Mozilla/Firefox Bug Allows Arbitrary Program Execution

treefort writes "An article at eWeek has the lowdown. The article also has a link to the bug report which addressed this issue some time ago. Still, I feel safer using Firefox since malicious persons are much more unlikely to target any vulnerabilites. Note that this only affects users of Mozilla and Firefox on Windows XP or Windows 2000." New releases are already available on mozilla.org that fix this. Update: 07/09 00:41 GMT by CN : I removed the bum link to Bugzilla, since I guess they don't like us. Also I discovered that OSDN's own NewsForge has more on the situation.

A clear advantage

[SIGALRM]

The Mozilla Foundation has confirmed the problem and issued a fix

This incident underscores why many use or have switched to Firefox: vulnerabilities discovered and promptly fixed. Not weeks and months from their publication--and not by another vendor--this exploit was addressed by those who have made available Mozilla's code for public scrutiny.

FYI, in case you didn't read the article, you can download the fix here [mozilla.org].

And now for some helpful links:

[strictnein]

And now for some helpful links:

Note: If you click on download links for firefox on the main page of mozilla.org [mozilla.org], you get 0.9.2 [mozilla.org]. The link on the firefox page @ http://www.mozilla.org/products/firefox/ [mozilla.org] still gets you 0.9.1 [mozilla.org]. The link on the main page for the Linux version of Firefox still points to version 0.9.1. It seems that if you want 0.9.2 for Linux you'll have to compile it yourself [mozilla.org].

0.8 [mozilla.org]
0.9rc [mozilla.org]
0.9 [mozilla.org]
0.9.1 [mozilla.org]
0.9.2 [mozilla.org]

And a direct link to the newest release for the really lazy:
Windows 0.9.2 [mozilla.org]

The question is, what is the shellblock.xpi [newaol.com] for?

Does Bugzilla know? Sorry, links to Bugzilla from Slashdot are disabled. Ook!

Re:A clear advantage

[peripatetic_bum]

OK. This just rocked. I click on the link to fix the exploit and mozilla asks if it can update the file and Whammo. It's done.

Amazing what the mozilla group is doing.

G

Re:And now for some helpful links:

[hallucination]

No need for a linux release..... Read the article:
Note that this only affects users of Mozilla and Firefox on Windows XP or Windows 2000

Re:A clear advantage

[Anonymous Coward]

This incident underscores why many use or have switched to Firefox: vulnerabilities discovered and promptly fixed. Not weeks and months from their publication

Yeah, it was years before it was addressed. If you read the Bugzilla report, it was first opened in 2002. This is not a good example of "open software fixes things faster".

No.

[Anonymous Coward]

If you were paying attention, you'd have noticed that it is already fixed. Not only that, but installing the fix is dead simple.

That's the opposite of hypocrisy. That's leading by example.

Re:Yes, but releases are available already

[Anonymous Coward]

This particular bug has been in bugzilla for quite some time. Not sure why you think it was fixed "immediately". Remember, *you* just heard about the issue today and so the patch was not released in a timely fashion as you may believe. Awesome browser though no doubt!

Microsoft bug which affects Firefox

[Anonymous Coward]

This is NOT a firefox bug. It is a bug in an external protocol in windows - of which Mozilla calls. The fix is to disable ALL external windows protocols. (bittorrent, mirc, etc)

Re:A clear advantage

[bwy]

Very true- no software ever written has been 100% bug free. Mac, Linux, Mozilla etc. simply aren't targets for obvious reasons that are frequently brought up here.

The difference in large part in my opinon boils down to:

#1 WHO finds the bug. Is it the developers and community that discovers it in good faith, or is it a hacker and the rest of us find out after a billion dollars has been lost worldwide to the latest worm, virus, etc.

#2 As you said, how quickly is the problem fixed. Certainly, private companies aren't necessarily horrible at doing this, to spite what people say. I work for a small software company and assure you that any security issues with our product would be corrected promptly. By the same token, some open source projects w/o a steady lead or direction could have exploits that go unfixed for some time.

However, based on my observations and considering those two points, I'd say I certainly feel better using Firefox than IE.

Re:A clear advantage

[lseltzer]

Not quite done yet. You have to restart your browser first.

It's not "in" the browser

[Anonymous Coward]

Mozilla hands off schemes it doesn't know to the operating system (Windows), and WINDOWS executes the shell scheme. It was obviously a security flaw in their eyes, too, as they fixed it in XP SP2. If you were able to run Windows with real restricted user accounts, this wouldn't really be such a problem.

Re:A clear advantage

[Maradine]

Ummmm . . .

The vulnerability [slashdot.org] was first reported in September of 2002.

Sorry. RTFA and all that.

Re:A clear advantage

[SIGALRM]

it was years before it was addressed

Not really. The bug history began immediately afterward and for quite some time it was moved between FIX and WONTFIX but received a lot of attention. Here are some of the comments from the bug report at http://bugzilla.mozilla.org/show_bug.cgi?id=167475 :

------- Additional Comment #2 From Jesse Ruderman 2002-09-11 16:58 PDT [reply] -------
It's not hard for a malicious site to get a visitor to click a link. Requiring
a click or an equivalent keyboard action can be useful for limiting how much a
web site can annoy you (pop-up windows, etc.) but I don't think it's useful for
larger security issues.

------- Additional Comment #3 From Daniel Veditz 2002-09-11 17:25 PDT [reply] -------
I agree, WONTFIX. Other bugs are already discussing blocking external protocol
handlers, we don't need to do additional work to base the decision on context.

------- Additional Comment #5 From Daniel Veditz 2002-09-12 11:35 PDT [reply] -------
re-opening for reconsideration. This doesn't solve the problem of untrusted
protocols, but even for trusted ones it doesn't make much sense in these kinds
of places.

Re:And now for some helpful links:

[sgtsanity]

The shellblock.xpi works to patch the 0.9.1 release. The only difference between 0.9.2 and 0.9.1 is that one of the preferences is a different value by default. So, if you have 0.9.1 already, there is no need to download the 0.9.2 release. You can just patch it using the .xpi link on mozillazine.

Re:A clear advantage

[Maradine]

And for those who would like the actual URL . . .

http://bugzilla.mozilla.org/show_bug.cgi?id=1674 75

Forgive me. I'm an idiot when I'm flamebait.

No, it doesn't.

[SHEENmaster]

There are no known exploitations of this in the wild, so it in no way shows that attackers are going for the common denominator of Mozilla installations.

Also note that this is a problem with Windows URI Handler rather than Mozilla. Mozilla passes any protocol it doesn't understand to Windows, and Windows uses it to execute a local file. That's why this problem doesn't exist in anything but Windows.

This just goes to show that Microsoft makes insecure software, and that insecurity often bleeds into otherwise trustworthy programs.

Re:Two beefs...

[hkfczrqj]

I don't like that the entire package had to be updated

I don't like that either. Nor the mozilla devs. So they posted a patch via an extension [mozilla.org] to be applied to ff, tb and seamonkey.

Cheers...

Re:Only recent Mozilla bug.

[Carnildo]

Strictly speaking, it's not a hole in Mozilla. It's a "feature" that can be used to turn local holes in other software into remote holes.

Re:Sorry, links to Bugzilla from Slashdot are disa

[Charlie Bill]

That's why you need Mozilla with that handy "Launch This Page in IE" plugin. Referrer=null.

Re:2K or not 2K

[AchilleTalon]

RTFA to the end.

It explains the exploit is working with a specific syntax to invoke the program execution and it clearly mentionned the similar behavior for execution exists on W2K, but the syntax is different. Conclusion: The exploit exist only on WXP.

Incorrect bug link

[jesser]

Eweek and Slashdot linked to bug 167475, implying that Mozilla developers knew about this hole in 2002. Fixing bug 167475 would have done approximately nothing to protect Mozilla users against the shell: hole in Windows, and that is why bug 167475 hasn't been fixed.

The correct bug number for this hole is bug 250180.

Re:A clear advantage

[roca]

That is not a report of this or any other vulnerability. It's simply a suggestion for a change that would have provided a defense in case a vulnerability like this one was discovered. I agree we still should have done it, and hopefully will do it now...

Re:Open Source Collaboration

[EvanED]

bugs are fixed instantly.

Hmm, this is obviously some strange usage of the word instantly that I wasn't previously aware of...

As the other posters have said, all over, the bug was opened in Sept 2002. Not far from 2 years ago.

"updates available" bug fix

[joshds]

A lot of people have the problem where, even after they've updated to firefox 0.9.1 (or now 0.9.2) the automatic update still says that there is a new update available (annoying).

Here's the fix:

Enter about:config in the location bar.
Enter update.app in the filter field. (Click on Enter)
Reset any prefs that appear in bold.
Restart Firefox.


taken from FireFox support newsgroup. [http://www.mozilla.org/support/]

Taken out of context...

[Phil John]

...they didn't realise at that point that this could be launched without user interaction, that is what was posted to full disclosure - when that was written it was believed that a user had to be fooled into clicking on that link - a whole different ballgame.

True, I think this was something that should have been looked at earlier, but the same day the no-user interaction vuln was posted, there was a fix.

Is there a (proper) fix yet for the download.ject problem? No, even with the temporary "sticking plaster" that microsoft launched onto windows update this week there are still ways to exploit the problem. It will be months until a proper patch that fixes that will be released, if it is ever released at all.

Lets keep things in perspective and in context please.

Re:Open Source Collaboration

[roca]

That's not a report of this vulnerability. It's a comment about a proposed change that might have prevented this vulnerability, had it been implemented. At the time, there was no known actual vulnerability that demanded the change.

Re:A clear advantage

[Anonymous Coward]

Valid point. Inspect the XPI before installing it. It's a ZIP file which contains two js files. "install.js" copies "bug250180.js" into the default-prefs folder. "bug250180.js" creates the preference string "network.protocol-handler.external.shell" with the value "false", which disables this particular handler.

The complete content of these files:

bug250180.js:

// block shell: protocol handler (bug250180)
pref("network.protocol-handler.extern al.shell", false);

install.js:

if (SUCCESS == initInstall("Patch for bug 250180","mozilla.org/bug250180","1.0.0.0"))
{
&n bsp; var prefDir = getFolder("Program", "defaults/pref");
var err = addFile( "", "bug250180.js", prefDir, "");

if (err == SUCCESS)
performInstall();
else
cancelInstall(err);
}

...or something similar to that, which I can't show here because Slashcode fucks it up.

Re:Open Source Collaboration

[jesser]

That's not a report of this vulnerability. It's a comment about a proposed change that might have prevented this vulnerability, had it been implemented. At the time, there was no known actual vulnerability that demanded the change.

The proposed change wouldn't even have prevented this vulnerability. It would have increased the requirement to exploit it from "Get the victim to visit your site" to "Get the victim to visit your site and click a link".

Re:Konqui

[Maljin Jolt]

And how do you read your slashdot user page? It does not render properly (or sometimes at all) on Konqueror. As well as many other webs, because style engine is broken.

BTW, my Mozilla 1.7/linux on "shell:/bin/ls" says

Alert! shell is not a registered protocol

So, I see no problems with mozilla on linux.

Note, your Konqueror probably has some other obscure protocols, such as system:, settings: or programs: which may render your machine vulnerable by means you can't even imagine. You really should check if they are on just now.

Re:A clear advantage

[Anonymous Coward]

The bug listed in the summary is about a general issue - no actual exploit was known. When an exploit was made known YESTERDAY, bug 250180 was filed, and fixed within 24hrs.

Go to the source for better info!!!

http://www.mozilla.org/security/shell.html

Some other fixes:

[twitter]

Note that Linux versions of these browsers were not exploitable. You can take advantage of this with free downloads from these helpful people:

• Mepis [mepis.org]
• Fedora [redhat.org]
• Debian [debian.org] use the new installer, Testing rocks.
• Feather Linux [berlios.de] for those of you still running your favoite 486.

I doubt they will block Slashdotters.

It's less effort, really it is. We now return you, of your own volition, to Windoze hell.

Re:A clear advantage

[owlstead]

Just to find out that the wrapper code and the stdio files are full of bugs, that the compiler is still in debug mode and opens up a remote socket to support it, the compiler is over-optimizing, the terminal on which the program runs is unstable, the code is P4 compatible but doesn't run on the intended platform... I mean, the code is not even bug free.

The problem with programs is that it is the complete _system_ that needs to be safe. As stated nicely by Bruce Sneider in one of his many books (I think it was Secrets & Lies (don't buy) or practical cryptography (must buy for security professionals).

Re:Shellblock XPI...

[Wanderer2]

How can I check it is installed?

Try this page: test page [mccanless.us]

After I installed the patch (without restarting Mozilla), all four example links were available to click on. Clicking on the fourth link, marked "Clicking this could crash your system!!!" did cause Mozilla to go crazy. It kept opening new windows stupidly fast until it crashed.

After it died, I restarted it and went back to the page - now three of the links are completely disabled (I can't even highlight them), and the link that does work (the one with the example iframe exploit) has no malicious effect - the iframe no longer shows the Windows tip but is empty instead.

So my version of Moz clearly wasn't fixed until it had been restarted.

Re:Microsoft bug which affects Firefox

[Anonymous Coward]

Yes. Any decent OS would simply disallow the request if the process was unprivileged and didn't hold a "formathd" capability - the WHOLE POINT of a modern OS is to give each process a safe virtual machine sandbox to run in where it can do little harm. Linux out-of-box also fails at this to an extent (small and weak capabilities... for the moment... and no process-private namespaces...yet...), but windoze out-of-box just ABSOLUTELY SUCKS AT IT. Presumably because many windoze coders grew up with a "home computer" there-is-only-one-memory-space we're-all-happy-friends mindset and Microsoft has to pander to them - it's not like the NT OS Kernel lacks the ability, after all.

Re:A clear advantage

[shaitand]

Actually this is a blotch on MS too, not Mozilla. The browser just passes unknown URI's to the OS and the OS handles them however it handles them. In this case the WINDOWS shell uri handler is insecure, creating what appears to be a bug in mozilla.

Re:A clear advantage

[shaitand]

The debate on whether or not to do something about it was because it's the uri handler in the OS which is insecure, not mozilla.

This isn't really a fix for a security problem in Mozilla, it's a workaround for a security problem in windows... which is why this only affects Mozilla on windows.

Re:A clear advantage

[Aidtopia]

Except for the semicolon, as the other poster pointed out, this does have some portability problems. Not sure if you'd call them bugs or not.

#include<stdio.h>

You could argue that a preprocessor should allow this, some will indeed choke because there's no space before the <.

return 0;

The 0 is returned to the operating system, but operating systems have different rules for what return values mean. For example, in VMS, even numbers are errors, and

return 0;

will generate a nasty error message upon completion.

Some people argue that the compiler should return "success" when the code says to return a 0. I haven't read anything official that supports that. And if so, how would you return a 0 if that's indeed the error you need to return to the operating system?

For maximum portability with ANSI C, you probably want to do something like this:

#include <stdio.h>
#include <stdlib.h>

int main(void) /* void makes it clear this is ANSI, not K&R */
{
printf("Hello, World!"); /* note ',' for proper grammar */
exit(EXIT_SUCCESS);
/*NOTREACHED*/ /* Let lint know, that you won't get here. */
return 0; /* silences compiler warning */
}

[Slashcode says to use <ECODE> instead of <PRE or <CODE, but how do I inline code or do indentation with <ECODE>?]

Even his sig has a typo!

Re:Open Source Collaboration

[Christopher Whitt]

As the other posters have said, all over, the bug was opened in Sept 2002. Not far from 2 years ago.

As other posters have been mistaken, so are you. The bug linked to in the /. article is 2 years old, but the correct bug (250180) is one day old. Fixing the 2 year old bug would have only removed some of the methods of activating the underlying Windows bug, not all.

Re:A clear advantage

[mingot]

Could you imagine a list like that for IE?

Will probably end up happening soon. Open online bug tracking has already started for some of their products.

0.9.2 Release Notes?

[thedillybar]

Apparently they haven't gotten to writing the release notes for 0.9.2. Is this "shellblock" thing the only fix? Sounds like it would be much easier to install the shellblock.xpi extension [mozilla.org]. (redundant I know)

BUT, since I have XP SP2 installed (the latest release candidate), I can ignore 0.9.2 altogether? Or are other bug fixes included in this release?

Re:And this line says all I need to know

[shaitand]

You know this doesn't affect any OS that uses /bin, /sbin, or /usr directories right?

Re:It's not "in" the browser

[Switchback]

Agreed. It's not really a bug in the browser, it's a flaw in Windows.

Windows has a bunch of protocol handlers registered. Mozilla knows how to handle a few (e.g. http, ftp, etc.). Whenever it encounters a protocol it doens't know what to do with, it sees if Windows knows how to handle it. Windows either handles it in some way or it doesn't. If it doesn't, Mozilla puts up a message saying "xyz is not a registered protocol." Mozilla has no way of knowing that anything is bad or dangerous.

The real bug is in Windows. The only real options the Mozilla developers have is to black/white list known dangerous protocols or simply don't allow protocols Mozilla itself doesn't handle. Neither are optimal. If you can't trust the OS you're on, you really limit yourself, bugs or not.

So we banish the "shell" protocol today. Who's to say Windows won't have another flaw in another protocol tomorrow?

This really isn't any different than plugins, which are in a sense, external protocol handlers. i.e. they know how to handle certain content...just like a protocol handler. What if there is an exploit in a plugin? Mozilla just starts the plugin with the listed parameters and lets it go. Are you going to blame Mozilla for allowing the plugin to run, or are you going to require that Mozilla not allow "known, dangerous plugins" to run?

Re:A clear advantage

[mldl]

Actually http://bugzilla.mozilla.org/show_bug.cgi?id=250180 is the first mention of the shell: bug. Bug 167475 is a catch all deciding whether or not Mozilla/Firefox should hand off unknown protocols. If it used a whitelist of known protocols as some people suggest then it would break a lot of things relied upon over various platforms.

The specific shell: bug was reported only Wednesday morning which gives us a total time of less than 48 hours.

Re:Firefox pass unknown protocol handlers to the O

[roca]

Mozilla does support different levels of trust. For example, a page on a remote website can't create an IFRAME whose SRC points at your local filesystem. A local file can do that. So I don't know what your point is.

This bug is about which Windows HTTP protocol handlers should be trusted. 'shell:' was trusted when it should not have been.

Re:Monoculture, my ass.

[Anonymous Coward]

In this case, the browser is passing a URL to Microsoft's OS standard URL handler API, not the shell directly. For some benighted reason, Microsoft thought a "shell:" URL scheme was a great idea, and then left the security up to the application, not the OS, and then didn't tell anyone.

Re:Update system

[galaga79]

There is an auto-update for Firefox, take a look at Options > Advanced > Software Updates.

By default it will periodically check for updates for the main program and extensions. You can even set it up to automatically download and install these updates.

Re:I knew it!!!

[TrancePhreak]

Avant Browser [avantbrowser.com] and MyIE 2 [myie2.com] are both programs that make use of IE for displaying and both contain tabbed browsing.

Re:Just to be fair...

[Kelson]

But where is the auto-update feature for Firefox á la Windows XP, OS X, YAST or Up2date?

Tools -> Options -> Advanced -> Software Update.

To check manually: Tools -> Extensions -> Update.

It's not perfect yet, but remember, it's still 0.9.x, not 1.0.

(Wait, you did want an answer, right?)

This bug report isn't the same..

[osssmkatz]

This bug report is about executing unknown protocol handlers in other places except . Mozilla has had for a while now, a blacklist of bad protocols that it should not pass to the OS.

With this patch, "shell:" was added--quickly because the infastructure was there.

--Sam

Re:A clear advantage

[TRACK-YOUR-POSITION]

Well, this is the bug you should probably be looking at: http://bugzilla.mozilla.org/show_bug.cgi?id=163648

One of the comments explains why this "bug" is so long in being "fixed"--it was suggested that a dialog should be popped up before launching any external app, (which Internet Explorer only started to do sometime this year), but this is inconsistent--external plugins, like Flash, don't get similar dialog boxes in any browser, even though such plugins have been exploited in the past. Also, some programs launch their own dialog warning the user of executing from untrusted environments, and having Mozilla also display a warning is redundant. Essentially, any program that registers itself as a plugin or web protocol is saying "I will take care of the security issues involved with my execution." Therefore, while known dangerous protocols like vbscript were blacklisted (that's why this particular bug is FIXED, even though the comments suggest awareness of the current problem), they didn't implement a whitelist (which I guess is the plan for 1.0) or a dialog box (which Internet Explorer now relies upon, foolishly) because it was not consistent with the behavior towards external plugins.

Presumably, with the bad press this has received, Mozilla has realized that Microsoft is going to put whatever-the-hell it wants to in as an external protocol, so unknown protocols should not be trusted. (Something that, apparently, Microsoft themselves has only realized in the last year or so.) shell: protocol is disabled in 0.9.2, and only whitelisted plugins will be trusted in 1.0. I think.

Re:WTF is an XPI? Super secret instructions requir

[Doppleganger]

Here you go [mozilla.org].. an obvious, step-by-step guide.

Don't even need to double-click anything, it installs from inside the browser. No need for self-extracting executables.

Concern has been around since 2002

[DragonHawk]

The security exposure is apparently due to the fact that Mozilla, running on MS-Windows, will hand off any "URI scheme" Mozilla does not recognize to the OS. This only happens on MS-Windows. Since Windows may (and indeed, does, by default) know about URI schemes that do things you would not want a web page doing (like run programs), this is considered a problem for Mozilla.

I have to agree that this is a Mozilla issue. To use a slightly contrived comparison: I read my mail using UW Pine. If someone sends me a script via attachment in email, I do not want Pine to test and see if the interpreter in the she-bang line is available on the host OS. My OS is not my mail reader; I do not want my mail reader allowing everything my OS can do. Ditto my web browser.

There appear to be at least three Mozilla Bugzilla Bugs related to this (likely a lot more):

#1 = Mozilla Bug 163767 (20 Aug 2002)
"Pref to disable external protocol handlers"
http://bugzilla.mozilla.org/show_bug.cg i?id=163767

#2 = Mozilla Bug 167475 (9 Sep 2002)
"Disable external protocol handlers in all cases, excluding <A HREF"
http://bugzilla.mozilla.org/show_bug.cgi?id =167475

#3 = Mozilla Bug 250180 (7 Jul 2004)
"Shell: protocol allows access to local files"
http://bugzilla.mozilla.org/show_bug.cgi?i d=250180

It appears that Mozilla developers have been worried about this kind of problem going back to at least Aug 2002 (see #1 above). #1 talks about an option to disable external protocol handlers (URI schemes) by default. I have to say that would be the right thing to do. "Secure by default" is the correct approach.

#2 talks about an approach that uses context to determine if an external handler should be invokved. Basically, it assumes that if a user clicked a link, they wanted to invoke the handler; anything that happened implictly (such as image loading) should not invoke an external handler. I do agree with those who commented (in that bug) that this is not the right approach. It adds complexity, and it still fails to address the fact that clicking a link is not something that should just up and run anything the web page wants. If I wanted that, I'd use MSIE.

#3 is a reference to the "shell:" URI scheme in particular being abused this way. It blocks the "shell:" scheme to prevent that abuse. It does nothing to prevent abuses of other possible schemes, though. I suspect we may see this "feature" of Mozilla rear its ugly head again in the future.

This is not a failure of Open Source in particular. Nor does it prove Mozilla is crap or Microsoft is okay after all. It means that people make mistakes. This should not surprise anyone. Stop pointing fingers and fix the problem.

auto-update no worky - ?

[real_smiff]

nice, doesn't seem to work though. says there are no updates, or it couldn't find any, something like that. for both methods you suggested (and for several other plugins i've got insalled). anyone else got firefox's auto-update to work?

Re:A clear advantage

[Jeffrey Baker]

no, but you might exit(EXIT_FAILURE); instead

Re:This has been addressed by MS

[HungSquirrel]

It requires clicking on a link in order to execute.

No, a sneaky little bastard could use <meta> refresh tags as well.

Re:Microsoft bug which affects Firefox

[DarkMan]

Bittorrent doesn't use the protocol handler. Instead, it relies on the browser identifing the .torrent through MIME types, and passing it to the client.

The external protocol handler would only be invoked if the links were like bt:// or bittorrent://. Never seen one like that.

Accent Nazi!!

[wirelessbuzzers]

Yeah. But where is the auto-update feature for Firefox á la Windows XP, OS X, YAST or Up2date?

The French word à is spelled with a grave accent, rather than an acute one. If you're going to spell things like a smartass, at least get them right.

Re:Where's the patch for 2000?

[Lanzaa]

for FireFox:
1. type "about:config" in your url bar
2. Find "network.protocol-handler.external.shell"
3. Change value to false

Thats all that you need to do to fix it.

Re:A clear advantage

[jesser]

We unhid the bug report because the hole had already been posted to the Full Disclosure mailing list.

Re:Mozilla VS IE

[smash]

If you RTFA, you'll notice that the problem is with Windows explorer - Firefox is simply passing links handled by explorer.exe to windows.

Also, if you RTFA, you'd realise this was supposed to have been fixed in a Windows service pack, but isn't.

So yes, I blame microsoft :)

Problem doesn't exist on any other OS running firefox...

smash.

Hypocritical?

[shplorb]

To all the people talking about how it's hypocritical to say a security flaw like this is no biggie for Mozilla and rant and rave on about a similar flaw in IE, think about this:

* Internet Explorer 6
* Firefox 0.9

Note the difference? Well, if you can't - basically Firefox is still not a 1.0 product - one that's ready to ship, whereas Internet Explorer is up to 6.whatever... one is a product that has been released, the other is still undergoing development.

Plus, the flaw only affects Windows systems, not Mac or Linux or whatever systems so the blame also partly lays with Microsoft.

I rest my case.

Re:Bad way

[dolphinling]

From the article:

The developers considered changing from scheme blacklisting to whitelisting, in which case all schemes and protocols would be disallowed unless explicitly allowed.

Mozilla Foundation spokesmen said a future version of the browsers will change to whitelisting, but the interim fix just disables the shell protocol. Several other schemes, such as vbscript, are already disabled by default.

So in other words, this fix only changes a pref which is easy to do without a huge download, etc. and is easy for the clueless, since it requires one click. Future versions will have a fix for the problem in general, rather than just this specific case.

Re:Just to be fair...

[dolphinling]

Because shell: doesn't exist on Linux.

shell: is like any other protocol, such as http: or ftp:. What Necko (the networking part of Mozilla) does is if it doesn't recognize the protocol, it asks the OS. Windows recognizes shell:, and lets it do pretty much anything. None of the other OSs recognize it, which is why this only affects Windows

Re:Firefox pass unknown protocol handlers to the O

[TheLink]

"Take the URI file:///c:/windows/system32/mspaint.exe Type it into the Address bar of IE - it works. Toss it into a webpage on the local machine and click on it - it works"

Doesn't work on mine. I see VERY few good reasons to need to be able to launch/download applications (or download fonts and run active script etc) from a local html page and thus I have disabled those options in the My Computer zone. I've also set things up so that copying and pasting gives me a prompt too.

Change the Flags to 1 in
HKEY_CURRENT_USER\Software\Microsoft\Windows\C urre ntVersion\Internet Settings\Zones\0

And the My Computer zone becomes configurable.

However do note that windows explorer seems to rely on activex or active scripting IF you are not using the classic view.

Re:It's not "in" the browser

[FireFury03]

why does Mozilla "hand off" stuff from the Internet to the operating system? It obviously can't determine that doing so is safe, so it shouldn't do it.

The OS contains a list of protocols and their handling applications. For example, RealPlayer will register itself and say "When someone clicks a link that calls for the rtsp: protocol then start me up coz I know how to handle it" (if this wasn't allowed then you could say goodbye to being able to just click a realaudio link and fire up the player). Unfortunately, Windows decided to add to the register an application saying "When someone clicks a link that calls for the shell: protocol, I know how to handle that".

Essentially there is a central register of "these applications can handle these internet protocols". As you know, anything on the internet has to be secure so this is basically a register of secure software. Unfortunately MS decided to put an insecure piece of software on the register and there was no reason for the browser to distrust the contents of the register.

OT: mozilla support for exchange servers!

[mt-biker]

This is off-topic, but nonetheless should be of interest to mozilla users who are forced to use Outlook at work. Even more so for people who use linux at work and are forced to access email via Outlook Web Access (sob!).

Mozilla support for exchange servers (without IMAP) looks like it should now be implementable.

Bug 128284 [mozilla.org]

Please vote for this bug if you desperately _desperately_ (like me!) need support for exchange!

Re:Bad way

[wellard1981]

I hate to be picky but isn't Firefox designed for XP / 2k

Mozilla is a cross-platform web browser, it has not been specificly designed to run on one type of operaing system, such as Windows. There are also packages for most flavors of Linux/UNIX, including the source code.

so you'd think the devs might consider security flaws in them to be an important issue.

What Mozilla are doing is passing anything that the browser does not understand over to the OS, with a small hope that the OS will understand what it means. The bug aparantly affects Internet Explorer too, so it's more of a bug in the Windows OS more than anything.

Re:Bad way

[stemcell]

As far as I'm aware IE does not directly run the shell: protocol but provides a dialogue offering the option to run / save / etc.

And yes, Mozilla is cross-platform, but Firesomething is designed for windows (with ports being a secondary consideration) - it doesn't seem unreasonable to expect some security protocol changes in light of that fact.

--
Stem

Re:Bad way

[rwise2112]

It is in fact an IE insecurity too as i just tested it with internet explorer and windows 2000

Odd! The article indicates:
The shell: syntax works only on Windows XP systems. According to one report, similar functionality is available on Windows 2000 but with different syntax.

Re:This IS 100% Mozilla's fault

[julesh]

As hundreds of other people have already pointed out, the bug filed 2 years ago, while it would have helped if it were fixed _would not have solved this problem_. Read it. It would have just stopped the use of and tags to open shell: URIs, not tags or form submissions, and probably not javascript either.

Also, the reported wasn't aware of this specific problem. One poster was aware of another protocol scheme that could be used to cause problems, which was subsuquently blocked -- i.e. they fixed the reason the problem reported was dangerous without fixing the "bug" itself. And, as fixing this "bug" would have damaged Mozilla's functionality, this is probably a good thing.

Re:Serendipity! Vindication in under one day!

[dossen]

Does IE have this bug?
If not, it's a FIREFOX BUG

IE (version 6.0.2800.1106.xpsp2.030422-1633 (not kidding, that's what it says), which appears to be the latest version (no patches pending in the update utility)) opens shell: URIs. So the answer to your question is YES, IE has this bug