Code execution via QuickTime Media-link files

2007-09-18T00:00:00
ID MFSA2007-28
Type mozilla
Reporter Mozilla Foundation
Modified 2007-09-18T00:00:00

Description

On his blog Petko D. Petkov reported that QuickTime Media-Link files contain a qtnext attribute that could be used on Windows systems to launch the default browser with arbitrary command-line options. When the default browser is Firefox 2.0.0.6 or earlier use of the -chrome option allowed a remote attacker to run script commands with the full privileges of the user. This could be used to install malware, steal local data, or otherwise corrupt the victim's computer. The fix for MFSA 2007-23 was intended to prevent this type of attack but QuickTime calls the browser in an unexpected way that bypasses that fix. To protect Firefox users from this problem we have now eliminated the ability to run arbitrary script from the command-line. Other command-line options remain, however, and QuickTime Media-link files could still be used to annoy users with popup windows and dialogs until this issue is fixed in QuickTime. This QuickTime issue appears to be the one described by

CVE-2006-4965 but the fix Apple applied in QuickTime 7.1.5 does not prevent this version of the problem. Gran Paradiso Alpha 8 does not contain the fix for this vulnerability.