Risk
7/30/2008
07:56 PM
George V. Hulme
George V. Hulme
Commentary
50%
50%

Radware Reveals Critical Vulnerability In Firefox 3

Well, not exactly "critical." But there is a flaw. And there is no patch. And so Radware demonstrates how many security vendors push their gear by spreading fear, uncertainty, and doubt on the user community.

Well, not exactly "critical." But there is a flaw. And there is no patch. And so Radware demonstrates how many security vendors push their gear by spreading fear, uncertainty, and doubt on the user community.Radware's bug find, according to Radware, is a "vulnerability that may cause application Denial of Service (DoS) in Firefox 3, Mozilla's latest Web browser application."

This sounds very scary, huh? A critical DoS in Firefox. And Radware's PR firm wanted to make certain that I understood the world was coming to an end. Here's how they introduced the criticality of the issue before us today:

"While we often like to assume there is safety in numbers, such an argument may not apply for today's Web browser environment. In their ongoing security efforts, Radware announced that it has discovered a critical vulnerability in the Firefox 3 Web browser application by Mozilla. Firefox 3 recently set a new Guinness world record for the most software downloads in a 24-hour period with 8,002,530 downloads of the software upon its launch this summer.

Upon reading this, I immediately rushed out to see if there was a patch. Nothing. I then went to some security bulletin boards. Again, Nothing.

The only fixed proffered by Radware was to, and this is a shocker, use its security gear:

Immediate protection from this vulnerability is available as part of Radware's Security Update Service (SUS), which seeks to safeguard customer infrastructures in advance of public disclosure of the flaw.

I sat at my desk, and I wondered for awhile: should I yank my modem cable out the wall?

Nah.

It was some time later in the morning when Mozilla spoke up, and they labeled the vulnerability as being low. From Mozilla's Security Blog:

Impact: If a user browses to a malicious page that takes advantage of this vulnerability, the browser will crash. A feature in Firefox called Session Restore will restore the browser session when Firefox is restarted and will likely save user-typed content in text areas as well. This feature is designed to save users' work in the event of a crash or browser restart.

Status: This issue is currently under investigation. Mozilla has assigned this bug an initial severity rating of low because of the minimal security risk to users.

So what we have here is a flaw in Firefox that could crash the browser, and any data managed by the browser in RAM may go poof. But that data would be restored, according to Mozilla, by its Session Restore feature.

So where's the criticality? Where's the big-time remote insertion of code? Authentication escalation? Folks, it doesn't seem to be there.

In fact, I just haven't been able to find anything in this vulnerability find worth causing a ruckus about, let alone announcing to the world.

What Radware has done is serve us a bad dish of fear, uncertainty, and doubt; aka: FUD. And it's a marketing tactic designed to sell equipment, or influence the market by muddying facts and spreading fear. And this vulnerability announcement, dubbed "critical" and dumped on the industry without a patch, work-around, or co-coordinated disclosure with Mozilla, is FUD at its worst, and a marketing cheap shot.

And Radware chose -- a security company actually thought it through and consciously decided -- to hype up a low-risk flaw as a critical flaw without offering any fix. And they did this on the very same week that organizations and ISPs are rushing to fix and patch a real risk, the DNS vulnerability. And they chose to do this a day after Oracle users had to start grappling with the full disclosure and exploit-code release against their WebLogic Servers.

Vendors that act this way care more about their marketing efforts than they care about their customers and prospects.

And when I approached Radware to substantiate why their press release is more than FUD, this was their response:

"Radware has no further comment beyond what's in the press release."

Wow.

Seems, to me at least, to be pretty shabby form for a company that purports to help companies better secure their infrastructure.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8802
Published: 2015-01-23
The Pie Register plugin before 2.0.14 for WordPress does not properly restrict access to certain functions in pie-register.php, which allows remote attackers to (1) add a user by uploading a crafted CSV file or (2) activate a user account via a verifyit action.

CVE-2014-9623
Published: 2015-01-23
OpenStack Glance 2014.2.x through 2014.2.1, 2014.1.3, and earlier allows remote authenticated users to bypass the storage quote and cause a denial of service (disk consumption) by deleting an image in the saving state.

CVE-2014-9638
Published: 2015-01-23
oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (divide-by-zero error and crash) via a WAV file with the number of channels set to zero.

CVE-2014-9639
Published: 2015-01-23
Integer overflow in oggenc in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (crash) via a crafted number of channels in a WAV file, which triggers an out-of-bounds memory access.

CVE-2014-9640
Published: 2015-01-23
oggenc/oggenc.c in vorbis-tools 1.4.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted raw file.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
If you’re a security professional, you’ve probably been asked many questions about the December attack on Sony. On Jan. 21 at 1pm eastern, you can join a special, one-hour Dark Reading Radio discussion devoted to the Sony hack and the issues that may arise from it.