Firefox remains vulnerable to attacks exploiting protocol-handling bugs, even though it was patched twice in July, a pair of security researchers said this weekend.
Billy Rios and Nate McFeters, who spelled out design and functionality vulnerabilities in Windows' Uniform Resource Identifier (URI) protocol handling as recently as mid-August, said Saturday that they have uncovered another way hackers could send malicious code to users via browsers.
"Once again, these URI payloads can be passed by the mailto, nntp, news, and snews URIs, allowing us to pass the payload without any user interaction," claimed Rios in a posting to his blog. "Although the conditions which allowed for remote command execution in Firefox 184.108.40.206 have been addressed with a security patch, the underlying file type handling issues which are truly the heart of the issue have NOT been addressed," he added.
URI bugs were a hot topic throughout July, when Norwegian researcher Thor Larholm showed how a browser could be tricked into sending malformed data from other applications. Although Larholm initially blamed Internet Explorer for the flaw, others quickly pointed out that Firefox suffered from the same bug. A finger-pointing debate ensued.
Rios and McFeters didn't divulge technical details of how an attacker could exploit the new-found URI flaws, saying that they are giving Mozilla Corp.'s security team time to plug the hole. However, they did post a screenshot that they said showed how they used the mailto URI -- the string used on Web pages that, when clicked, open up the user's default e-mail client with an address already inserted -- to eventually call up any desired malware.
Although Mozilla was not immediately available for comment Tuesday, the vulnerability could not have come as much of a surprise. In the 2007-027 security advisory -- one of two issued in the update to version 220.127.116.11 on July 30 -- Mozilla presciently noted that more bugs might be hidden in protocol handling.
"The Firefox 18.104.22.168 release contains fixes that prevent the original demonstrations of this variant, but it is still possible to launch a filetype handler based on extension rather than the registered protocol handler," stated the advisory. "A way to exploit a common handler with a single unexpected URI as an argument may yet be found."