Remote Command Exec (FireFox 2.0.0.5 et al)

By: Nate McFeters nate dot mcfeters -at- gmail Billy BK Rios billy dot rios -at- gmail Tested in FireFox 2.0.0.5 and 3.0a6, Netscape Navigator 9, and Mozilla browser. NOTE These examples were created for WinXP SP2 with no external mail programs installed outlook, notes…etc. If you have an externa...

[Full-disclosure] More URI Handling Vulnerabilites (FireFox Remote Command Execution)

Internet Explorer has received a lot of attention lately for the way it handles requests for external URIs.... Nate and I have warned that IE isn't the only browser with URI handling issues.... I've posted a PoC for remote command execution in Firefox 2.0.0.5, Netscape Navigator 9, and mozilla at...

Cross site scripting

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Netscape installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a -chrome argument to the...

CVE-2007-3924

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Netscape installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a -chrome argument to the...

CVE-2007-3924

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Netscape installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a -chrome argument to the...

CVE-2007-3924

CVE-2007-3924 describes an argument-injection vulnerability in Internet Explorer when Netscape is installed and certain URIs are registered. The issue arises from IE not properly delimiting the URL argument when invoking Netscape, allowing remote attackers to perform cross-browser scripting and e...

Microsoft Internet Explorer and Mozilla Firefox URI Handler Command Injection Vulnerability

Description Microsoft Internet Explorer, Mozilla Firefox and Netscape Navigator are prone to a vulnerability that lets attackers inject commands through the 'firefoxurl' and 'navigatorurl' protocol handlers. Exploiting these issues allows remote attackers to pass and execute arbitrary commands an...

US-CERT Technical Cyber Security Alert TA07-151A -- Mozilla Updates for Multiple Vulnerabilities

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 National Cyber Alert System Technical Cyber Security Alert TA07-151A Mozilla Updates for Multiple Vulnerabilities Original release date: May 31, 2007 Last revised: -- Source: US-CERT Systems Affected Mozilla Firefox Mozilla Thunderbird Mozilla SeaMonk...

security flaw

The 1 Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the 2 Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a...

security flaw

The 1 Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the 2 Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a...

CVE-2007-1377

AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service unspecified resource consumption via a .pdf URL with an anchor identifier that begins with search= followed by many %n sequences, a different vulnerability...

CVE-2007-1377

AcroPDF.DLL in Adobe Reader 8.0, when accessed from Mozilla Firefox, Netscape, or Opera, allows remote attackers to cause a denial of service unspecified resource consumption via a .pdf URL with an anchor identifier that begins with search= followed by many %n sequences, a different vulnerability...

security flaw

The 1 Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the 2 Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a...

security flaw

The 1 Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the 2 Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a...

security flaw

The 1 Password Manager in Mozilla Firefox 2.0, and 1.5.0.8 and earlier; and the 2 Passcard Manager in Netscape 8.1.2 and possibly other versions, do not properly verify that an ACTION URL in a FORM element containing a password INPUT element matches the web site for which the user stored a...

CVE-2007-0320

Multiple buffer overflows in a an ActiveX control iftw.dll and b Netscape plug-in npiftw32.dll for Macrovision formerly InstallShield InstallFromTheWeb allow remote attackers to execute arbitrary code via crafted HTML documents...

Buffer overflow

Multiple buffer overflows in a an ActiveX control iftw.dll and b Netscape plug-in npiftw32.dll for Macrovision formerly InstallShield InstallFromTheWeb allow remote attackers to execute arbitrary code via crafted HTML documents...

CVE-2007-0320

CVE-2007-0320 involves Macrovision’s InstallFromTheWeb product (ActiveX control in iftw.dll and Netscape plug-in in npiftw32.dll). The connected sources document multiple buffer overflows in these components that could allow an attacker to execute arbitrary code via crafted HTML documents, potent...

CVE-2007-0320

Multiple buffer overflows in a an ActiveX control iftw.dll and b Netscape plug-in npiftw32.dll for Macrovision formerly InstallShield InstallFromTheWeb allow remote attackers to execute arbitrary code via crafted HTML documents...

Macrovision / InstallShield InstallFromTheWeb buffer overflows

Overview Macrovision / InstallShield InstallFromTheWeb contains multiple buffer overflows, which could allow an attacker to execute arbitrary code on a vulnerable system. Description InstallShield InstallFromTheWeb is a web-based software installation product for Microsoft Windows systems...