RE: [Full-disclosure] FireFox Host: Buffer Overflow is not justexploitable on FireFox

[Juha-Matti Laurio <juha-matti.laurio () netti fi>]

> Hi Juha!
>
> > I have informed the vendor Netscape being affected on 9th 
> > September 2005.
>
> I did the same on the 10th of September - still no reply nor official
> statement from Netscape which makes me a little worried.

Good to know. It seems that's their way to act.
They had a coverage Security Center wp.netscape.com/security/index.html 
earlier, but all these wp.netscape.com pages redirect to Netscape 
Browser 8.0 Main Page when writing this.

> > Disabling IDN support via about:config (or prefs.js file) is 
> > possible in Netscape Browser 8 too. Xpi file for Firefox and 
>
> Correct. I reported that workaround on the 10th of September.
>
> I did so using both the security address at netscape.com and the "submission
> form" on Netscape's official webpage. I never got any reply/respons from
> netscape. 

Yes, I have similar experiences. I have information that they are 
reading their bug report submissions, however.

> Netscape uses the same rendering engine as Firefox (unless explicitly told
> to use IE) and as such, will also be vulnerable. The workaround, covered by
> the Mozilla Team, will correct the problem simply by disabling IDN.
>
> Regards
> Peter Kruse

Thanks for sharing the word.

- Juha-Matti