IE or Firefox: Who's to blame for newest browser zero-day?
Both browsers must be present for the vulnerability to be exploited
July 11, 2007 12:00 PM ETComputerworld - Confusion reigns around a zero-day browser vulnerability made public yesterday, with four researchers or organizations squaring off over whether Microsoft Corp.'s Internet Explorer or Mozilla Corp.'s Firefox is at fault.
According to researcher Thor Larholm, the zero-day bug is in IE. "There is an input validation flaw in Internet Explorer that allows you to specify arbitrary arguments to the process responsible for handling URL protocols," Larholm said on his blog. That becomes a problem on PCs that also have Firefox 2.0.0.2 or later. Firefox, said Larholm, registers a URL protocol handler called FirefoxURL, designed to let Web pages force a Firefox launch if the "firefoxurl://" uniform resource identifier (URI) is used.
IE doesn't perform any input validation on the protocol, which means an attacker can use IE to pass malicious a script -- JavaScript code, say -- to the browser. The result: a PC hijack. Symantec Corp.'s analysts backed up Larholm's conclusion.
Larholm also said that the IE bug is similar to the input validation vulnerability in Safari 3.0 that he spotted the same day Apple Inc. released the Windows browser in beta.
Others, however, blamed Firefox for the vulnerability. In an e-mail, Thomas Kristensen, chief technology officer at Danish bug tracker Secunia, did not dispute Larholm's findings but did have a problem with his conclusion. "This is in fact not an IE issue, it is a Firefox issue," said Kristensen. "The way in which the URL handler was registered by Firefox causes any parameter to be passed from IE (or another application) to Firefox when firefoxurl:// is activated." FrSIRT, a French company that also monitors vulnerabilities, agreed with Secunia.
"Registering a URI handler must be done with care," said Kristensen, "since Windows does not have any proper way of knowing what kind of input potentially could be dangerous for an application. Improper usage of URI handlers and parameters supplied via URIs has historically caused problems."
No matter which browser is to blame, it takes two to tango or, in this case, both must be present to let an attacker inject malicious code. Only PCs with Firefox 2.0.0.2 or later (Firefox's most recent update was to 2.0.04) are vulnerable, and then only if the victim uses IE to surf to a malicious site sporting the firefoxurl:// protocol.
Secunia rated the threat as "highly critical," its second-highest ranking; FrSIRT, meanwhile, pegged it as "critical," its top warning. Several proof-of-concept exploits have been posted to security mailing lists or Web sites, including one by Larholm and another by a researcher named Billy Rios, who goes by the initials BK.
No fixes -- for either Firefox or IE -- are available, although in a comment posted last month to a security message forum, Dan Veditz, a Mozilla developer, said the team is preparing a patch. "[We are] working on protecting users from this on our end for a future security update," said Veditz. Nonetheless, Veditz, like Larholm and Symantec, said IE should shoulder responsibility for the zero-day vulnerability.
"I do think IE should escape quotes in URLs (RFC 1738 considers them an 'unsafe' character in URLs), but the Firefox team has been looking into back-stop protection in our app since we saw Thor Larholm's Safari 0-day post," Veditz wrote.
Read more about security in Computerworld's Security Knowledge Center.
Mozilla
Additional Resources



White Papers & Webcasts
Death to PST Files
Download Now
The Tangled Web: Silent Threats & Invisible Enemies
Download Now
Tape Killed the IT Guy
Watch Now
Forrester Consulting Mobility Study: Taking Control of Enterprise Mobile Device Diversity
Download Now
BRM: What You Can Do To Reduce Risk In Challenging Times
Watch this webcast now!
What IT Must Do to Support Employee-Owned BlackBerry, iPhone and Android Mobile Devices
Download Now
Web 2.0, Social Media and the Dark Web - A Web Criminals Paradise?
In this discussion, learn about the challenges of protecting your users from the potentially unsafe content hidden in the "Dark Web".
eGuide: Enterprise Security
Smart Security Strategies for 2010. Read now!
Disaster Recovery 2008: Reduced Costs and Improved Performance
How long can your Enterprise afford to be without your data? With an accelerated disaster recovery program, you never have to answer this...

