Firefox vulnerable from IE



User avatar

Hero Member
Hero Member

Posts: 1911

Joined: Mon Dec 11, 2006 3:23 pm

Post Tue Jul 17, 2007 7:30 am

Firefox vulnerable from IE

Well now this is interesting, Firefox can be exploited when browsing with IE...

"The vulnerability is exposed when a user browses to a malicious webpage in IE and clicks on a specially crafted link. The link causes IE to invoke another Windows program via the command line and then pass [to] that program the URL from the malicious webpage without escaping the quotes," she said. "This can cause data to be passed accidentally from the malicious webpage to the second Windows program. In the specific attack described in the report [by researcher Thor Larholm], IE sends URL data to Firefox. If the data is crafted in a certain way, it will allow remote code execution in Firefox."

Full Article - SC Magazine


Post Wed Jul 25, 2007 7:42 am

Re: Firefox vulnerable from IE

More on this topic courtesy of The Register ... x_url_bug/



User avatar

Sr. Member
Sr. Member

Posts: 368

Joined: Sun Aug 13, 2006 5:31 pm

Post Wed Jul 25, 2007 11:03 pm

Re: Firefox vulnerable from IE

IE is not the only one vulnerable but Firefox as well!

The Mozilla Foundation acknowledged over the weekend that its own Firefox browser allows links that can send malicious code to external programs, a security issue that the group had previously argued should be fixed by the browser maker.

In early July, three researchers found a way to execute code in Firefox -- and potentially other Windows programs -- by passing it a malicious uniform resource identifier (URI) from Internet Explorer. The discovery lit off a firestorm of finger pointing: The Mozilla Foundation argued that IE should validate the URI before passing it along to another program, while Microsoft stated that input validation is the responsibility of the receiving program.

Over the weekend, another researcher discovered that Mozilla Firefox has the same security issue. The Mozilla Foundation acknowledged the problem on Monday.

"We thought this was just a problem with IE," Mozilla's chief security officer Window Snyder said in a blog post. "It turns out, it is a problem with Firefox as well."

In the latest versions of their products, Microsoft and the Mozilla Foundation have focused on security. In Internet Explorer 7, Microsoft added anti-phishing features, the ability to run in protected mode on its latest operating system, Windows Vista, and severely culled problematic ActiveX controls. In Firefox 2.0, the Mozilla Foundation also added anti-phishing features and the ability to clear private data.

Mozilla is now looking into the issue to determine its response to the problem.

Original story:
Security+, OSCP, CEH

Return to News from the Outside World

Who is online

Users browsing this forum: No registered users and 0 guests

Powered by phpBB® Forum Software © phpBB Group.
Designed by ST Software