Firefox vulnerable to protocol-handling bug attacks

Firefox vulnerable to protocol-handling bug attacks

Security researchers claim Firefox issues not addressed

Firefox remains vulnerable to attacks exploiting protocol-handling bugs, even though it was patched twice in July, a pair of security researchers said.

Billy Rios and Nate McFeters, who spelt out design and functionality vulnerabilities in Windows' Uniform Resource Identifier (URI) protocol handling mid-August, said they had uncovered another way hackers could send malicious code to users via browsers.

"Once again, these URI payloads can be passed by the mailto, nntp, news, and snews URIs, allowing us to pass the payload without any user interaction," claimed Rios in a posting to his blog. "Although the conditions which allowed for remote command execution in Firefox have been addressed with a security patch, the underlying file type handling issues which are truly the heart of the issue have NOT been addressed," he added.

URI bugs were a hot topic throughout July, when Norwegian researcher Thor Larholm showed how a browser could be tricked into sending malformed data from other applications. Although Larholm initially blamed Internet Explorer for the flaw, others pointed out that Firefox suffered from the same bug. A finger-pointing debate ensued.

Rios and McFeters didn't divulge how an attacker could exploit the new-found URI flaws, saying that they are giving Mozilla's security team time to plug the hole. However, they did post a screenshot that they said showed how they used the mailto URI -- the string used on Web pages that, when clicked, open up the user's default email client with an address already inserted -- to eventually call up any desired malware.

Although Mozilla was not immediately available for comment Tuesday, the vulnerability could not have come as much of a surprise. In the 2007-027 security advisory -- one of two issued in the update to version on July 30 -- Mozilla presciently noted that more bugs might be hidden in protocol handling.

"The Firefox release contains fixes that prevent the original demonstrations of this variant, but it is still possible to launch a filetype handler based on extension rather than the registered protocol handler," stated the advisory. "A way to exploit a common handler with a single unexpected URI as an argument may yet be found."

Microsoft has repeatedly said protocol handling problems are up to individual applications to address, not Windows itself. In August, Mark Griesi, a security program manager with Microsoft, told IDG News that Microsoft was free of blame. "Security is an industry responsibility and this is certainly a case of that [principle]," said Griesi then. "It's not Microsoft's position to be the gatekeeper of all third-party applications." Microsoft modified documents on its MSDN (Microsoft Developer Network) site around the same time to reflect that stance.

Although some security experts said hackers would turn to these unorthodox attack tactics, no evidence of use in the wild has yet surfaced.

Follow Us

Join the ARN newsletter!

Error: Please check your email address.



 IN PICTURES: VeeamON Tour in Sydney and Melbourne (+ 17 photos)

IN PICTURES: VeeamON Tour in Sydney and Melbourne (+ 17 photos)

The VeeamON tour showcased company's upcoming release of the Veeam Availability Suite v9. Veeam product strategist, Rick Vanover led the discussions in Sydney and Melbourne about the upcoming v9 and other Veeam innovations for the new year.​ VeeamON was held on September 23 at the Museum of Sydney, Warrane Theatre, and at Melbourne Museum in Melbourne on September 24.

IN PICTURES: VeeamON Tour in Sydney and Melbourne (+ 17 photos)
 IN PICTURES: Greentree A/NZ Partners Explore Japan (+ 13 PHOTOS)

IN PICTURES: Greentree A/NZ Partners Explore Japan (+ 13 PHOTOS)

As part of a regular strategic planning program for select Greentree A/NZ partners, they enjoyed a week in Japan combining strategic planning sessions with sightseeing. Principals and their partners from Star Business Solutions, Endeavour Solutions, Addax Business Solutions, GT Business Solutions, bizlinkIT and Verde Group joined Greentree chief executive, Peter Dickinson, channel director, Graham Hill, and R&D director, Stephen Sims in Tokyo and took in Hiroshima, Kyoto and Hakone, including travel on the famed bullet train which hit a top speed of 296 KPH.

IN PICTURES: Greentree A/NZ Partners Explore Japan (+ 13 PHOTOS) is a channel management ecosystem that automates all major aspects of the entire sales, marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.

Show Comments