why is firefox 15 displaying hex data size for the html data making up the page?
Windows 7, 32 bit Firefox 15.0.1 updated Friday Java 1.7.0_07 updated Friday
Management forced a java upgrade and reboot on Friday; when Firefox was started it auto-updated to V15.0.1. It had problems immediately; the previous session tabs were all lost, and any page with Flash no longer worked (everything was OK prior to the two upgrades).
Per recommendations I created a new profile, only copying over the bookmarks and username/authentication files from the previous profile. When manually reopening the needed tabs, noted that any Sonicwall firewall, and the Panasonic Netcam both only displayed a white page with one or more hex numbers on it.
Efforts to repair since included completely removing Firefox, Java, and the Flash plugin, running in safe mode, disabling all extensions/plugins, running in a completely default new profile with nothing carried over, trying with and without hardware acceleration, etc. The behavior does not change. It does not matter if I go in via http or https for the devices that support both.
Javascript IS enabled, and _no_ script blocking is in place; javascript does work on other sites that use it.
IE9 on the same PC works fine, so it is not apparently a system issue
Review of the page source shows the hex numbers are the data length of the following line or chunk of HTML, including javascript code. The Sonicwall puts up a bigger number (2ea) on line one of the view source page that matches the size in bytes of the code in the subsequent lines.
The Panasonic apparently sends the data length of each line so it provides one hex number for each line of the html code in the view source screen.
What would make Firefox interpret the incoming size data as displayable, but only for certain pages or devices? I can visit other sites that have javascript and they work; a view source on those pages does not show any lines with just a hex number.
example Sonicwall view source (between the ==== lines); all you see on the screen is the '2ea' in the upper left corner
=
2ea
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html>
<head>
<meta name="SonicWALL Administrator" content="Copyright 2004 (c) SonicWALL, Inc. All rights reserved.">
<title>SonicWALL - Authentication</title>
<meta name="id" content="auth" >
<script type="text/JavaScript">
<!--
top.location.target="_top";
if (window.location.target != "_top") {
top.location.href=window.location.href;
}
var savedPwd = "";
function onPageUnload() {
window.name = "";
}
window.onunload=onPageUnload;
// -->
</script>
</head>
<frameset rows="*,1">
<frame src="auth1.html" name="authFrm" noresize scrolling="no">
<frame src="emptyView4.html" name="authTgtFrm" noresize scrolling="no">
</frameset>
</html>
=====
View source sample from the Panasonic; the blank lines are displayed as such in the view source screen. All you see in the browser window is the series of hex numbers separated by a space on the same line.
=====
0
3b
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Frameset//EN">
8
<HTML>
7
<HEAD>
28
<META HTTP-EQUIV="expires" CONTENT="0">
2e
<META HTTP-EQUIV="Pragma" CONTENT="no-cache">
35
<META HTTP-EQUIV="Cache-Control" CONTENT="no-cache">
24
<META NAME="robots" CONTENT="none">
30
<META NAME="robots" CONTENT="noindex,nofollow">
29
<META NAME="robots" CONTENT="noarchive">
15
<TITLE>Start</TITLE>
8
</HEAD>
3d
<FRAMESET border=0 frameSpacing=0 rows=30,8,* frameBorder=0>
4c
<FRAME name=bar src="CgiTagMenu?page=Top&Language=0" scrolling=no NORESIZE>
3c
<FRAME name=hrbar src="BarFoot.html" scrolling=no NORESIZE>
27
<FRAME name=body src="Top?Language=0">
c
</FRAMESET>
9
</HTML>
=====
Ilungisiwe ngu cor-el
Isisombulu esikhethiweyo
Try to boot the computer in Windows Safe mode with network support (press F8 on the boot screen) as a test to see if that works better.
Funda le mpendulo kwimeko leyo 👍 0All Replies (5)
Isisombululo esiKhethiweyo
Try to boot the computer in Windows Safe mode with network support (press F8 on the boot screen) as a test to see if that works better.
Ok, done. In fact Firefox did load the camera and firewall pages without issue in safe mode with networking; unfortuantely I can't stay in safe mode on this work box. When I rebooted back to normal mode, Firefox opened the profile manager but is now failing to start at all (new behavior) with the most recently built profile (the one I used in safe mode); other older profiles do open but exhibit other problems. The hung profile process is present using 15MB RAM but no CPU activity, the quick start icon is highlighted, but no window ever opens (I gave it 15 minutes).
I don't think this pc has been compromised; I've run scans from several tools and the pc admin ran a hijack-this scan, all clear, but I guess its likely to be a system problem even if it only impacts firefox at this point. But if anyone has any thoughts I'd appreciate it; rebuilding this box will be a major PITA given all the service apps loaded on it.
More testing. I removed FF 15.0.1 and installed the current beta. The newest profile opened but camera and firewall screens still display the hex numbers. I then deinstalled / rebooted and installed FF 14.0.1 (which worked before) and now it also fails to render the camera and firewall screens (still shows the hex numbers).
Whatever the problem is, it was definitely triggered by the Firefox 15.0.0 and/or 15.0.1 upgrades, or the java upgrade, but I can't locate it.
cor-el, thanks for responding. As it turns out the machine was compromised, probably due to the Java upgade from 6.x to the supposedly current 7.x version. I suspect one of the 'always open' tabs in my profile was aimed at a site that had been compromised to exploit the java vulnerability that has not apparently been fixed yet.
After removing Java, a current Panda AV scan detected three bad jar files. Further testing with MSCONFIG found a file in startup that did not belong, turns out to be a new exploit with very little coverage on virustotal (neither Panda nor McAfee detected it as malware) but as soon as it was taken out of the startup, Firefox started working perfectly.
Firefox was the parakeet in the cave, tipping over to let me know something was wrong.
The machine is in quarantine until a much more complete analysis is done. We may still rebuild it to be certain.
I'm giving you a 'solved' on this because the windows safe mode boot pointed the way to determining the problem.
As a point of interest in case similar symptoms crop up for someone else, this is the Virustotal page on the file we located: