ndmmxiaomayi SG From Secunia Description A vulnerability has been discovered in Firefox, which can be exploited by malicious people to compromise a user's system. The problem is that Firefox registers the "firefoxurl://" URI handler and allows invoking firefox with arbitrary command line arguments. Using e.g. the "-chrome" parameter it is possible to execute arbitrary Javascript in chrome context. This can be exploited to execute arbitrary commands e.g. when a user visits a malicious web site using Microsoft Internet Explorer. The vulnerability is confirmed in Firefox version 2.0.0.4 on a fully patched Windows XP SP2. Other versions may also be affected. Test codes Warning: Do not run this on your machine. If you wish to do so, please use a virtual machine or perform it on a test machine. All these codes are live; they will affect your machine. Anybody who disregards this message is not my problem. http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html http://larholm.com/vuln/firefoxurl.html Explantion An explanation of how this works is provided at: http://larholm.com/2007/07/10/internet-explorer-0day-exploit/ Prevention Avoid untrusted sites and disable the "Firefox URL" URI handler. I haven't found out how to disable the "Firefox URL" URI handler yet. Will post once I've figured out how. Or if anybody knows, please post it. Edit: Found out how to disable Firefox URL URI handler. 1. Open My Computer. 2. Click on Tools > Folder Options 3. Select File Types tab. 4. Under Extensions column, select None. Next to None, make sure it says Firefox URL. 5. Select it, click on Delete. a) If your Delete button is grayed out, click on Advanced b) A new window will open. Click Remove. If it is done properly, you should receive a warning:
ndmmxiaomayi SG From Secunia Description Michal Zalewski has discovered a vulnerability in Mozilla Firefox, which can be exploited by malicious people to disclose sensitive information and conduct spoofing attacks. The vulnerability is caused due to an error in the handling of the "wyciwyg://" URI handler. This can be exploited to access or spoof contents from a previously cached web site e.g. via HTTP 302 redirects when a user visits a malicious web page. The vulnerability is confirmed in version 2.0.0.4. Other versions may also be affected. Test codes Warning: Do not run this on your machine. If you wish to run it, use it on a virtual machine or a test machine. All these codes are live; they can modify your machine. Anybody who disregards this message is not my problem. http://lcamtuf.coredump.cx/ffcache/ Explanation The explanation is also provided at the above link provided for the exploit. Prevention Avoid untrusted sites. Other notes Didn't work on my Linux machine (maybe because it's Firefox 2.0.0.3 ?). I will test out on a Windows soon... Edit: Update: Works on Firefox 2.0.0.4 Windows SP2 Screenshots:
The man who was death SG got four url leh...got file transfer protocol, gopher protocol, hypertext transfer protocol and hypertext transfer with privacy..... delete which one??
The man who was death SG i think becos i still using 1.0.7..... i look at correct section.....maybe i shldn't be so worried 1.0.7 so old le...
ndmmxiaomayi SG Oh... like that no need worry... it only affects Firefox 2... I think... because of compatibility issue with Vista... which opened this hole.
revnon SG Think should be resolved. Download and Update to Firefox 2.0.0.5 via http://www.mozilla.com/en-US/firefox/ OR Just click on "Help" -> "Check for Updates..." for auto update to 2.0.0.5. ============================================================ Fixed in Firefox 2.0.0.5 MFSA 2007-25 XPCNativeWrapper pollution MFSA 2007-24 Unauthorized access to wyciwyg:// documents MFSA 2007-23 Remote code execution by launching Firefox from Internet Explorer MFSA 2007-22 File type confusion due to %00 in name MFSA 2007-21 Privilege escallation using an event handler attached to an element not in the document MFSA 2007-20 Frame spoofing while window is loading MFSA 2007-19 XSS using addEventListener and setTimeout MFSA 2007-18 Crashes with evidence of memory corruption ============================================================
ndmmxiaomayi SG An update to the vulnerabilities. While removing those Firefox URL (see post 1) will prevent a successful attack, the problem is far worse. You can read more about it here: http://mozillalinks.org/wp/2007/07/ies-unescaped-urls-vulnerability-also-present-in-firefox/ http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9027718&intsrc=hm_list Basically, any programs that you have uses Firefox to call another program will be vulnerable. One example is P2P. Bittorent and eDonkey are two examples which users can set in Firefox to call your P2P programs to download when you click on a torrent link. The next set of update will patch this same vulnerability again.
ndmmxiaomayi SG http://blog.mozilla.com/security/2007/07/23/related-security-issue-in-url-protocol-handling-on-windows/ Confirmed Firefox bug. Firefox 2.0.0.6 should be shipping soon.
ndmmxiaomayi SG Testers needed. http://forums.mozillazine.org/viewtopic.php?t=569539 The above link is for Linux and Mac testers. Firefox 2.0.0.5 password bug doesn't seem to be listed there. Edit: http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/latest-mozilla1.8/
ndmmxiaomayi SG Well, it turns out that all Internet related protocols are affected. mailto, nntp, news, etc are all affected. http://www.0x000000.com/?i=401 http://xs-sniper.com/blog/remote-command-exec-firefox-2005/ And works very well if the related application is a registered URI. Those who don't believe, click on the mailto link. If you are using Thunderbird, MS Outlook or any clients as your default email program, it will be launched.
ndmmxiaomayi SG Just tested it. One of the screenshots I took. Looks like Mozilla was right about not their fault (but too bad, they admitted already). Microsoft is at fault. Or maybe all OS. If that is so, it's not a program error, but rather how the OS handles it as long as it's allowed. Go to Start > Run and type in this: telnet:%00%00../../../../../../windows/system32/cmd".exe ../../../../../../../../windows/system32/calc.exe " - " blah.bat Command Prompt will open. One doesn't even need Firefox to trigger. Microsoft will do it PROPERLY and PROMPTLY for you.
ndmmxiaomayi SG Workarounds: If you have no other email clients other than Outlook Express installed, you will need to remove this as well: (NONE) URL:MailTo Protocol. After successfully de-registering them, you will either be prompted, see no actions or see errors. For Telnet when triggered within Firefox: For Telnet when triggered by using Start > Run:
ndmmxiaomayi SG Windows bug... why can't MS just admit it? http://www.kb.cert.org/vuls/id/403150 US-CERT has issued an article on it. News article: http://www.betanews.com/article/IE7Firefox_URI_Handling_Bug_Caused_by_Windows_After_All/1185811085
ndmmxiaomayi SG http://www.infoworld.com/article/07/08/15/New-URI-browser-flaws-worse-than-first-thought_1.html MS still don't want to admit!
ndmmxiaomayi SG http://xs-sniper.com/blog/2007/09/01/firefox-file-handling-woes/ Same URI vulnerability, but is affecting another part of Windows.
ndmmxiaomayi SG You need to read the first few posts to understand. Anyway, if your Firefox is the latest, all the exploits posted before today will not affect you.
fifteen SG i clicked on Help>Check for update but then they say no update. but how do i know my firefox is up to date?
