Firefox users beware
According to the website Secunia the Firefox vulnerability be exploited by malicious people to compromise a user's system.
A successful attack requires an Internet user to click on an unsafe link which is generally achieved through either a malicious website or an HTML email.
“The problem is that Firefox registers the "firefoxurl://" URI handler and allows invoking firefox with arbitrary command line arguments. Using e.g. the "-chrome" parameter it is possible to execute arbitrary Javascript in chrome context,” the Secunia website states.
“This can be exploited to execute arbitrary commands e.g. when a user visits a malicious web site using Microsoft Internet Explorer.”
According to Secunia the vulnerability is confirmed in Firefox version 2.0.0.4 on a fully patched Windows XP SP2. Other versions may also be affected.
Users are advised to steer clear of unknown and untrusted websites and disable the "Firefox URL" URI handler.
Mozilla developing a fix
There was initially some confusion as to which browser – IE or Firefox – was vulnerable to attack, but the Secunia CTO Thomas Kristensen pointed out that “this is in fact NOT an IE issue – it is a Firefox issue.”
According to ZDNet’s Ryan Naraine blog Mozilla security chief Window Snyder said that they [Mozilla] “are aware of this issue and we are developing a fix. Mozilla is committed to delivering the safest online experience for its users.”
Loading ...