Firefox Vulnerable to Protocol-Handling Bug Attacks

Firefox remains vulnerable to attacks exploiting protocol-handling bugs, even though it was patched twice in July, a pair of security researchers said this weekend. Billy Rios and Nate McFeters, who spelled out design and functionality vulnerabilities in Windows' Uniform Resource Identifier (URI) protocol handling as recently as mid-August, said Saturday that they have uncovered another way hackers could send malicious code to users via browsers.

"Once again, these URI payloads can be passed by the mailto, nntp, news, and snews URIs, allowing us to pass the payload without any user interaction," claimed Rios in a posting to his blog. "Although the conditions which allowed for remote command execution in Firefox 2.0.0.5 have been addressed with a security patch, the underlying file type handling issues which are truly the heart of the issue have NOT been addressed," he added.

View: The full story
News source: PCWorld

Report a problem with article
Previous Story

ECS GeForce 8500 GT 512MB review

Next Story

Windows Server 2008 Beta 3 Download

10 Comments

Commenting is disabled on this article.

now that FF is becoming more famous its gonna attract more attackers... hence its gonna suck like IE too

OPERA is the Best!

Shouldn't you be saying "Opera sucks" ?

If you say it's the best, then people may believe you. And if that happens, they just may download Opera and start using it. If they do that, then friends will tell friends and soon, it'll become popular. Then attackers will start aiming for Opera and it won't be the best anymore. Onoes! Hurry hurry! Tell the world Opera sucks so it won't grow!!!

I say we all get Linux and run Opera for the rest of our lives. No way they can attack that ****, right? Right? :ponder:

yeah i agree this crap is getting confusing!

whats the deal... cause im on Firefox v2.0.0.6 and thats still effected?... will it ever get properly fixed?

I've read soo many descriptions about this freaking thing I have no clue anymore

I've read it's all Firefox's fault

I've read it's all IE 7's fault

I've read it's XP's URI fault

I've read nothing has to already be on your system and that something HAS to be on your system already

Which one is it already?

From what i've read, this exploit only works on Windows XP with IE7 installed. XP+IE6, and Vista+IE7 are not effected. Also from what I understand, this exploit lets someone run a file that already exists on your computer by getting you to click a specially-crafted link (eg, mailto: ). It doesn't actually allow people to place files onto your HD or anything.