Trading with zero-day-exploits

On February 18. Secunia announced a zero-day-exploit for Firefox 3.6. A serios bug in Mozilla Firefox offers the possibility for remote code execution with administrator rights on Windows. It is possible that earlier versions of Firefox are affected too.

Evgeny Legerov about the result of his work: "People who've seen firefox exploit agree with me - it is a really cool bug, it was an interesting challenge to find and exploit it."

The Internet security company Intevydis had knowledge of the bug for more than two weeks. But they did not give any notice of it to the Mozilla developers. A Twitter post from Legerov shows, he was working on an exploit. On February 12./13. there were a lot firefox chrashes. Maybe the exploit was tested in the wild this time.

Secunia and Intevydis did not give any information about the bug to the Firefox developers, because the companies wanted to push the commercial exploit toolkit Canvas and the commercial addon VulnDisco with a really working zero-day-exploit.

Because of secure default settings the JonDoFox is much less vulnerable. But without knowledge about the exploit we can't evaluate, if it is save for this exploit.