-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2007.0084 -- AUSCERT ALERT
                                   [Win]
            Mozilla Firefox URL protocol handling vulnerability
                               12 July 2007

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Firefox 2.0.0.4 and prior
Publisher:            US-CERT
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated

Original Bulletin:    http://www.kb.cert.org/vuls/id/358017

- --------------------------BEGIN INCLUDED TEXT--------------------

US-CERT Vulnerability Note VU#358017
Mozilla Firefox URL protocol handling vulnerability

Overview

        Mozilla Firefox protocol handlers may allow remotely supplied
        JavaScript to execute with elevated privileges. This may allow a
        remote, unauthenticated attacker to execute arbitrary code on a
        vulnerable system.

I. Description

        Mozilla Firefox installs protocol handlers for Mozilla-specific
        protocols, such as the FirefoxURL and FirefoxHTML protocols. If
        Microsoft Windows encounters a URL protocol it cannot handle natively
        it searches the Windows registry for the appropriate protocol handler.
        When the correct protocol handler is found, Windows passes it the URL
        string. By design Windows passes the URL string to the protocol
        handler as it was received without performing any sanitization.

        Mozilla Firefox URL protocol handlers are constructed in a way that
        may allow a remote attacker to execute arbitrary JavaScript with
        elevated (chrome) privileges. Mozilla Firefox security restrictions
        detect and prevent the execution of such JavaScript. However, if a
        remote attacker can persuade a user with Firefox installed to access
        a specially crafted web page using Internet Explorer, and perhaps
        other Windows applications, the malicious JavaScript will be
        executed. Reports claim this vulnerability is introduced when
        Firefox versions 2.0.0.2 and later are installed.

        Exploit code is publicly available for this vulnerability.

II. Impact

        This vulnerability may allow a remote, unauthenticated attacker to
        execute JavaScript with elevated (chrome) privileges. This
        essentially means that the attacker can execute arbitrary code with
        the privileges of the user.

III. Solution

        We are unaware of a practical solution to this problem. Until a
        solution is available the following workaround may prevent known
        exploits from working:


        Unregister the Firefox protocols

        Disabling the Mozilla Firefox protocol handlers will mitigate this
        vulnerability. To unregister the protocol handlers, delete or rename
        the following registry keys:

            HKEY_CLASSES_ROOT\FirefoxURL
            HKEY_CLASSES_ROOT\FirefoxHTML

        Modifying the Windows registry may have unintended consequences and
        should be done with care.

Systems Affected

        Vendor                  Status    Date Updated
        Microsoft Corporation   Unknown   10-Jul-2007
        Mozilla                 Unknown   11-Jul-2007

References

        http://www.virusbtn.com/news/virus_news/2007/07_11.xml
        http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/

Credit

        This vulnerability was publicly disclosed by Thor Larholm.

        This document was written by Jeff Gennari.

Other Information

        Date Public             07/10/2007
        Date First Published    07/11/2007 10:53:35 AM
        Date Last Updated       07/11/2007
        CERT Advisory
        CVE Name
        Metric                  19.69
        Document Revision       57


- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRpV0XSh9+71yA2DNAQK24AP/dAdXbaGLjUHKaxE3SZg/El5vUMTeIhrO
VkhJjYk317MP8+Si/Y17EIkE1XP3k+5d5VOUas3FI9rjXjVg+bUAhigSyBgekmFy
Zd5tbxBvP83uCO0fLnYNVz6HxohQYdAWEUGK2N7vyRJGdX3jvLM+9B+BXett6Bb9
IJFvYW1szcE=
=i6LK
-----END PGP SIGNATURE-----