What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Discussion

Multiple Browsers 0-day Vulns

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Post #1
FYI…

> http://secunia.com/advisories/25984/
Release Date: 2007-07-10
Critical: Highly critical
Impact: System access
Where: From remote
Solution Status: Unpatched
Software: Mozilla Firefox 2.0.x …
The vulnerability is confirmed in Firefox version 2.0.0.4 on a fully patched Windows XP SP2. Other versions may also be affected.
Solution:
- Do not browse untrusted sites.
- Disable the "Firefox URL" URI handler…
Original Advisory:
http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html

>>> http://larholm.com/2007/07/10/internet-exp…r-0day-exploit/ …"


> http://secunia.com/advisories/25990/
Release Date: 2007-07-10
Critical: Less critical
Impact: Spoofing, Exposure of sensitive information
Where: From remote
Solution Status: Unpatched
Software: Mozilla Firefox 2.0.x …
Solution: Do not browse untrusted web sites.
Provided and/or discovered by: Michal Zalewski …

:ph34r:
Post #2 last edited
FYI…

- http://isc.sans.org/diary.html?storyid=3121
Last Updated: 2007-07-10 19:59:27 UTC - "…So where does IE come into play against Firefox ?
Firefox seems to prevent access to the command line, but IE happily calls the URL handler and as such provides a path to the command line via the handler installed by Firefox. As a result the IE user on a machine that has Firefox installed is at risk. A workaround is to remove the URL handlers installed by Firefox from the registry. I'm sure the developers of Firefox can undo the damage done to systems in a next patch. This however goes to show that even unused but installed client programs might be a threat on your client system. Hence you need to take care of vulnerabilties in software that you don't even use…"

Also:
- http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3550
Last revised: 7/5/2007
Base score: 7.8 (High)
Impact Subscore: 6.9
Exploitability Subscore: 10.0
Range: Network exploitable
Authentication: Not required to exploit
Impact Type: Allows disruption of service

- http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-3670
7/10/2007

:ph34r:
Post #4
FYI…

- http://blog.mozilla.com/security/2007/07/1…ing-on-windows/
10 July 2007 - "… -Any- Windows application that calls a registered URL protocol without escaping quotes may be used to pass unexpected and potentially dangerous data to the application that registers that URL Protocol. This could result in a critical security vulnerability. The vulnerability is exposed when a user browses to a malicious web page in Internet Explorer and clicks on a specially crafted link. That link causes Internet Explorer to invoke another Windows program via the command line and then pass that program the URL from the malicious webpage without escaping the quotes. This can cause data to be passed accidentally from the malicious web page to the second Windows program. In the specific attack described in the report, Internet Explorer sends URL data to Firefox. If the data is crafted a certain way it will allow remote code execution in Firefox… Mozilla believes in defense in depth and will be patching Firefox in the upcoming 2.0.0.5 release to mitigate the problem. This will prevent IE from sending Firefox malicious data. Other Windows programs may also be vulnerable to bad data being passed from IE…"

- http://wiki.mozilla.org/WeeklyUpdates/2007….0.13.2F2.0.0.5
2007-07-09 - "…targeting 7/31 for release date…"

.
Post #6
FYI…

- http://preview.tinyurl.com/ytjep2
July 18, 2007 - (Mozilla Security Blog) - "Firefox 2.0.0.5 is now available and there is a fix for the URL protocol handling issue… We warned that other Windows applications may be vulnerable to this Internet Explorer issue, and on Sunday Nate Mcfeters, Billy Rios, and Raghav Dube posted a proof of concept that demonstrates the same attack through Internet Explorer to execute code in Trillian. Additionally, Thor Larholm says*…"

* http://larholm.com/2007/07/18/firefox-fixe…-explorer-flaw/
July 18, 2007 - "… I can still automatically launch a wide range of external applications from Internet Explorer and provide them with arbitrary command line arguments. AcroRd32.exe (Adobe Acrobat PDF Reader), aim.exe (AOL Instant Messenger), Outlook.exe, msimn.exe (Outlook Express), netmeeting.exe, HelpCtr.exe (Windows Help Center), mirc.exe, Skype.exe, wab.exe (Windows Address Book) and wmplayer.exe (Windows Media Player) - just to name a few. I can categorically deny that this flaw has been fixed in Internet Explorer. Nicolas Robillard even detailed this flaw back in 2004 and it has remained unpatched since long before then…"

.
Post #7 last edited
FYI…

- http://preview.tinyurl.com/25dtqf
July 23, 2007 - (Mozilla Security Blog) - "…While browsing with Firefox, a specially crafted URL could potentially be used to send bad data to another application. We thought this was just a problem with IE. It turns out, it is a problem with Firefox as well. We should have caught this scenario when we fixed the related problem in 2.0.0.5. We believe that defense in depth is the best way to protect people, so we’re investigating it now… For more information:
https://bugzilla.mozilla.org/show_bug.cgi?id=389106 …
Bug 389106 – firefox may not escape quotes everywhere
Status: RESOLVED FIXED
Modified: 2007-07-25 …"

Firefox exploit published
- http://preview.tinyurl.com/2yhuwk
July 25, 2007 - (InfoWorld) - "… Mozilla is planning to fix this issue in the upcoming 2.0.0.6 release of its browser. Snyder did not say when…"

:ph34r:

> http://www.kb.cert.org/vuls/id/783400
26-Jul-2007
"…Workarounds for users
* Using the about:config interface, setting the
network.protocol-handler.warn-external-default,
network.protocol-handler.warn-external.mailto,
network.protocol-handler.warn-external.news,
network.protocol-handler.warn-external.nntp,
network.protocol-handler.warn-external.snews
…to true will make Firefox display a prompt before sending a URI to an external handler.
* Do not click on or follow untrusted links, or links that contain [percent-00] immediately following the protocol name.

Workarounds for administrators
* Blocking mailto:, nntp:, news:, snews:, telnet: strings inside of HTML pages or other network streams using an application layer firewall or IPS may mitigate this vulnerability… Please note that these filters will only work for the public exploit code that is currently available. Other variations of the exploit code may be able to bypass these restrictions…"

.
Post #8 last edited
FYI…

Microsoft Windows URI Protocol Handling Vulnerability
- http://www.us-cert.gov/current/#microsoft_…otocol_handling
added July 27, 2007 - " US-CERT is aware of a vulnerability in the way Microsoft Windows determines how to handle URIs, which may be be leveraged by a remote attacker to execute arbitrary commands on an affected system. Public reports demonstrate that Mozilla Firefox can be used to pass malicious URIs to Windows, but other applications may also act as attack vectors for this vulnerability. More information regarding this vulnerability can be found in Vulnerability Note VU#403150*."
* http://www.kb.cert.org/vuls/id/403150

—————

Mozilla Firefox URI Sanitization Vulnerability
- http://www.us-cert.gov/current/#multiple_w…ri_sanitization
updated July 27, 2007 - "US-CERT is aware of a vulnerability (VU#783400**) in the way Mozilla Firefox passes URIs to registered protocol handlers in Microsoft Windows. Due to a separate vulnerability (VU#403150*) in the way Windows determines how to execute URIs, Firefox could be used as an attack vector to execute arbitrary commands."
** http://www.kb.cert.org/vuls/id/783400

:ph34r: :ph34r:
===================

Related:
- http://blog.ceruleanstudios.com/?cat=7
"…You can thank the three geniuses behind the vulnerability report for their professionalism (read: none) in reporting this vulnerability to the vendor before public disclosure. To the rest of #hack: we’re happy to responsibly fix vulnerabilities as they’re found, but would appreciate some advance notice."