Related Security Issue in URL Protocol Handling on Windows
07.23.07 - 04:46pm
On July 10th, I posted about a security issue in URL protocol handling on Windows. In the previous example, Internet Explorer was the entry point and Firefox was the application receiving the bad data.
Over the weekend, we learned about a new scenario that identifies ways that Firefox could also be used as the entry point. While browsing with Firefox, a specially crafted URL could potentially be used to send bad data to another application.
We thought this was just a problem with IE. It turns out, it is a problem with Firefox as well. We should have caught this scenario when we fixed the related problem in 2.0.0.5. We believe that defense in depth is the best way to protect people, so we’re investigating it now.
We are working to make sure that we are giving you as much information about pressing security issues as possible. We make real-time updates as we find out new information because we are committed to an open and transparent security process.
For more information: https://bugzilla.mozilla.org/show_bug.cgi?id=389106
I think Alun Jones hits the nail right on the head in this item:
http://msmvps.com/blogs/alunj/archive/2007/07/22/firefoxurl-url-vulnerability.aspx
and in his comment here regarding the C/C++ argument point:
http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx#6570
Bug 389106 is already fixed, big kudos for biesi and the other moz devs!
While we’re waiting for Firefox 2.0.0.6 to ship, NoScript users can enjoy an early fix: http://noscript.net/getit#direct
I just got an automatic update from Firefox that needed to be installed. Half way through the installation, it quit saying that my current security settings did not permit me to install the updates. The program was so hung up that I had to uninstall Fire Fox all together. When I tried to reinstall Fire Fox, I got the same message saying that my current security set up did not allow me to install Fire Fox. How do I fix this ? Bill
My apologies for the previous comment about the delay of moderation… I think, anyway that the solution lie only in a redefinition of firefoxurl URI handler… actually the quotes can be used to create bad formed url, no matter what patches you release…
Both Microsoft and Mozilla are wrong on this one.
Microsoft either:
1. Should have used an array of strings as opposed to a single string for CreateProcess and WinMain.
2. Should have written ShellExecute a less naive way that validates the format string and takes an array of strings instead of a string for parameters to do things the argc/argv way.
3. Shouldn’t have used ShellExecute for url handlers.
Given the above situation, it’s my opinion that IE is doing the correct thing and that Mozilla is doing the incorrect thing by trying to do things based on argc/argv instead of GetCommandLine because:
1. The ShellExecute way has 10+ years of precedence.
2. The ShellExecute way of URL handlers has been documented forever and “fixing” this would break some apps.
3. If Firefox tries to do it the argc/argv way, there will be a hodgepodge of programs that read the documentation and did it the IE way and others that expect the command line to work the argc/argv way. That would be an even bigger nightmare than we have now.
4. Trying to tack on the argc/argv way given the above model is lossy and will lead to multiple escaping/unescaping which breaks the preservation recommendation in rfc3986.
A hacker could use Firefox to launch another application, and possibly run malicious instructions. Now there is even some speculation that the bug is not even the fault of the browser, but is actually a flaw in Windows. Man, I can’t remember the last time that no one would take responsibility for a security-related bug like this.
been hypocritical not to fix the similar issue in Firefox. The Mozilla Security Blog post about the URL protocol handling flaw states that “defense in depth is the best way to protect people” (although that weblog
I use IE on my personal computer but Firefox is common on the PCs at the internet cafes here in Prague. Many hotels also use Firefox as the browser of choice on their computers reserved for guests.
It’s my estimation that a problem occurring on both browsers on Microsoft should be fixed before we all chuck it and switch to those cool Apples that have just come out. Yeah!
I think this is a good blog & this information is very helpful & My site Christian counseling is about counseling in Dallas, Palno, Richardson.