IE or Firefox: Who's to blame for newest browser zero-day?
Both browsers must be present for the vulnerability to be exploited
Computerworld - Confusion reigns around a zero-day browser vulnerability made public yesterday, with four researchers or organizations squaring off over whether Microsoft Corp.'s Internet Explorer or Mozilla Corp.'s Firefox is at fault.
According to researcher Thor Larholm, the zero-day bug is in IE. "There is an input validation flaw in Internet Explorer that allows you to specify arbitrary arguments to the process responsible for handling URL protocols," Larholm said on his blog. That becomes a problem on PCs that also have Firefox 184.108.40.206 or later. Firefox, said Larholm, registers a URL protocol handler called FirefoxURL, designed to let Web pages force a Firefox launch if the "firefoxurl://" uniform resource identifier (URI) is used.
Larholm also said that the IE bug is similar to the input validation vulnerability in Safari 3.0 that he spotted the same day Apple Inc. released the Windows browser in beta.
Others, however, blamed Firefox for the vulnerability. In an e-mail, Thomas Kristensen, chief technology officer at Danish bug tracker Secunia, did not dispute Larholm's findings but did have a problem with his conclusion. "This is in fact not an IE issue, it is a Firefox issue," said Kristensen. "The way in which the URL handler was registered by Firefox causes any parameter to be passed from IE (or another application) to Firefox when firefoxurl:// is activated." FrSIRT, a French company that also monitors vulnerabilities, agreed with Secunia.
"Registering a URI handler must be done with care," said Kristensen, "since Windows does not have any proper way of knowing what kind of input potentially could be dangerous for an application. Improper usage of URI handlers and parameters supplied via URIs has historically caused problems."
No matter which browser is to blame, it takes two to tango or, in this case, both must be present to let an attacker inject malicious code. Only PCs with Firefox 220.127.116.11 or later (Firefox's most recent update was to 2.0.04) are vulnerable, and then only if the victim uses IE to surf to a malicious site sporting the firefoxurl:// protocol.
Secunia rated the threat as "highly critical," its second-highest ranking; FrSIRT, meanwhile, pegged it as "critical," its top warning. Several proof-of-concept exploits have been posted to security mailing lists or Web sites, including one by Larholm and another by a researcher named Billy Rios, who goes by the initials BK.
No fixes -- for either Firefox or IE -- are available, although in a comment posted last month to a security message forum, Dan Veditz, a Mozilla developer, said the team is preparing a patch. "[We are] working on protecting users from this on our end for a future security update," said Veditz. Nonetheless, Veditz, like Larholm and Symantec, said IE should shoulder responsibility for the zero-day vulnerability.
"I do think IE should escape quotes in URLs (RFC 1738 considers them an 'unsafe' character in URLs), but the Firefox team has been looking into back-stop protection in our app since we saw Thor Larholm's Safari 0-day post," Veditz wrote.
Read more about Security in Computerworld's Security Topic Center.
- Radicati: Cloud Business Email - Market Quadrant 2013 Google was named the top cloud business email provider in a recent report by research firm Radicati. Out of 14 key players, Google...
- Tablets in the Enterprise: A Checklist for Successful Deployment How can you enterprise manage and secure tablets in order to protect corporate data while providing access to the information and applications employees...
- Enterprise Mobility: A Checklist for Secure Containerization The advantages and disadvantages of the multiple approaches to containerization. Learn More>>
- Enterprise File Sync & Share Checklist File sync and share has changed the way people work and collaborate in today's tech-savvy world. Gone are the email roadblocks, clunky FTP...
- Live Webcast LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- LIVE EVENT: 5/7, The End of Data Protection As We Know It. Introducing a Next Generation Data Protection Architecture. Traditional backup is going away, but where does this leave end-users?
- On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy... All Security White Papers | Webcasts