Mozilla has a shell exploit

Zardon · Jul 9, 2004, 03:54 PM

AS PUNTERS SWITCH from IE in droves to the Mozilla Foundation, peddlers of the rival browsers Mozilla, Firefox and Thunderbird have admitted that they have a security hole too.
Mozilla has seen record downloads after big names in the security industry recommended dumping IE at least until Vole released its service pack two for Windows XP or patches for its holy browser.

Now, according to Reuters, developers at the open-source Mozilla Foundation have confirmed its product also has a shell exploit and it has come up with a patch for it.

The flaw affected only Windows users, not computers running either Mac or Linux operating systems.

The problem is minor and requires a fair bit of effort and knowledge on the part of the attacker. Ultimately, all they can do is cause the computer to freeze. Mozilla has said that future versions of the Firefox web browser would have automatic update notifications that would make it easier to notify users about security fixes.

inquirer

**dj_stick** · Jul 9, 2004, 03:58 PM

hmm - well one exploit is better than the multitudes that IE has

Warpy · Jul 9, 2004, 04:01 PM

Very true...

Xii · Jul 9, 2004, 04:42 PM

It's actually a problem with Windows Explorer.

Quote:

The kicker is that this isn't even a problem with Mozilla; it's a problem with Windows Explorer. Windows XP Service Pack 1 was supposed to have closed this hole, but apparently it is still functioning and leaving Windows systems open to remote attack. So the Mozilla team worked to patch a hole that had little to do with their project.

Is this really a security hole? When Mozilla receives a shell: request, it passes it on to an external handler in Windows. The "fix" for this is to disable this functionality which, as far as I can tell, is totally unnecessary to begin with. External handlers -- programs outside Mozilla -- have no specific security model, so the only way to deal with them is to make individual exceptions like this one. Messy? Yes. But that's Windows.

Newsforge Story

caqde · Jul 9, 2004, 08:40 PM

Wow they can cause my computer to freeze. Much better than most IE flaws that allow them to install anything they want into my system I really hate spyware.

Jul 9, 2004, 03:54 PM	#1
Zardon DriverHeaven Founder Join Date: May 2002 Posts: 32,480 Rep Power: 177	Mozilla has a shell exploit AS PUNTERS SWITCH from IE in droves to the Mozilla Foundation, peddlers of the rival browsers Mozilla, Firefox and Thunderbird have admitted that they have a security hole too. Mozilla has seen record downloads after big names in the security industry recommended dumping IE at least until Vole released its service pack two for Windows XP or patches for its holy browser. Now, according to Reuters, developers at the open-source Mozilla Foundation have confirmed its product also has a shell exploit and it has come up with a patch for it. The flaw affected only Windows users, not computers running either Mac or Linux operating systems. The problem is minor and requires a fair bit of effort and knowledge on the part of the attacker. Ultimately, all they can do is cause the computer to freeze. Mozilla has said that future versions of the Firefox web browser would have automatic update notifications that would make it easier to notify users about security fixes. inquirer

Jul 9, 2004, 04:01 PM	#3
Warpy DriverHeaven Senior Member Join Date: Jun 2003 Location: USA Posts: 2,761 Rep Power: 0	Very true... __________________ The nine most terrifying words in the English language are, "I'm from the government and I'm here to help."

Jul 9, 2004, 08:40 PM	#5
caqde HardwareHeaven Senior Member Join Date: Oct 2002 Location: US, IL Posts: 502 Rep Power: 64 System Specs	Wow they can cause my computer to freeze. Much better than most IE flaws that allow them to install anything they want into my system I really hate spyware. __________________ AMD Phenom II X4 925 AM3/ Giga-byte MA790XT-UD4P XFX HD5770 1GB / 2x2GB of GSKILL DDR3 10666 8-8-8-23 Samsung SH-S182D DVD-RW drive / Sony Optiarc BD-5300S BD-RW drive Western Digital WD1501FASS(Primary)/Western Digital 15EADS(Secondary)/Western Digital 7500AACS(Secondary)/Seagate Barracuda 7200.10 320gb(Secondary)/Western Digital 3200KS 16MB 7200rpm SATAII HD(Secondary) Antec TP-550 / CoolerMaster CMStacker Sound Blaster X-FI Titanium Fatal1ty Professional / Creative Inspire 6600 6.1 speakers Samsugn T200HD 20" LCD Monitor / Logitech Internet 350 Black Keyboard Logitech MX510 Mouse