----------------------------------------------------------------------

Want a new job?

http://secunia.com/secunia_security_specialist/
http://secunia.com/hardcore_disassembler_and_reverse_engineer/

International Partner Manager - Project Sales in the IT-Security
Industry:
http://corporate.secunia.com/about_secunia/64/

----------------------------------------------------------------------

TITLE:
Mozilla Firefox 2 URI Launching Vulnerability

SECUNIA ADVISORY ID:
SA31120

VERIFY ADVISORY:
http://secunia.com/advisories/31120/

CRITICAL:
Less critical

IMPACT:
Security Bypass, Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
Mozilla Firefox 2.0.x
http://secunia.com/product/12434/

DESCRIPTION:
A vulnerability has been reported in Firefox 2, which can be
exploited by malicious people to bypass certain security restrictions
and disclose sensitive information.

The problem is that it is possible to open multiple tabs via pipe
symbols within the URI and can e.g. be exploited to launch "chrome:"
URIs via the command-line. This can also be exploited to read files
from a user's system using the "file:" URI but requires that an
attacker is able to place a malicious file in a guessable location on
a user's system (e.g. in combination with another security issue).

Successful exploitation requires that the URI is passed to Firefox
from e.g. another browser and that Firefox is not running.

The vulnerability is reported in versions prior to 2.0.0.16.

SOLUTION:
Update to version 2.0.0.16.
http://www.mozilla.com/en-US/firefox/all-older.html

PROVIDED AND/OR DISCOVERED BY:
The vendor credits Billy Rios.

ORIGINAL ADVISORY:
MFSA 2008-35:
http://www.mozilla.org/security/announce/2008/mfsa2008-35.html

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------