Firefox and IE together brew up security trouble
UPDATE: Blame them both.
That's the latest update from security researchers who initially laid the blame on Microsoft's Internet Explorer for the latest zero-day exploit that also can afflict those using the Firefox Web browser.
Users could face a "highly critical" risk if they have both IE and Firefox version 2.0, or later, loaded on their computer. The trouble begins when browsing a malicious site while using IE and it registers a "firefoxurl://" URI (uniform resource identifier) handler, which allows the browser to interact with specific resources on the Web. As a result, users may find their systems remotely compromised.
Earlier Tuesday, security researcher Thor Larholm, who discovered the IE flaw, and security research giant Symantec put much of the blame on IE, while Secunia's Thomas Kristensen, chief technology officer, attributed the problem to Firefox versions 2.0 or later.
"It's a little bit of both," said Oliver Friedrichs, director of Symantec's Security Response Center. "You have two very complex applications that are not playing well together and leading to a security issue. The components themselves are secure as stand-alone products but not together."
"Firefox is the current attack vector, but Internet Explorer is to blame for not escaping...characters when passing on the input to the command line," said Larholm, in response to a reader's comments. "I agree that Firefox could have registered its URL handler with pure DDE (dynamic data exchange, the protocol for information exchange) instead and thereby have avoided the possibility of a command-line argument injection, but IE should still be able to safely launch external applications."
Friedrichs noted that while Firefox, which released version 2 in October, has gained in popularity, most Firefox users will also have IE loaded on their computers, since it comes with the Windows operating system.
The number of people who may be at risk could be substantial, he added.
Meanwhile, Kristensen of Secunia said: "A new URI handler was registered on Windows systems to allow Web sites to force launching Firefox if the 'firefoxurl://' URI was called, like ftp://, http://, or similar would call other applications."
But because of the way the URI handler was registered by Firefox, it causes any parameter--which activates a program to perform a particular task--to be passed from Microsoft's Internet Explorer, or another application, to Firefox, when firefoxurl:// is activated.
An attacker may use "chrome" context--the interface elements of a browser that create the frame around its page displays--to inject code on a user's system that would be executed within Firefox, Kristensen said.
"Registering the URI handler must be done with care, since Windows does not have any proper way of knowing what kind of input potentially could be dangerous for an application," said Kristensen. "For example, how should Windows know that the string 'chrome' could be dangerous for Firefox."
Other than avoiding malicious Web sites, system administrators could unregister, or remove, the "Firefox URL" URI handler, as well as change the way Firefox accepts the chrome input, Kristensen said.
Dawn Kawamoto covers enterprise security and financial news relating to technology for CNET News. E-mail Dawn. 
If MS would totally abandon the core code That been in use since 1980's and switch to either UNIX like Apple did on the Mac OS, or even Linux. The Virus and Malware would be shut down immediately. Either , Mac. UNIX, or Linux when something ask you to execute a file it ask your permission. Making you the user totally responsible for screwing up your computer.
ALso how many Falws in IE/6/7 That may not being reported?
Really this needs to be fixed on both ends of the problem. IE shouldn't be just sending random junk to the command line with no error checking while Firefox should not be accepting command lines without proper error checking.
I'm sure they love gaining "remove" control...
When it's fixed, this can be deleted..
/P
And to be honest, the problem seems to be rooted in the way that Windows handles Firefox code. (aka. more fuel for MS haters)
Must suck to do all that astroturfing in this thread, then have the rug pulled out from under ye by real events... >:)
/P
While using IE? There are people out there who actually use IE after installing Firefox? Why? Except where MS insists on it (on their website), I avoid IE like the plague.
mark d.
For some reason they seem to really beat the Firefox critical flaw with remote control issue to death and the barely breeze past the fact that you need to be using IE to have it affect you.
Go figure.
been to sites to download, using FF browser, and
am told I must use IE to download the program.
That is the ONLY time I use IE. I did install IE 7 but hated it, removed it and went back to
IE 6 which I also don't like.
Now my 1-year old computer is still fast and happy instead of bogged down.
i love Firefox, so I hope they solve or plug whatever issues are here.
Just thought I'd share :)
If they use FireFox to surf they're fine. And why would you install FireFox just to use IE still? Hmmm...
And my Windows PC ran smoothly for more than 1 year, it actually doesn't take much nous to keep a Windows PC free of malware, adware, or crapware although I must point out that your pristine Mac is absolutely crawling with software and is itself hardware...
Just thought I's share :)
More in general, they're protected from chrome privilege escalation gained by opening non-chrome URLs in top-level chrome windows (Larholm's PoC) and from javascript: URLs being loaded in externally opened browser shells (Rios' "Universal XSS" PoC), no matter if attempted through the "firefoxurl:" handler (like in this specific case) or by other means we don't know yet (if any exist).
Hence, these protective features are here to stay, since the upcoming Firefox 2.0.0.5 just fixes the "firefoxurl:"/command line known exploit.
I have MS IE7 installed and working erratically.
I've also discovered that there is "some version of Mozilla Firefox 2.0" installed in my system but it was not installed by me.
Don't ask "how" (FF 2.0) ended up in the system but I have some idea as to what's going on and how this is occuring.
- Fixed in Firefox, no fix for IE
- by RustedGod July 18, 2007 5:26 AM PDT
- See http://www.mozilla.org/security/announce/2007/mfsa2007-23.html
- Reply to this comment
-
(37 Comments)