Author Topic: New cross browser zero day vulnerability for IE!  (Read 6042 times)

0 Members and 1 Guest are viewing this topic.

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
New cross browser zero day vulnerability for IE!
« on: July 10, 2007, 01:14:12 PM »
Hello malware fighters,

A new dangerous cross browser zero day hole has been found up for IE:
http://larholm.com/2007/07/10/internet-explorer-0day-exploit/
There are no exploits in the wild found at the moment, but why it is announced at Patch Tuesday?
Again, again when you have NoScript extension enabled in FF or Flock, you have nothing to fear
from the arbitrary javascript code for this cross browser command injection hole.

polonus

Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: New cross browser zero day vulnerability for IE!
« Reply #1 on: July 10, 2007, 03:19:42 PM »
Well I have NoScript on firefox 2.0.0.4, but more importantly it would appear that you get an external protocol request pop-up notification (see image), contrary to someone saying that it works on 2.0.0.4. Now I believe the alert is a firefox on rather than anything to do with NoScript.

I even gave temp permission for larholm.com in NoScript and I still got the alert, so it doesn't look as if it is functional on firefox 2.0.04 unless the user gives permission for the external application/process to run.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: New cross browser zero day vulnerability for IE!
« Reply #2 on: July 11, 2007, 02:19:05 PM »
Quote
Security firm Secunia has issued an advisory regarding a newly discovered "highly critical" security flaw in Firefox 2.0 and later, which involves a special URI handler. Although the problem was initially attributed to Internet Explorer by researcher Thor Larholm, Firefox is the culprit.

According to Secunia, "Firefox registers the "firefoxurl://" URI handler and allows invoking Firefox with arbitrary command line arguments." This means that a malicious site visited in Internet Explorer could pass parameters using that URI handler that would be run automatically in Firefox, without any sort of validation. The firm suggests not visiting untrusted sites until the problem is resolved.

http://www.betanews.com/article/Highly_Critical_Flaw_in_Firefox_20/1184081542

Some interesting comments:

Quote
By Scotch Moose    posted Jul 10, 2007 - 2:35 PM

The reason for this is that the FirefoxURL handler was added in Firefox 2.0.0.2 as part of a Vista compatibility change. Microsoft asked for it.

The lack of input validation is still a flaw in IE, even if Firefox could have registered their URL protocol handler with DDE instead.

I don't think we will see Firefox fixed to not accept command line arguments. And don't stay awake waiting for Microsoft to validate input before launching a URL handler. Your best bet is to remove the URL protocol handlers, that is if you must run Windows.

Really, who thinks launching executable programs with a browser based on the content of web page is a good idea? This is even worse than ActiveX.

 By bourgeoisdude    posted Jul 10, 2007 - 2:54 PM

"Really, who thinks launching executable programs with a browser based on the content of web page is a good idea? This is even worse than ActiveX."

Sadley, Dell, HP, Norton, McAfee, Trend Micro, and countless other manufacturers use this technology for their driver reinstall discs/online virus scans/active updates/etc. It's tough to kill it because so many people are using it...

 By zxo20000    posted Jul 10, 2007 - 2:49 PM

totally agree

 By yohimbe9    posted Jul 10, 2007 - 12:48 PM

It starts to make you wonder about all of the other protocol handlers that are installed. A quick registry search in HKCL for "URL Protocol" found an Acrobat (acrobat://), Adobe Bridge (adobebridge), iTunes (daap://, itms://, itmss://, itpc://, pcast://) as well as several for WinAmp, Outlook and Real

Secunia report:

Quote
Description:
A vulnerability has been discovered in Firefox, which can be exploited by malicious people to compromise a user's system.

The problem is that Firefox registers the "firefoxurl://" URI handler and allows invoking firefox with arbitrary command line arguments. Using e.g. the "-chrome" parameter it is possible to execute arbitrary Javascript in chrome context. This can be exploited to execute arbitrary commands e.g. when a user visits a malicious web site using Microsoft Internet Explorer.

The vulnerability is confirmed in Firefox version 2.0.0.4 on a fully patched Windows XP SP2. Other versions may also be affected.

Solution:
Do not browse untrusted sites.

Disable the "Firefox URL" URI handler.

http://secunia.com/advisories/25984/

Demo:

Quote
This is a simple demo of Cross Browser Scripting through the use of registered URIs
When Firefox2 is installed, it registers the "firefoxurl" URI in the Windows Registry
This allows applications which render HTML (like Internet Explorer) to spawn an instance of Firefox.
The danger arises when parameters that are part of the firefoxurl: are passed directly to the Firefox.exe as options, without validation.
By using the firefoxurl URI, it is possible to use Internet Explorer (or other windows based browsers) to launch FireFox and immediately launch Javascript Code.
It is also possible to create a user profile, load arbitrary firefox options, and install global extensions, all without user consent.
Attacks using the firefoxurl URI will probably be initiated through the use of XSS or CSRF
Although these examples are very simple, other, more malicious attacks can probably be initiated.


A demonstration of each vulnerability is given below. The user must have both IE and FireFox installed. Although there are several ways to initiate this vulnerability, this particular example can be launched by doing the following:
1 - Close all Firefox browser windows
2 - Browse to this page with Internet Explorer and click one of the demonstration links
3 - Enjoy
4 - Close all Firefox windows before clicking on the next link

http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
A serious browser vulnerability, but whose?
« Reply #3 on: July 11, 2007, 03:50:11 PM »
Quote
Security researchers can't decide whether it's in IE or Firefox
By Dan Goodin in San Francisco → More by this author
Published Wednesday 11th July 2007 00:50 GMT
Email and Web Compliance: Awareness Pack - Free download

A serious vulnerability that causes Internet Explorer to launch Firefox and execute a malicious payload is sparking debate about exactly who is responsible for the flaw.

The vulnerability, which was widely reported on security blogs, allows an attacker to remotely execute malicious code on a machine that is running IE but also has the Mozilla browser installed. By luring an IE user to a malevolently crafted site, the attacker can cause Firefox to execute the code without first vetting it for security.

The saying about success having many parents but failure being an orphan seems fitting here. Window Snyder, who heads security at Mozilla, wrote today that Mozilla developers will patch Firefox so it no longer accepts bad data from IE. But she stressed that only people browsing with the Microsoft browser were vulnerable to the attack.

"We recommend that people use Firefox and as always take care when browsing unknown websites," she wrote.

For its part, Microsoft representatives said company researchers have "investigated the claim of a vulnerability in Internet Explorer and found that this is not a vulnerability in a Microsoft product." Jesper Johansson, a former senior security strategist for Microsoft, similarly argues that "most definitely" the problem isn't caused by IE.

"Firefox fails to properly validate the parameters, and any fix will have to come from Mozilla, not Microsoft," he wrote in a blog entry.

A proof of concept exploit found here uses IE to hand off maliciously-scripted code to a Firefox handler known as "firefoxurl." Handlers, which also include strings such as "ftp" and "aim," are found in the address bar and in many cases can be used to get Firefox to carry out certain actions.

Roger Thompson, CTO of Exploit Prevention Labs, says Microsoft shares culpability because IE fails to properly validate the input before passing it along.

"I think it's an IE issue mostly, because if you access the exploit directly with Firefox, FF warns you that something bad is happening and advises you to not do it," he said in an instant message.

http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Offline DavidR

  • Avast Überevangelist
  • Certainly Bot
  • *****
  • Posts: 88895
  • No support PMs thanks
Re: New cross browser zero day vulnerability for IE!
« Reply #4 on: July 11, 2007, 04:21:23 PM »
I think the key here is that You have to be using IE browsing on a compromised/iffy site and click on a link that passes parameters to launch firefox.

Quote
According to Secunia, "Firefox registers the "firefoxurl://" URI handler and allows invoking Firefox with arbitrary command line arguments." This means that a malicious site visited in Internet Explorer could pass parameters using that URI handler that would be run automatically in Firefox, without any sort of validation. The firm suggests not visiting untrusted sites until the problem is resolved.

So to me yes there might be a vulnerability in how firefox handles the parameters (hopefully soon to be patched), but if you aren't using IE as your default browser this isn't an issue in firefox, since you can click the same link whilst running firefox and you get the alert image I posted in reply #1.
Windows 10 Home 64bit/ Acer Aspire F15/ Intel Core i5 7200U 2.5GHz, 8GB DDR4 memory, 256GB SSD, 1TB HDD/ avast! free 24.2.6105 (build 24.2.8918.824) UI 1.0.799/ Firefox, uBlock Origin, uMatrix/ MailWasher Pro/ Avast! Mobile Security

Offline FreewheelinFrank

  • Avast Evangelist
  • Ultra Poster
  • ***
  • Posts: 4872
  • I'm a GNU
    • Don't Surf in the Nude!
Re: New cross browser zero day vulnerability for IE!
« Reply #5 on: July 11, 2007, 09:34:26 PM »
Quote
I think the key here is that You have to be using IE browsing on a compromised/iffy site and click on a link that passes parameters to launch firefox.

Quote
According to Secunia, "Firefox registers the "firefoxurl://" URI handler and allows invoking Firefox with arbitrary command line arguments." This means that a malicious site visited in Internet Explorer could pass parameters using that URI handler that would be run automatically in Firefox, without any sort of validation. The firm suggests not visiting untrusted sites until the problem is resolved.

So to me yes there might be a vulnerability in how firefox handles the parameters (hopefully soon to be patched), but if you aren't using IE as your default browser this isn't an issue in firefox, since you can click the same link whilst running firefox and you get the alert image I posted in reply #1.

The link says it more succinctly:

IE-Pwns-Firefox.html

 ;D
     Bambleweeny 57 sub-meson brain     Don't Surf in the Nude Blog

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: New cross browser zero day vulnerability for IE!
« Reply #6 on: July 11, 2007, 10:12:45 PM »
Hi FwF,

Mozilla's Window Snyder let us know that the problem only occurs with people that use Internet Explorer. "It is important to know, that when you use Firefox to surf the world wide web, you are not vulnerable to this attack. That is why we advise people to use Firefox as their default browser, and as always to be cautious when visiting unknown websites." see:
http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/

Microsoft's Jesper Johansson counterattacks: "Firefox fails in validating the parameters, and a solution has to be sought at Mozilla's, and is not to be expected from Microsoft." Mozilla already told that it would patch the hole with Firefox 2.0.0.5. see:
http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx

Security researcher Larholm, the man that found up the hole, keeps insisting that Internet Explorer is at the root of the problem, while it does not "escape" quotes, while re-directing input to the command line.
"You cannot blame Firefox for doing what it is told to do, the core problem is that IE makes us specify more items than it was meant to at the outset."

But the crux of the matter is that NoScript has saved our glorious behinds here again, when will they bring in this unique security add-on into Firefox and Flock by default?

polonus

« Last Edit: July 11, 2007, 10:15:20 PM by polonus »
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline bob3160

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 48523
  • 64 Years of Happiness
    • bob3160 Protecting Yourself, Your Computer and, Your Identity
Re: New cross browser zero day vulnerability for IE!
« Reply #7 on: July 11, 2007, 10:28:02 PM »
Hi Damien,
Those of us who use a plug-in to open a link in IE while using Firefox as our default browser
need to use extra caution any time this option is used.
Free Security Seminar: https://bit.ly/bobg2023  -  Important: http://www.organdonor.gov/ -- My Web Site: http://bob3160.strikingly.com/ - Win 11 Pro v22H2 64bit, 16 Gig Ram, 1TB SSD, Avast Free 23.5.6066, How to Successfully Install Avast http://goo.gl/VLXdeRepair & Clean Install https://goo.gl/t7aJGq -- My Online Activity https://bit.ly/BobGInternet

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: New cross browser zero day vulnerability for IE!
« Reply #8 on: July 11, 2007, 10:38:44 PM »
Well, bob 3160, that is why this is called a "cross browser" vulnerability. But NoScript enabled for unknown websites with possible malicious code (good for us live exploits weren't as yet discovered) protects you for the full 100 % as it has done with so many Javascript driven embedded malware code.
If you do not have NoScript installed inside FF or Flock you loose out on a lot of serious browser security.
It can save your "hide", really it can, also for exploits that haven't been patched or won't even!!!

Damian
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!

Offline polonus

  • Avast Überevangelist
  • Probably Bot
  • *****
  • Posts: 33891
  • malware fighter
Re: New cross browser zero day vulnerability for IE!
« Reply #9 on: July 11, 2007, 11:47:49 PM »
Hi malware fighters,

Someone showed that it is possible to open local files on a computer from inside firefox of a visitor of a website via the resource:// URL Protocol handler in Firefox. As an example let us consider the following link: resource://gre/greprefs/security-prefs.js. This link reads the file security-prefs inside your installation folder of  Firefox (that is: C;/programfiles/mozilla firefox/greprefs/security-prefs.js). Mozilla thought to block this by blocking opening of files outside the firefox folder by blocking the commands: ..\ en ../ commando's  (to go back one folder). By changing ..\ into ..%5c (the ASCII-code for a slash) you can circumvent this block, and open up the file resource.txt on the C-sdrive as follows (e.g.):


To cut down abuse Daniel Veditz posted a bugfile in Bugzilla, so Firefox-developers could patch this 0-day hole. Mozilla has launched a patch for Window-users, but it is still unpatched for Linux and Mac. But it is still possible to read the Firefox folder, that is files like update.xml, install.log and browserconfig.properties (those are your settings, like the start page) to be read from malicious sites.

On http://larholm.com/2007/05/25/firefox-0day-local-file-reading/ you can see the hole is still "alive and kicking", the info is based on data in files inside the Firefox-folder.

Shortly an update will be launched to tackle the whole problem. Best solution is to take out all of the whole resource://-protocol and forbid it to Internet sites in Firefox.

polonus
Cybersecurity is more of an attitude than anything else. Avast Evangelists.

Use NoScript, a limited user account and a virtual machine and be safe(r)!