Posted on 07/31/2007 6:56:31 AM PDT by holymoly
The makers of Firefox Monday released a new version of the Web browser that addresses a pair of flaws.
The Mozilla Foundation has released Firefox version 2.0.0.6, addressing critical flaws that involved unescaped URLs passing to external programs and privilege escalation through chrome-loaded about:blank windows.
Last week, independent security researcher Billy Rios, said in an update on his blog that an input validation error could be delivered through the Firefox browser, enabling full access to the machine..
"You simply have to have IE7 installed somewhere on your system for this to work (which is basically most WindowsXP Sp2 systems)," he said.
Danish vulnerability clearinghouse Secunia rated the flaw "highly critical" in its 26201 advisory Thursday because attackers could exploit it remotely. Secunia said users must visit a malicious Web site in order for the flaw to be exploited successfully.
"The vulnerability is caused due to an input validation error within the handling of system default URIs with registered URI handlers (e.g. 'mailto', 'news', 'nntp', 'snews', 'telnet')," Secunia said in its advisory.
Secunia said the vulnerability is confirmed on a fully patched Windows XP SP2 and Windows Server 2003 SP2 system using Firefox version 2.0.0.5 and Netscape Navigator version 9.0b2.
The United States Computer Emergency Readiness Team (US-CERT) also issued a US-CERT 783400 advisory, warning that Mozilla Firefox fails to properly filter input when sending certain URIs to registered protocol handlers.
"This vulnerability may allow a remote, authenticated attacker to execute commands on a vulnerable system," the agency said in its advisory.
Just installed the new version 2 seconds ago. My “tabs” weren’t working at all this morning. Must be why. Things seem OK now. Phew!
Linux users seem not to be affected by this since these are Windows-based issues.
Well it is a firefox issue but one that needs a certain environment to be attacked (Windows and IE7).
It also appears to be a Windows XP & Vista problem. (IE7 is unavailable for Windows 2000 & earlier.)
That would explain why Firefox keeps griping at me to restart.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.