Incompatibility Between Firefox and Internet Explorer Causes Security Hole

HellasVagabond · Jul 12, 2007

If both IE and Firefox version 2.0, or later are loaded on a persons computer a zero day security hole may occur.

The trouble begins when visiting a site with malicious content while using IE. The site then registers a "firefoxurl://" URI (uniform resource identifier) handler, that gives access to that site and allows it to interact with IE.

The Security researcher named Thor Larholm who discovered the Security Hole and Symantec put much of the blame on IE, while Secunia's chief technology researcher named Thomas Kristensen, blamed FireFox for this Security Issue.

Source : Zdnet

View at TechPowerUp Main Site

cmberry20 · Jul 12, 2007

"If both IE and Firefox version 2.0, or later are loaded on a persons computer a zero day security hole may occur."

That quote in it self will apply to 99% of PC users as IE comes fully installed on all XP & Vista machines.
So just installing Mozilla will causes this scenario to happen.

GJSNeptune · Jul 12, 2007

cmberry20 said:
So just installing Mozilla will causes this scenario to happen.

Not quite. You have to be using IE, and "Mozilla" is just a company.

Firefox is the vehicle, but it's relaly IE's fault.

"Firefox is the current attack vector, but Internet Explorer is to blame for not escaping...characters when passing on the input to the command line," said Larholm

Darknova · Jul 12, 2007

HAHAH, they BOTH are too blame. IE for having the security flaw...and Firefox for...oh yeah, having the security flaw.

GJSNeptune · Jul 12, 2007

Firefox's only involvement is being installed.

Darknova · Jul 12, 2007

GJSNeptune said:
Firefox's only involvement is being installed.

If it wasn't installed there wouldn't be a problem....hence it has a security flaw. Maybe not some gaping hole like IE has, but still a flaw none the less.

Telexen · Jul 12, 2007

Darknova said:
If it wasn't installed there wouldn't be a problem....hence it has a security flaw. Maybe not some gaping hole like IE has, but still a flaw none the less.

But if it's installed on Linux, where IE doesn't belong - then it has no problem

GJSNeptune · Jul 12, 2007

Darknova said:
If it wasn't installed there wouldn't be a problem....hence it has a security flaw. Maybe not some gaping hole like IE has, but still a flaw none the less.

It's a flaw because it takes advantage of IE when Firefox is installed. It has nothing to do with Firefox. It's entirely IE's shortcomings that makes this a risk.

The trouble begins when browsing a malicious site while using IE and it registers a "firefoxurl://" URI (uniform resource identifier) handler, which allows the browser to interact with specific resources on the Web. As a result, users may find their systems remotely compromised.

I'll quote this yet again:

"Firefox is the current attack vector, but Internet Explorer is to blame for not escaping ... characters when passing on the input to the command line," said Larholm.

Darknova · Jul 12, 2007

"It's a little bit of both," said Oliver Friedrichs, director of Symantec's Security Response Center. "You have two very complex applications that are not playing well together and leading to a security issue. The components themselves are secure as stand-alone products but not together."

It is not entirely IE's fault. I understand exactly how the risk came about, I understand how it is attacked, and I understand the under lying fault is with IE. However without FF there is no problem, as FF, in a sense, opening up the hole.

I still agree entirely that it is mostly IEs fault, but FF is not entirely blameless.

Dippyskoodlez · Jul 12, 2007

Darknova said:
It is not entirely IE's fault. I understand exactly how the risk came about, I understand how it is attacked, and I understand the under lying fault is with IE. However without FF there is no problem, as FF, in a sense, opening up the hole.

I still agree entirely that it is mostly IEs fault, but FF is not entirely blameless.

But... Can this be used if something other than firefox were to use the same method?

Its ie.. :laugh:

Benpi · Jul 12, 2007

If you're an anti-MS club member (or own a mac), then this is 100% IE's fault. If you're in the MS fanclub, it's FireFox's fault. If you really don't give a shart, it's both of their fault.

GJSNeptune · Jul 12, 2007

There is skewed logic working here. The flaw exploits a hole in IE, but it only works if Firefox is installed. Firefox has nothing to do with IE not escaping characters. If a patch comes out, it'd be for IE, not Firefox.

Dippyskoodlez · Jul 12, 2007

GJSNeptune said:
There is skewed logic working here. The flaw exploits a hole in IE, but it only works if Firefox is installed. Firefox has nothing to do with IE not escaping characters. If a patch comes out, it'd be for IE, not Firefox.

Exactly.

If you wanna scrape it up to fanboi-ism, GTFO.

The fix will be for IE.

HellasVagabond · Jul 12, 2007

Calm down people....

GJSNeptune · Jul 12, 2007

Calm as can be. Don't know why the mods have been exaggerating intensity.

HellasVagabond · Jul 12, 2007

Anyways everybodys goal is for this to get fixed so no point arguing about IE and Firefox.
Both are Outstanding Browsers.

GJSNeptune · Jul 12, 2007

Quick fix. Don't use IE.

HellasVagabond · Jul 12, 2007

I like it far more than Firefox.....And im sure many people do also.....However lately MS is releasing updates once a month so no problems there

demonbrawn · Jul 12, 2007

I personally like Firefox because of all the little free add-ons. Anyway, I don't think it really matters which program caused the issue as long as it gets fixed.

GJSNeptune · Jul 12, 2007

It matters when one is being falsely accused and criticized.

HellasVagabond · Jul 12, 2007

It takes both program faulty codes to create this mess GJSNeptune...Its not just 1 of those 2 thats bad.

Ketxxx · Jul 12, 2007

Darknova said:
If it wasn't installed there wouldn't be a problem....hence it has a security flaw. Maybe not some gaping hole like IE has, but still a flaw none the less.

The only flaw that was made was the creation of Internet Explorer.

WarEagleAU · Jul 12, 2007

Firefox is the bomb. Safe and secure, but now it seems folks are targetting it. I guess they are tired of everyone ragging IE

Dippyskoodlez · Jul 12, 2007

HellasVagabond said:
It takes both program faulty codes to create this mess GJSNeptune...Its not just 1 of those 2 thats bad.

It sounds like IE is not handling certain text correctly... enabling something to take advantage of an internal link ability of firefox... with this, simply patching IE would....... solve the problem, would it not?

HellasVagabond · Jul 12, 2007

We will see...If MS is the only one to release a patch yes, but if Mozilla releases an update too then no

System Name	SECONDARY RIG / PRIMARY RIG / THIRD RIG
Processor	i920@3.6GHz / i920@4GHz / AMD Phenom II 955
Motherboard	Gigabyte EX58-UD4P / Gigabyte EX58-UD7 / ASRock 890GX3
Cooling	CoolIT Domino ALC / Thermalright Silver Arrow / Thermalright VenomousX
Memory	12GB DDR3 @ 1800MHZ / 6GB DDR3 @ 2250MHZ / 4GB DDR3 @ 1600MHZ
Video Card(s)	XFX ATI RADEON 5970 / GAINWARD NVIDIA GTX 580 / 2xGEFORCE GTX295
Storage	1550GB / 6TB SAS - SSD / 160GB SSD
Display(s)	NEC 26WUXi2 / NEC 3090WQXi / SONY 55A2000 (1080P 55inch)
Case	COOLER MASTER HAF 932 / COOLER MASTER ATCS 840 / ANTEC DARKFLEET DF85
Audio Device(s)	Soundblaster X-Fi Xtreme Music / SoundBlaster X-Fi Fatal1ty Pro / Realtek Onboard
Power Supply	CWT 1200W / Enermax Revolution 85+ 1250W / Ikonik Vulcan 1200W
Software	Windows 7 x64 / Windows 7 x64 / Windows 7 x64

Processor	AMD Athlon 64 X2 5000+ Black Edition
Motherboard	Gigabyte GA-MA770-DS3
Cooling	Tuniq Tower 120 (with Scythe SFF21E)
Memory	2x1GB Corsair XMS2 DDR2-800 CAS4 DHX
Video Card(s)	PALiT 9800GTX 512MB PCI-E
Storage	WD2500AAKS, WD1600YS, WD1200JD, WD400EB
Display(s)	LG L1920P, Viewsonic VA520
Case	Lian-Li A05b (with two 120mm Yate Loon D12SM)
Power Supply	Corsair HX520
Software	Vista Business 32-bit/XP Pro 32-bit dual-boot

Processor	AMD FX 8320 @ 4GHz
Motherboard	Gigabyte GA-990FXA-UD5 rev1
Cooling	Corsair H70
Memory	4 x 4GB DDR3 Ripjawz 1600Mhz
Video Card(s)	Sapphire Vapor-X AMD R9 280X
Storage	1 x 500GB Samsung Evo 850, 1 x 500GB Vrap Data Drive, 3 x 2TB Seagate, 1 x 1TB Samsung F1
Display(s)	3 x DGM IPS-2402WDH
Case	Coolermaster HAF X
Audio Device(s)	Onboard
Power Supply	Coolermaster 1000W Silent Pro M
Mouse	Logitech G502
Keyboard	Logitech G510
Software	Windows 10 Pro x64

Processor	AMD Athlon 64 X2 5000+ Black Edition
Motherboard	Gigabyte GA-MA770-DS3
Cooling	Tuniq Tower 120 (with Scythe SFF21E)
Memory	2x1GB Corsair XMS2 DDR2-800 CAS4 DHX
Video Card(s)	PALiT 9800GTX 512MB PCI-E
Storage	WD2500AAKS, WD1600YS, WD1200JD, WD400EB
Display(s)	LG L1920P, Viewsonic VA520
Case	Lian-Li A05b (with two 120mm Yate Loon D12SM)
Power Supply	Corsair HX520
Software	Vista Business 32-bit/XP Pro 32-bit dual-boot

Processor	AMD FX 8320 @ 4GHz
Motherboard	Gigabyte GA-990FXA-UD5 rev1
Cooling	Corsair H70
Memory	4 x 4GB DDR3 Ripjawz 1600Mhz
Video Card(s)	Sapphire Vapor-X AMD R9 280X
Storage	1 x 500GB Samsung Evo 850, 1 x 500GB Vrap Data Drive, 3 x 2TB Seagate, 1 x 1TB Samsung F1
Display(s)	3 x DGM IPS-2402WDH
Case	Coolermaster HAF X
Audio Device(s)	Onboard
Power Supply	Coolermaster 1000W Silent Pro M
Mouse	Logitech G502
Keyboard	Logitech G510
Software	Windows 10 Pro x64

Processor	Dual Opteron 265s (each with dual cores @ 2ghz)
Motherboard	Asus K8N-DL
Cooling	Watercooled with 2 x Swiftech Apogees + DD D5
Memory	2x1gb Corsair ECC Registered PC3200 DDR
Video Card(s)	GeForce 7600gt
Storage	920gb total storage
Display(s)	Samsung SyncMaster 205BW
Case	Self painted double wide server case (Chenbro SR103)
Audio Device(s)	Sound Blaster Audigy 2 Value
Power Supply	600W Silverstone Quad rail
Software	Gentoo Linux amd64 (NO Windows!)

System Name	Dell XPS 15 9560
Processor	I7-7700HQ
Memory	32GB DDR4
Video Card(s)	GTX 1050/1080 Ti
Storage	1TB SSD
Display(s)	2x Dell P2715Q/4k Internal
Case	Razer Core
Audio Device(s)	Creative E5/Objective 2 Amp/Senn HD650
Mouse	Logitech Proteus Core
Keyboard	Logitech G910

Processor	AMD X2 4400+
Memory	2G
Video Card(s)	7950 GX2
Storage	2x 74g 10000rpm Raid:0
Display(s)	Dell 1920x1200 widescreen
Software	3dmark06 score: 7650

System Name	Sony Vaio - VGNFW390-CTO
Processor	Intel® Core™ 2 Duo Processor T9550 (2.66GHz)
Cooling	Stock
Memory	4GB DDR2-SDRAM (DDR2-800, 2GBx2)
Video Card(s)	ATI Mobility Radeon™ HD 3650 with 512MB vRAM (pitiful card)
Storage	320GB SATA Hard Disk Drive [7200 rpm]
Display(s)	LCD 16.4" (XBRITE-FullHD™)
Audio Device(s)	SupremeFX
Software	Windows 7

System Name	Ravens Talon
Processor	AMD R7 3700X @ 4.4GHz 1.3v
Motherboard	MSI X570 Tomahawk
Cooling	Modded 240mm Coolermaster Liquidmaster
Memory	2x16GB Klevv BoltX 3600MHz & custom timings
Video Card(s)	Powercolor 6800XT Red Devil
Storage	250GB Asgard SSD, 1TB Integral SSD, 2TB Seagate Barracuda
Display(s)	27" BenQ Mobiuz
Case	NZXT Phantom 530
Audio Device(s)	Asus Xonar DX 7.1 PCI-E
Power Supply	1000w Supernova
Software	Windows 10 x64
Benchmark Scores	Fast. I don't need epeen.

System Name	Pandemic 2020
Processor	AMD Ryzen 5 "Gen 2" 2600X
Motherboard	AsRock X470 Killer Promontory
Cooling	CoolerMaster 240 RGB Master Cooler (Newegg Eggxpert)
Memory	32 GB Geil EVO Portenza DDR4 3200 MHz
Video Card(s)	ASUS Radeon RX 580 DirectX 12 DUAL-RX580-O8G 8GB 256-Bit GDDR5 HDCP Ready CrossFireX Support Video C
Storage	WD 250 M.2, Corsair P500 M.2, OCZ Trion 500, WD Black 1TB, Assorted others.
Display(s)	ASUS MG24UQ Gaming Monitor - 23.6" 4K UHD (3840x2160) , IPS, Adaptive Sync, DisplayWidget
Case	Fractal Define R6 C
Audio Device(s)	Realtek 5.1 Onboard
Power Supply	Corsair RMX 850 Platinum PSU (Newegg Eggxpert)
Mouse	Razer Death Adder
Keyboard	Corsair K95 Mechanical & Corsair K65 Wired, Wireless, Bluetooth)
Software	Windows 10 Pro x64

Incompatibility Between Firefox and Internet Explorer Causes Security Hole

New Member

New Member

New Member

New Member

New Member

New Member

New Member

New Member

New Member

New Member

New Member

New Member

New Member

New Member

Heedless Psychic

Bird of Prey

New Member