 |
 |
 |
 |
 |
Information about your favorite browser: news, articles and more.
Firefox still vulnerable to attacks from protocol handling bugs
Published September 5th, 2007 in Browser Security, Exploits & Vulnerabilities, Firefox
Billy Rios and Nate McFeters, who spelled out design and functionality vulnerabilities in Windows’ Uniform Resource Identifier (URI) protocol handling as recently as mid-August, said Saturday that they have uncovered another way hackers could send malicious code to users via browsers. "Once again, these URI payloads can be passed by the mailto, nntp, news, and snews URIs, allowing us to pass the payload without any user interaction," claimed Rios in a posting to his blog. "Although the conditions which allowed for remote command execution in Firefox 2.0.0.5 have been addressed with a security patch, the underlying file type handling issues which are truly the heart of the issue have NOT been addressed," he added.
URI bugs were a hot topic throughout July, when Norwegian researcher Thor Larholm showed how a browser could be tricked into sending malformed data from other applications. Firefox still vulnerable to attacks from protocol-handling bugs
