Dynaverse.net

Off Topic => Engineering => Topic started by: Nemesis on July 10, 2007, 10:01:41 pm

Title: IE and Firefox combination attack
Post by: Nemesis on July 10, 2007, 10:01:41 pm
Link to full article (http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/)

Quote
A proof of concept exploit found here uses IE to hand off maliciously-scripted code to a Firefox handler known as "firefoxurl." Handlers, which also include strings such as "ftp" and "aim," are found in the address bar and in many cases can be used to get Firefox to carry out certain actions.


Both sides are blaming the other.  Mozilla is working on a Firefox fix.

I think both should have fixes made.  IE should not pass "bad data" and Firefox shouldn't use it if it is given.
Title: Re: IE and Firefox combination attack
Post by: Commander Maxillius on July 11, 2007, 03:41:03 am
meh, I use Safari and Opera.... on Macintosh :P
Title: Re: IE and Firefox combination attack
Post by: Just plain old Punisher on July 11, 2007, 03:50:02 pm
Quote from: Commander Maxillius on July 11, 2007, 03:41:03 am
meh, I use Safari and Opera.... on Macintosh :P

Ha! I use nothing on my amiga!
Title: Re: IE and Firefox combination attack
Post by: Nemesis on July 21, 2007, 12:07:26 pm
Mozilla patches their side of the issue.

2.0.0.5 patch for Firefox released to fix this issue (and others)

Quote
Fixed in Firefox 2.0.0.5
MFSA 2007-25 XPCNativeWrapper pollution
MFSA 2007-24 Unauthorized access to wyciwyg:// documents
MFSA 2007-23 Remote code execution by launching Firefox from Internet Explorer
MFSA 2007-22 File type confusion due to %00 in name
MFSA 2007-21 Privilege escalation using an event handler attached to an element not in the document
MFSA 2007-20 Frame spoofing while window is loading
MFSA 2007-19 XSS using addEventListener and setTimeout
MFSA 2007-18 Crashes with e

2.0.0.5 patch for Thunderbird released as well since they share code.

Quote
MFSA 2007-23  Remote code execution by launching Firefox from Internet Explorer
MFSA 2007-18 Crashes with evidence of memory corruption
Title: Re: IE and Firefox combination attack
Post by: jualdeaux on July 23, 2007, 01:52:08 pm
I wonder how long it will take MS to come up with a fix on their end. Oh, wait... I forgot, it is never MS's fault.
Title: Re: IE and Firefox combination attack
Post by: Just plain old Punisher on July 23, 2007, 03:29:20 pm
Quote from: jualdeaux on July 23, 2007, 01:52:08 pm
I wonder how long it will take MS to come up with a fix on their end. Oh, wait... I forgot, it is never MS's fault.

I imagine it would be the people who found and exploited the exploits fault.

It isn't my fault I robbed your house. Afterall, you didn't surround it with barb wire, alligator filled moats, and anti-personel minefields.