-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
A  U  S  C  E  R  T                                           A  L  E  R  T

                       AL-2007.0091 -- AUSCERT ALERT
                                   [Win]
       Mozilla Firefox unpatched URI filtering vulnerability allows
                             remote compromise
                               9 August 2007

===========================================================================

        AusCERT Alert Summary
        ---------------------

Product:              Firefox 2.0.0.5 and prior
Publisher:            US-CERT
Operating System:     Windows
Impact:               Execute Arbitrary Code/Commands
Access:               Remote/Unauthenticated
CVE Names:            CVE-2007-4041

Ref:                  AU-2007.0018

Original Bulletin:    http://www.kb.cert.org/vuls/id/783400

Comment: This is a newly reported vulnerability distinct from the
         URI issue described previously in AusCERT Alert AL-2007.0084.
         
         In this case a user's computer may be remotely compromised when
         visiting a malicious web page using Firefox or related browsers on
         Windows, if Internet Explorer 7 is also installed on the computer.
         
         This vulnerability remains unfixed in Firefox 2.0.0.5.

Revision History:  August 9 2007: Added CVE Name
                    July 27 2007: Initial Release

- --------------------------BEGIN INCLUDED TEXT--------------------

US-CERT Vulnerability Note VU#783400
Mozilla Firefox URI filtering vulnerability

Overview

	Mozilla Firefox does not filter input when sending certain URIs to
	registered protocol handlers. This may allow a remote, authenticated
	attacker to use Firefox as a vector for executing commands on a
	vulnerable system.

I. Description

	A Uniform Resource Identifier (URI) is a string of characters that
	can be used to identify a location, resource, or protocol. Mozilla
	Firefox passes some URIs to applications that have been registered
	to handle them.

	Firefox does not filter data passed to certain URIs. An attacker may
	be able to construct a malicious URI link that Firefox will pass to
	the registered URI handler. Public exploit code exists that uses
	mailto, news, nntp, snews, and telnet URI handlers. This public exploit
	code appears to rely upon having Internet Explorer 7 installed on a
	Microsoft Windows system. Also note that the technique used by the
	exploit code may affect applications other than Mozilla Firefox.

II. Impact

	A remote, unauthenticated attacker may be able to execute arbitrary
	commands, using Firefox as an attack vector.

III. Solution

	We are currently unaware of a practical solution to this problem.


	Workarounds for users

	    * Using the about:config interface, setting the
	      network.protocol-handler.warn-external-default,
	      network.protocol-handler.warn-external.mailto,
	      network.protocol-handler.warn-external.news,
	      network.protocol-handler.warn-external.nntp,
	      network.protocol-handler.warn-external.snews to true will make
	      Firefox display a prompt before sending a URI to an external
	      handler.
	    * Do not click on or follow untrusted links, or links that contain
	      %00 immediately following the protocol name.


	Workarounds for administrators

	    * Blocking mailto:%00, nntp:%00, news:%00, snews:%00, telnet:%00
	      strings inside of HTML pages or other network streams using an
	      application layer firewall or IPS may mitigate this vulnerability.
	      See the xs-sniper blog for more information about known vulnerable
	      URIs. Please note that these filters will only work for the public
	      exploit code that is currently available. Other variations of the
	      exploit code may be able to bypass these restrictions.

Systems Affected

	Vendor   Status      Date Updated
	Mozilla  Vulnerable  26-Jul-2007

References

	http://xs-sniper.com/blog/2007/07/24/remote-command-execution-in-firefox-2005/
	http://xs-sniper.com/blog/remote-command-exec-firefox-2005/
	http://kb.mozillazine.org/Firefox_:_FAQs_:_About:config_Entries
	https://bugzilla.mozilla.org/show_bug.cgi?id=389580
	http://en.wikipedia.org/wiki/Uniform_Resource_Identifier

Credit

	This vulnerability was disclosed by Billy (BK) Rios.

	This document was written by Ryan Giobbi.

Other Information

	Date Public	07/25/2007
	Date First Published	07/26/2007 04:02:37 PM
	Date Last Updated	07/26/2007
	CERT Advisory	 
	CVE Name	 
	Metric	25.51
	Document Revision	17

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        http://www.auscert.org.au/render.html?cid=1980

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBRrp2xSh9+71yA2DNAQL1XAP7BtVBaoWdIa6yiHkNjpa/2sy9H+nS/oYA
XW7DJfi17ofsH1fzPWGDl/aXrtwY+6BVdMmsUFOcir1JDbp1vz5XpFYNHqGfnlVf
TK5WHGMo5QAcgS6EdmWN3drjAOw5cu6119vVMJm4jRooweXMcIABvHfj3RdYTojE
C/wi9yq6Ilk=
=/nHA
-----END PGP SIGNATURE-----