Mozilla is working on patching its Firefox browser after a hacker posted details of a flaw that could let criminals run unauthorized software on a victim’s machine.

The flaw lies in Firefox’s URL handler component, which was the source of another bug Mozilla disclosed Tuesday.

This second flaw was disclosed Tuesday by Billy Rios and Nathan McFeters, security consultants with Verisign and Ernst & Young respectively.

Like the first flaw, this one could be exploited by attackers to launch programs on the victim’s PC without authorization, said Tyler Reguly, a security research engineer at nCircle Network Security. “They’re both related to the URL handling process,” he said “It’s just different errors within that handling process.”

Even though the code posted by Rios and McFeters can only be used to launch software that is already installed on a victim’s PC, it could be very dangerous if used by criminals, Reguly said. “It’s still letting you run any program that exists on the user’s computer,” he said. “You can make it do some fairly bad things. For example, having it use command-line FTP to download a malicious file off a server somewhere and then execute that file.”

A victim would have to be tricked into clicking on a malicious link for the attack to work, Reguly said.

Mozilla’s security chief, Window Snyder, said that her team is working to verify and fix this latest flaw.

Firefox’s URL handler has been a headache for Mozilla ever since security researcher Thor Larholm showed that the way IE (Internet Explorer) and Firefox interact with each other could be exploited to launch software on a user’s machine without authorization. To make the attack work, IE would load malformed data from a Web site and would then send it to Firefox, which would launch the unauthorized software.

Microsoft and Mozilla disagreed about who was at fault, however. Snyder initially said that the attack wouldn’t work on Firefox alone and that Microsoft should change the way IE passes malformed data to other programs. Microsoft said that the problem lay with Firefox.

While disclosing details on the first URL handler bug on Tuesday, Snyder admitted that she was wrong. “We thought this was just a problem with IE. It turns out, it is a problem with Firefox as well,” she said. “We should have caught this scenario.”

Mozilla is planning to fix this issue in the upcoming 2.0.0.6 release of its browser. Snyder did not say when the Billy Rios bug would be patched.

Thor Larholm, A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update. No, that’s not a typo, just the strange fall-out from an unusual bug that had security researchers debating the question this week: “Who’s to blame? Microsoft or Mozilla?”

Thor Larholm kicked off the controversy yesterday, claiming that he had discovered a flaw that would let an attacker run commands on a victim’s PC.

In his blog posting, Thor Larholm said the bug was similar to a flaw he’d discovered last month in Apple’s Safari 3.0 beta software, and he called it an “input validation flaw in Internet Explorer”. The problem is with a URL protocol handler component of Internet Explorer, he said. This software allows Internet Explorer users to launch applications such as Excel or Firefox by clicking on specially written links on web pages.

When Internet Explorer clicks on a link that launches the Firefox browser, however, the software does not properly check its syntax, and that, Larholm said, lets an attacker create a malicious link, that could be used in an attack. Security vendor Secunia ApS rates the flaw as ‘highly critical’.

So while the flaw affects Internet Explorer users, it appears to be a risk only to those who already have Firefox installed. And to make matters more complicated, if a Firefox user were to click on one of the specially-written links, he would not be affected.

Read more at Larholm.com.

A noted security researcher disclosed four new zero-day vulnerabilities in Microsoft and Mozilla’s browsers, including a critical flaw in Internet Explorer (IE) and a “major” bug in Firefox. Michael Zalewski, who regularly publishes browser flaw findings, posted details on the Full-disclosure mailing list for cookie-stealing, keystroke-snooping, malicious downloading and site-spoofing bugs.

The most serious of the four, said Zalewski, is an IE6 and IE7 flaw he rated “critical.” Dubbing it a “bait-and-switch” vulnerability, he said that the Microsoft browser gives hackers a window of opportunity to run malicious JavaScript to hijack the PC.

“The entire security model of the browser collapses like a house of cards and renders you vulnerable to a plethora of nasty attacks,” Zalewski claimed in notes that accompanied a demonstration of the IE bug. Up-to-date IE6 and IE7 are both at risk, he said, although Firefox is not.

But Mozilla’s browser also suffered at Zalewski’s hands. A new IFrame vulnerability in Firefox 2.0 can let attackers plant keyloggers or drop malicious content into a legitimate Web site. The flaw, rated as “major,” is related to a similar bug discovered last year; although Mozilla patched that problem, Zalewski said the fix hadn’t plugged all the holes.

Zalewski posted information about two other bugs, both rated “medium.” A Firefox vulnerability could lead to unauthorized downloads, while IE6 is open to yet another address bar-spoofing flaw. “IE7 is not affected because of certain high-level changes in the browser,” Zalewski said of the fourth vulnerability.

Mozilla is aware of both Firefox bugs — they have been posted to its Bugzilla management system — and a Microsoft spokeswoman said the company’s security team is looking into Zalewski’s claims. “Upon completion of this investigation, Microsoft will take the appropriate action, which may include issuing a security advisory or providing a security update,” she added.

Microsoft also said it knows of no ongoing attacks using the vulnerabilities.

Source: PCWorld

Danish vulnerability tracker Secunia ApS has concluded that Apple Incorporated’s QuickTime is three times more likely to pose a threat than Microsoft Corporation’s Internet Explorer 6 and six times more likely to be a threat than Mozilla Corporation’s Firefox. According to an analysis of more than 350,000 system checks done over the last six months by the free Secunia Software Inspector, 33.1% of all QuickTime 7 installations weren’t up to date with security patches. AOL LLC’s Winamp, was almost as likely to be outdated: 27% of Winamp 5 installations were missing needed security fixes. In comparison, IE 6 installations lacked one or more patches, while just 5.2% of Firefox 2 deployments needed updating. Secunia’s data shows that outside of operating systems and browsers, users neglect regular patching.

“This constitutes a significant problem. Most people wouldn’t hesitate to open an .mpg, .jpg, .mov or .mp3 file from any source if it seems the least bit interesting and relevant. It’s easy to embed a movie in your home page, for example, and all it takes is one unpatched QuickTime vulnerability and a provocative video title to compromise a lot of visitors,” said Jakob Balle, Secunia’s development manager.

Researchers regularly identify vulnerabilities in QuickTime and Winamp. Secunia’s own database, for example, pins 10 bugs on QuickTime 7, Winamp 5 sports 11 vulnerabilities. There are fairly recent bugs as well, but fixes for all have been released. Balle said that scans of business computers for unpatched applications reveal the same user behaviour that inspections of consumer computers expose. Although the free Software Inspector remains available, Secunia is also pushing a server-side edition, dubbed Network Software Inspector.

I myself use QuickTime Alternative and for the matter Real Alternative. Anyway read the full article here.

A vulnerability in the way Windows handles animated cursors puts users at risk. Several nefarious websites are already trying to exploit the flaw, according to the SANS Internet Storm Center.

The flaw is present on virtually the entire line of Windows OSes, including Vista, which has been held up as Redmond’s poster child for safe computing. According to McAfee, Windows users browsing malicious sites using Internet Explorer versions 6 or 7 risk having arbitrary code run on their machines. Those using Firefox are not vulnerable. Microsoft said in an advisory that those using IE 7 on Vista are safe from the vulnerability because of a protected mode, which restricts where the browser can write files.

“Upon viewing a web page, previewing or reading a specially crafted message, or opening a specially crafted email attachment the attacker could cause the affected system to execute code,” Microsoft warns. Files that can exploit the vulnerability are not limited to those with the .ani extension that come with most programs that animate the cursor on Windows machines. Some exploits in the wild are reported to be embedded in jpeg files, SANS says in an advisory.