Firefox and IE Still Not Getting Along 207
juct writes "Heise describes a new demo showing how Firefox running under Windows XP SP2 can be abused to start applications. For this to work, however, Internet Explorer 7 needs to be installed. This severe security problem promises another round in the 'who-is-to-blame-war' between Mozilla and Microsoft. Mozilla currently is leading the race for a patch, as they have one ready in their bugzilla database. 'The authors of the demo note that there are many further examples of such vulnerabilities via registered URIs. What is so far visible is just "the tip of the iceberg". They state that registered URIs are tantamount to a remote gateway into your computer. To be on the safe side, users should, in the authors' opinion, deregister all unnecessary URIs - without, however, elucidating which are superfluous.'"
Re:Obviously firefoxs fault (Score:1, Interesting)
If I create a URL that manages to get Firefox to tell Windows to run a command, how is that Windows' fault? Firefox is the one that told Windows to execute the command, Windows just did what Firefox told it to do.
Re:Obviously firefoxs fault (Score:4, Interesting)
also... i'm pretty sure if windows was a person he would punch himself in the genitals if he was asked to.
Re:bug database (Score:5, Interesting)
Unfortunately it doesn't fix the real problem, only makes FF work around it. Other applications could have the same issue on affected systems. According to TFA:
If this is true, it is the URL protocol handler that needs a patch (or whatever replaces/modifies its behaviour when IE7 is installed).
One more reason I prefer Open Source software: If you're a developer and run into a problem like this, then besides work around it in your application, you also have the option to fix the actual problem (in this case, the OS component that handles URL's). Next to impossible on a closed source OS.
Re:Obviously firefoxs fault (Score:5, Interesting)
That said, I completely agree with you on the firefoxurl: flaw.
Re:Not just Firefox. (Score:3, Interesting)
If you prefer the Readers' Digest version with your helping of crow:
AndSounds like what I did on a mac (Score:2, Interesting)
Thanks Mac-Firefox
Re:Obviously firefoxs fault (Score:4, Interesting)
If you leave your door open, the cable guy can come in anytime and fix your cable box. You dont have to house sit over that stupid four hour window. Would you do that? Then why people put up such great resistance to the idea that you must take action, not doable by the browser alone, to download and execute a file from the internet?
Re:No problem (Score:4, Interesting)