The Register® — Biting the hand that feeds IT

Feeds

Mozilla confirms own URL handling bug

'Turns out it's a problem with Firefox as well'

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

The Mozilla Foundation acknowledged over the weekend that its own Firefox browser allows links that can send malicious code to external programs, a security issue that the group had previously argued should be fixed by the browser maker.

In early July, three researchers found a way to execute code in Firefox - and potentially other Windows programs - by passing it a malicious uniform resource identifier (URI) from Internet Explorer.

The discovery lit off a firestorm of finger pointing: The Mozilla Foundation argued that IE should validate the URI before passing it along to another program, while Microsoft stated that input validation is the responsibility of the receiving program.

Over the weekend, another researcher discovered that Mozilla Firefox has the same security issue. The Mozilla Foundation acknowledged the problem on Monday.

"We thought this was just a problem with IE," Mozilla's chief security officer Window Snyder said in a blog post. "It turns out, it is a problem with Firefox as well."

In the latest versions of their products, Microsoft and the Mozilla Foundation have focused on security. In Internet Explorer 7, Microsoft added anti-phishing features, the ability to run in protected mode on its latest operating system, Windows Vista, and severely culled problematic ActiveX controls. In Firefox 2.0, the Mozilla Foundation also added anti-phishing features and the ability to clear private data.

Mozilla is now looking into the issue to determine its response to the problem.

This article originally appeared in Security Focus.

Copyright © 2007, SecurityFocus

Agentless Backup is Not a Myth

Latest Comments
Anonymous Coward

Re: Validate

"the only way IE could validate parameters passed to a 3rd part app is if the app provided an interface for it to validate against. it couldn't just validate everything against an IE defined set of rules. what might be invalid for your app could be valid for mine."

But IE shouldn't validate the parameters passed to the 3rd part app. The 3rd part app should validate the parameters.

As Dillon Pyron pointed out: "You should NEVER EVER trust another program to protect you from the bad guys."

Your suggestion only covers 'good programming'. If I wrote a program taking advantage of the exploit, and wanted to pass data to IE (or another program) in an attempt to do something on your system that I really shouldn't, do you rely on my code to follow the rules, and validate the data before passing them?

0
0

Validate

the only way IE could validate parameters passed to a 3rd part app is if the app provided an interface for it to validate against. it couldn't just validate everything against an IE defined set of rules. what might be invalid for your app could be valid for mine

0
0

Noscript

I love Noscript. I'm stuck with stable at work, so that's my cure. I haven't installed 2.0.0.6 RC at home because, well, because I'm too lazy. But I've got Noscript. I also resist using IE unless I absolutely have to.

I agree, IE should validate before sending to FF and FF should validate before sending to IE. BUT, FF should validate after receiving from IE and IE should validate after receiving from FF. You should NEVER EVER trust another program to protect you from the bad guys. To do so is either crap design, crap coding or pure laziness. Or more likely, a combination.

0
0

More from The Register

 breaking news
Number of cops abusing Police National Computer access on the rise
Only a telegram from the Queen can get you off it
 breaking news
NSA PRISM snoop-gate: Won't someone think of the children, wails Apple
10,000 things probed, mostly about missing kids, Alzheimer patients, we're told
 breaking news
NSA PRISM-gate: Relax, GCHQ spooks 'keep us safe', says Cameron
Whatever they are up to, it's all above board, we're told
PRISM snitch claims NSA hacked Chinese targets since 2009
Snowden suddenly looks safer in Hong Kong after revelations
 breaking news
US chief spook: Look, we only want to spy on 6.66 BEELLLION of you
Americans assured they are not in the NSA's sights
Flash flaw potentially makes every webcam or laptop a PEEPHOLE
But it's a Google problem - Chrome only, insists Adobe
Speech-to-text drives motorists to distraction
Will talking to you mean I crash into that car up ahead, Siri?
DHS warns of vulns in hospital medical equipment
Has your doctor's anasthesia machine been hacked?
 breaking news
'BadNews is malware' says outfit that found it
Google says code harmless but Lookout says code base is evolving
Panda-peddlers cuffed for chess gambling gambit
More porridge on the menu for Chinese coders after second offence