Thursday, July 12th 2007

Incompatibility Between Firefox and Internet Explorer Causes Security Hole

Thursday, July 12th 2007 Discuss (37 Comments)

If both IE and Firefox version 2.0, or later are loaded on a persons computer a zero day security hole may occur.
The trouble begins when visiting a site with malicious content while using IE. The site then registers a "firefoxurl://" URI (uniform resource identifier) handler, that gives access to that site and allows it to interact with IE.

The Security researcher named Thor Larholm who discovered the Security Hole and Symantec put much of the blame on IE, while Secunia's chief technology researcher named Thomas Kristensen, blamed FireFox for this Security Issue.

Source : Zdnet

Add your own comment

37 Comments on Incompatibility Between Firefox and Internet Explorer Causes Security Hole

cmberry20

"If both IE and Firefox version 2.0, or later are loaded on a persons computer a zero day security hole may occur."

That quote in it self will apply to 99% of PC users as IE comes fully installed on all XP & Vista machines.
So just installing Mozilla will causes this scenario to happen.

GJSNeptune

by: cmberry20
So just installing Mozilla will causes this scenario to happen.

Not quite. You have to be using IE, and "Mozilla" is just a company. ;)

Firefox is the vehicle, but it's relaly IE's fault.

"Firefox is the current attack vector, but Internet Explorer is to blame for not escaping...characters when passing on the input to the command line," said Larholm

Darknova

HAHAH, they BOTH are too blame. IE for having the security flaw...and Firefox for...oh yeah, having the security flaw.

GJSNeptune

Firefox's only involvement is being installed.

Darknova

by: GJSNeptune
Firefox's only involvement is being installed.

If it wasn't installed there wouldn't be a problem....hence it has a security flaw. Maybe not some gaping hole like IE has, but still a flaw none the less.

Telexen

by: Darknova
If it wasn't installed there wouldn't be a problem....hence it has a security flaw. Maybe not some gaping hole like IE has, but still a flaw none the less.

But if it's installed on Linux, where IE doesn't belong - then it has no problem :D

GJSNeptune

by: Darknova
If it wasn't installed there wouldn't be a problem....hence it has a security flaw. Maybe not some gaping hole like IE has, but still a flaw none the less.

It's a flaw because it takes advantage of IE when Firefox is installed. It has nothing to do with Firefox. It's entirely IE's shortcomings that makes this a risk.

The trouble begins when browsing a malicious site while using IE and it registers a "firefoxurl://" URI (uniform resource identifier) handler, which allows the browser to interact with specific resources on the Web. As a result, users may find their systems remotely compromised.

I'll quote this yet again:

"Firefox is the current attack vector, but Internet Explorer is to blame for not escaping ... characters when passing on the input to the command line," said Larholm.

Darknova

"It's a little bit of both," said Oliver Friedrichs, director of Symantec's Security Response Center. "You have two very complex applications that are not playing well together and leading to a security issue. The components themselves are secure as stand-alone products but not together."

It is not entirely IE's fault. I understand exactly how the risk came about, I understand how it is attacked, and I understand the under lying fault is with IE. However without FF there is no problem, as FF, in a sense, opening up the hole.

I still agree entirely that it is mostly IEs fault, but FF is not entirely blameless.

Dippyskoodlez

by: Darknova
It is not entirely IE's fault. I understand exactly how the risk came about, I understand how it is attacked, and I understand the under lying fault is with IE. However without FF there is no problem, as FF, in a sense, opening up the hole.

I still agree entirely that it is mostly IEs fault, but FF is not entirely blameless.

But... Can this be used if something other than firefox were to use the same method?

Its ie.. :laugh:

#10

Benpi

Banned

If you're an anti-MS club member (or own a mac), then this is 100% IE's fault. If you're in the MS fanclub, it's FireFox's fault. If you really don't give a shart, it's both of their fault.

#11

GJSNeptune

There is skewed logic working here. The flaw exploits a hole in IE, but it only works if Firefox is installed. Firefox has nothing to do with IE not escaping characters. If a patch comes out, it'd be for IE, not Firefox.

#12

Dippyskoodlez

by: GJSNeptune
There is skewed logic working here. The flaw exploits a hole in IE, but it only works if Firefox is installed. Firefox has nothing to do with IE not escaping characters. If a patch comes out, it'd be for IE, not Firefox.

Exactly.

If you wanna scrape it up to fanboi-ism, GTFO.

The fix will be for IE.

#13

HellasVagabond

Calm down people.... :)

#14

GJSNeptune

Calm as can be. Don't know why the mods have been exaggerating intensity.

#15

HellasVagabond

Anyways everybodys goal is for this to get fixed so no point arguing about IE and Firefox.
Both are Outstanding Browsers.

#16

GJSNeptune

Quick fix. Don't use IE. :D

#17

HellasVagabond

I like it far more than Firefox.....And im sure many people do also.....However lately MS is releasing updates once a month so no problems there :)

#18

demonbrawn

I personally like Firefox because of all the little free add-ons. Anyway, I don't think it really matters which program caused the issue as long as it gets fixed.

#19

GJSNeptune

It matters when one is being falsely accused and criticized.

#20

HellasVagabond

It takes both program faulty codes to create this mess GJSNeptune...Its not just 1 of those 2 thats bad.

#21

Ketxxx

Eligible for custom title

by: Darknova
If it wasn't installed there wouldn't be a problem....hence it has a security flaw. Maybe not some gaping hole like IE has, but still a flaw none the less.

The only flaw that was made was the creation of Internet Explorer.

#22

WarEagleAU

Bird of Prey

Firefox is the bomb. Safe and secure, but now it seems folks are targetting it. I guess they are tired of everyone ragging IE

#23

Dippyskoodlez

by: HellasVagabond
It takes both program faulty codes to create this mess GJSNeptune...Its not just 1 of those 2 thats bad.

It sounds like IE is not handling certain text correctly... enabling something to take advantage of an internal link ability of firefox... with this, simply patching IE would....... solve the problem, would it not?

#24

HellasVagabond

We will see...If MS is the only one to release a patch yes, but if Mozilla releases an update too then no :)

#25

GJSNeptune

I give up. People are still not understanding and I've explained it too many times already.

Add your own comment

Incompatibility Between Firefox and Internet Explorer Causes Security Hole

Related News

37 Comments on Incompatibility Between Firefox and Internet Explorer Causes Security Hole