=====================================================================
                                   CERT-Renater

                        Note d'Information No. 2007/VULN298
_____________________________________________________________________

DATE                      : 12/07/2007

HARDWARE PLATFORM(S)      : /
                                               	
OPERATING SYSTEM(S)       : Windows avec Mozilla Firefox

======================================================================


US-CERT Vulnerability Note VU#358017
Mozilla Firefox URL protocol handling vulnerability

Overview

        Mozilla Firefox protocol handlers may allow remotely supplied
        JavaScript to execute with elevated privileges. This may allow a
        remote, unauthenticated attacker to execute arbitrary code on a
        vulnerable system.

I. Description

        Mozilla Firefox installs protocol handlers for Mozilla-specific
        protocols, such as the FirefoxURL and FirefoxHTML protocols. If
        Microsoft Windows encounters a URL protocol it cannot handle
        natively it searches the Windows registry for the appropriate
        protocol handler.
        When the correct protocol handler is found, Windows passes it
        the URL string. By design Windows passes the URL string to the
        protocol handler as it was received without performing any
        sanitization.

        Mozilla Firefox URL protocol handlers are constructed in a way
        that may allow a remote attacker to execute arbitrary JavaScript
        with elevated (chrome) privileges. Mozilla Firefox security
        restrictions detect and prevent the execution of such
        JavaScript. However, if a remote attacker can persuade a user
        with Firefox installed to access a specially crafted web page
        using Internet Explorer, and perhaps other Windows applications,
        the malicious JavaScript will be executed. Reports claim this
        vulnerability is introduced when Firefox versions 2.0.0.2 and
        later are installed.

        Exploit code is publicly available for this vulnerability.

II. Impact

        This vulnerability may allow a remote, unauthenticated attacker
        to execute JavaScript with elevated (chrome) privileges. This
        essentially means that the attacker can execute arbitrary code
        with the privileges of the user.

III. Solution

        We are unaware of a practical solution to this problem. Until a
        solution is available the following workaround may prevent known
        exploits from working:


        Unregister the Firefox protocols

        Disabling the Mozilla Firefox protocol handlers will mitigate
        this vulnerability. To unregister the protocol handlers, delete
        or rename the following registry keys:

            HKEY_CLASSES_ROOT\FirefoxURL
            HKEY_CLASSES_ROOT\FirefoxHTML

        Modifying the Windows registry may have unintended consequences
        and should be done with care.

Systems Affected

        Vendor                  Status    Date Updated
        Microsoft Corporation   Unknown   10-Jul-2007
        Mozilla                 Unknown   11-Jul-2007

References

        http://www.virusbtn.com/news/virus_news/2007/07_11.xml

http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/

Credit

        This vulnerability was publicly disclosed by Thor Larholm.

        This document was written by Jeff Gennari.

Other Information

        Date Public             07/10/2007
        Date First Published    07/11/2007 10:53:35 AM
        Date Last Updated       07/11/2007
        CERT Advisory
        CVE Name
        Metric                  19.69
        Document Revision       57

======================================================================

          =========================================================
          Les serveurs de référence du CERT-Renater
          http://www.urec.fr/securite
          http://www.cru.fr/securite
          http://www.renater.fr
          =========================================================
          + CERT-RENATER          | tel : 01-53-94-20-44          +
          + 151 bd de l'Hopital   | fax : 01-53-94-20-41          +
          + 75013 Paris           | email: certsvp@renater.fr     +
          =========================================================