Is IE or Firefox in the gun for browser zero-day?

Is IE or Firefox in the gun for browser zero-day?

Confusion reigns around a zero-day browser vulnerability made public on Tuesday, with four researchers or organisations squaring off over whether Microsoft's Internet Explorer or Mozilla's Firefox is at fault.

According to researcher Thor Larholm, the zero-day bug is in IE. "There is an input validation flaw in Internet Explorer that allows you to specify arbitrary arguments to the process responsible for handling URL protocols," Larholm said on his blog. That becomes a problem on PCs that also have Firefox or later. Firefox, said Larholm, registers a URL protocol handler called FirefoxURL, designed to let web pages force a Firefox launch if the "firefoxurl://" uniform resource identifier (URI) is used.

IE doesn't perform any input validation on the protocol, which means an attacker can use IE to pass malicious a script -- JavaScript code, say -- to the browser. The result: a PC hijack. Symantec's analysts backed up Larholm's conclusion.

Larholm also said that the IE bug is similar to the input validation vulnerability in Safari 3.0 that he spotted the same day Apple released the Windows browser in beta.

Others, however, blamed Firefox for the vulnerability. In an email, Thomas Kristensen, chief technology officer at Danish bug tracker Secunia, did not dispute Larholm's findings but did have a problem with his conclusion. "This is in fact not an IE issue, it is a Firefox issue," said Kristensen. "The way in which the URL handler was registered by Firefox causes any parameter to be passed from IE (or another application) to Firefox when firefoxurl:// is activated." FrSIRT, a French company that also monitors vulnerabilities, agreed with Secunia.

"Registering a URI handler must be done with care," said Kristensen, "since Windows does not have any proper way of knowing what kind of input potentially could be dangerous for an application. Improper usage of URI handlers and parameters supplied via URIs has historically caused problems."

No matter which browser is to blame, it takes two to tango or, in this case, both must be present to let an attacker inject malicious code. Only PCs with Firefox or later (Firefox's most recent update was to 2.0.04) are vulnerable, and then only if a person uses IE to surf to a malicious site sporting the firefoxurl:// protocol.

Secunia rated the threat as "highly critical," its second-highest ranking; FrSIRT, meanwhile, pegged it as "critical," its top warning. Several proof-of-concept exploits have been posted to security mailing lists or web sites, including one by Larholm and another by a researcher named Billy Rios, who goes by the initials BK.

No fixes -- for either Firefox or IE -- are available, although in a comment posted last month to a security message forum, Dan Veditz, a Mozilla developer, said the team is preparing a patch. "[We are] working on protecting users from this on our end for a future security update," said Veditz. Nonetheless, Veditz, like Larholm and Symantec, said IE should shoulder responsibility for the zero-day vulnerability.

Follow Us

Join the newsletter!


Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags FirefoxInternet Explorer



Ingram Micro launches Showcase 2018 in Christchurch

Ingram Micro launches Showcase 2018 in Christchurch

Ingram Micro kickstarted Showcase 2018 in Christchurch, hosting more than 40 vendors at Horncastle Arena. Under the banner of Leading the Way, the event demonstrated what’s new, what’s next and how it can be used to improve business and everyday life.

Ingram Micro launches Showcase 2018 in Christchurch
Data breach notification laws in NZ: How can partners prepare?

Data breach notification laws in NZ: How can partners prepare?

This exclusive Reseller News Roundtable outlined the responsibilities facing security partners today, assessing risk while evaluating the role of the vendor in providing added layers of protection.

Data breach notification laws in NZ: How can partners prepare?
Show Comments