Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
Arbitrary Code Execution Vulnerability in Mozilla
A vulnerability has been found in Mozilla that could let a potential attacker remotely execute arbitrary code on the vulnerable system.
Ken Pfeil
July 13, 2004
1 Min Read
Reported July 9, 2004, by MozillaSecurity Group
VERSIONS AFFECTED
DESCRIPTION
Windows versions of Mozilla products use the shell: scheme to pass UniformResource Identifiers (URIs) to the OS for handling. The effects of thevulnerability depend on the version of Windows, but on Windows XP it's possibleto launch executables in known locations or the default handlers for fileextensions. An attacker could combine this effect with a known buffer overrunin any of the affected Mozilla programs to create a remote execution exploit.
VENDOR RESPONSE
The Mozilla Foundation hasreleased the securitybulletin "What Mozilla users should know about the shell: protocolsecurity issue," which addresses this vulnerability, and recommends thataffected users immediately apply the appropriate patch listed in the bulletinor upgrade to the latest software release.
CREDIT
Discovered by Keith McCanless.
About the Author(s)
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
.jpg?width=700&auto=webp&quality=80&disable=upscale)