- Mozilla FireFox 1.0.6 and 1.5beta,</div>
<div>- Mozilla Browser 1.7.11,</div>
<div>
<div>- Netscape <a href=3D"http://8.0.3.3">8.0.3.3</a>.</div>
<div>&nbsp;</div>
<div>Recommendations for this vulnerability:</div></div>
<div>- FireFox and Mozilla: Install the workaround for (<a href=3D"https://=
addons.mozilla.org/messages/307259.html">https://addons.mozilla.org/message=
s/307259.html</a>).<br>- Netscape: hope they'll respond to this email and r=
elease a workaround.
</div>
<div>- Wait for a patch and install it asap.</div>
<div>&nbsp;</div>
<div>Recommendations to make it harder to exploit any FireFox vulnerability=
:</div>
<div>- Turn on DEP (Data Execution Prevention),</div>
<div>- Turn off JavaScript,</div>
<div>- Switch to another browser,</div>
<div>- Do not browse untrusted sites,</div>
<div>- Do not browse the web at all,</div>
<div>- Unplug your machine from the web,</div>
<div>- Wear a tinfoil hat.</div>
<div>&nbsp;</div>
<div>Cheers,</div>
<div>SkyLined<br><br>&nbsp;</div>
<div><span class=3D"gmail_quote">On 9/10/05, <b class=3D"gmail_sendername">=
Berend-Jan Wever</b> &lt;<a href=3D"mailto:berendjanwever@gmail.com">berend=
janwever@gmail.com</a>&gt; wrote:</span>=20
<blockquote class=3D"gmail_quote" style=3D"PADDING-LEFT: 1ex; MARGIN: 0px 0=
px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid">
<div>(Just a little heads up, no details or PoC attached)</div>
<div>&nbsp;</div>
<div>The security vulnerability in Mozilla FireFox reported by Tom Ferris i=
s exploitable on Windows.</div>
<div>I developed a working exploit that seems to be 100% stable, though I'v=
e only tested it on one system.</div>
<div>The exploit will not be released publicly&nbsp;untill patches are out.=
</div>
<div>&nbsp;</div>
<div>On a side note: it took only about 3 hours and 30 minutes to develop t=
he exploit, so I might not be the only one able to write it.</div>
<div>&nbsp;</div>
<div>Cheers,</div>
<div>SkyLined<br clear=3D"all"><br>-- <br>Berend-Jan Wever &lt;<a onclick=
=3D"return top.js.OpenExtLink(window,event,this)" href=3D"mailto:berendjanw=
ever@gmail.com" target=3D"_blank">berendjanwever@gmail.com</a>&gt;<br><a on=
click=3D"return top.js.OpenExtLink(window,event,this)" href=3D"http://www.e=
dup.tudelft.nl/~bjwever" target=3D"_blank">
http://www.edup.tudelft.nl/~bjwever </a></div></blockquote></div><br><br cl=
ear=3D"all"><br>-- <br>Berend-Jan Wever &lt;<a href=3D"mailto:berendjanweve=
r@gmail.com">berendjanwever@gmail.com</a>&gt;<br><a href=3D"http://www.edup=
.tudelft.nl/~bjwever">
http://www.edup.tudelft.nl/~bjwever</a>=20

------=_Part_10103_25079004.1126427967549--