Menu
Is IE or Firefox in the gun for browser zero-day?

Is IE or Firefox in the gun for browser zero-day?

Confusion reigns around a zero-day browser vulnerability made public on Tuesday, with four researchers or organisations squaring off over whether Microsoft's Internet Explorer or Mozilla's Firefox is at fault.

According to researcher Thor Larholm, the zero-day bug is in IE. "There is an input validation flaw in Internet Explorer that allows you to specify arbitrary arguments to the process responsible for handling URL protocols," Larholm said on his blog. That becomes a problem on PCs that also have Firefox 2.0.0.2 or later. Firefox, said Larholm, registers a URL protocol handler called FirefoxURL, designed to let web pages force a Firefox launch if the "firefoxurl://" uniform resource identifier (URI) is used.

IE doesn't perform any input validation on the protocol, which means an attacker can use IE to pass malicious a script -- JavaScript code, say -- to the browser. The result: a PC hijack. Symantec's analysts backed up Larholm's conclusion.

Larholm also said that the IE bug is similar to the input validation vulnerability in Safari 3.0 that he spotted the same day Apple released the Windows browser in beta.

Others, however, blamed Firefox for the vulnerability. In an email, Thomas Kristensen, chief technology officer at Danish bug tracker Secunia, did not dispute Larholm's findings but did have a problem with his conclusion. "This is in fact not an IE issue, it is a Firefox issue," said Kristensen. "The way in which the URL handler was registered by Firefox causes any parameter to be passed from IE (or another application) to Firefox when firefoxurl:// is activated." FrSIRT, a French company that also monitors vulnerabilities, agreed with Secunia.

"Registering a URI handler must be done with care," said Kristensen, "since Windows does not have any proper way of knowing what kind of input potentially could be dangerous for an application. Improper usage of URI handlers and parameters supplied via URIs has historically caused problems."

No matter which browser is to blame, it takes two to tango or, in this case, both must be present to let an attacker inject malicious code. Only PCs with Firefox 2.0.0.2 or later (Firefox's most recent update was to 2.0.04) are vulnerable, and then only if a person uses IE to surf to a malicious site sporting the firefoxurl:// protocol.

Secunia rated the threat as "highly critical," its second-highest ranking; FrSIRT, meanwhile, pegged it as "critical," its top warning. Several proof-of-concept exploits have been posted to security mailing lists or web sites, including one by Larholm and another by a researcher named Billy Rios, who goes by the initials BK.

No fixes -- for either Firefox or IE -- are available, although in a comment posted last month to a security message forum, Dan Veditz, a Mozilla developer, said the team is preparing a patch. "[We are] working on protecting users from this on our end for a future security update," said Veditz. Nonetheless, Veditz, like Larholm and Symantec, said IE should shoulder responsibility for the zero-day vulnerability.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags FirefoxInternet Explorer

Featured

Slideshows

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

More than 500 channel leaders gathered in Auckland on 21 October at the ​Reseller News Innovation Awards ​2020 to celebrate the achievements of the New Zealand technology industry's top partners, start-ups, vendors, distributors and individuals.

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners
Meet the winners of the 2020 Reseller News Innovation Awards

Meet the winners of the 2020 Reseller News Innovation Awards

Reseller News honoured the standout players of the New Zealand channel in front of more than 500 technology leaders in Auckland on 21 October, recognising the achievements of top partners, start-ups, vendors, distributors and individuals.

Meet the winners of the 2020 Reseller News Innovation Awards
Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Show Comments