New vulnerability for the couple Windows/Firefox 2007-07-27
A little more than one week ago, left a new version maintenance of the navigator Web Firefox estampillée 2.0.0.5 with the correction of several bugs of safety including one allotted initially by the Mozilla Foundation, to Internet Explorer (exploit of safety firefoxurl: /).
After more deepened investigation, the Mozilla Foundation ended up putting water in its wine, recognizing its own responsibility and not rejecting more the fault on Microsoft.
Always vulnerable Firefox 2.0.0.5
Obviously, Firefox did not finish any with its problems of management of parameters passed in an address of the type URI since a bulletin of alarm published by FrSIRT teaches us that: “A vulnerability was identified in Mozilla Firefox, it could be exploited by attackers in order to compromise a vulnerable system where Internet Explorer 7 was installed. This problem results from an error presents at the level of the treatment of the arguments sent via certain recorded protocols (“mailto: ”, “NNTP: ”, “news: ”, “snews: ” or “telnet: ”), which could be exploited by attackers in order to carry out arbitrary orders in incentive a user to visit a malicious Web page. “
This vulnerability identified in Firefox 2.0.0.5 also was the subject of a bulletin of alarm (highly critical) emitted by Secunia, with a distinction close which will not fail to revive the polemic, since the experts of the Danish company allotted the vulnerability to Windows. Secunia thus confirms the presence of the fault in Windows XP SP2 while announcing mechanism same of exploitation as FrSIRT (presence of Internet Expl
