IE7/Firefox URI Handling Bug Caused by Windows After All

Iria · Jul 30, 2007, 06:12 PM

Source: BetaNews
______
An exploitable bug discovered earlier this month that was first believed to have been caused by Internet Explorer 7.0, before Mozilla was forced to admit that it afflicted Firefox as well, has apparently been traced back to a Windows API function.

The discovery may have been first revealed through the US-CERT Web site of the Dept. of Homeland Security, which now classifies it as a "Microsoft Windows URI protocol handling vulnerability." The function in question is an old favorite of malware writers: ShellExecute(), which was the subject of a notorious Windows 2000 exploit four years ago.

Robert McClelland · Jul 31, 2007, 05:44 AM

Thats why Opera rules!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !!

Erroneus · Jul 31, 2007, 01:42 PM

Allready fixed in firefox 2.0.0.6 and not like Opera, they actually inform there users about the security bugs they fixed and not hide them.

Jul 30, 2007, 06:12 PM	#1
Iria DriverHeaven Extreme Member Join Date: Apr 2004 Posts: 7,275 Rep Power: 89	IE7/Firefox URI Handling Bug Caused by Windows After All Source: BetaNews ______ An exploitable bug discovered earlier this month that was first believed to have been caused by Internet Explorer 7.0, before Mozilla was forced to admit that it afflicted Firefox as well, has apparently been traced back to a Windows API function. The discovery may have been first revealed through the US-CERT Web site of the Dept. of Homeland Security, which now classifies it as a "Microsoft Windows URI protocol handling vulnerability." The function in question is an old favorite of malware writers: ShellExecute(), which was the subject of a notorious Windows 2000 exploit four years ago.

Jul 31, 2007, 05:44 AM	#2
Robert McClelland PAX Tweaker, PAX Expert. Join Date: Jun 2002 Location: Somewhere in Wood County Ohio Same Town :) Posts: 10,671 Rep Power: 196 System Specs	Thats why Opera rules!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! !! __________________ "XTREME AUDIO IS CRAP!" "There no support for it. It's crapist card on face of the earth it should be throw into the sun" http://www.speedtest.net/result/1949536385.png correct the correct one now

Jul 31, 2007, 01:42 PM	#3
Erroneus Get off my lawn! Join Date: Aug 2002 Location: Denmark Posts: 13,419 Rep Power: 119 System Specs	Allready fixed in firefox 2.0.0.6 and not like Opera, they actually inform there users about the security bugs they fixed and not hide them. __________________