mailing list archives
Mozilla Security Advisory 2004-07-08
From: dveditz () cruzio com
Date: Thu, 8 Jul 2004 22:36:48 GMT
Mozilla Security Advisory
July 7, 2004
Summary: Windows shell: scheme exposed in Mozilla
Products: Mozilla (Suite)
Fixed in: Mozilla (Suite) 1.7.1
Mozilla Firefox 0.9.2
Mozilla Thunderbird 0.7.2
Windows versions of Mozilla products pass URIs using the shell: scheme
to the OS for handling. The effects depend on the version of windows,
but on Windows XP it is possible to launch executables in known
locations or the default handlers for file extensions. It could be
possible to combine this effect with a known buffer overrun in one
of these programs to create a remote execution exploit, although
at this time we have confirmed only denial-of-service type attacks
(including crashing the system in some cases).
We urge people to install the patch available on mozilla.org or
install the latest version of the software.
Mozilla Security Group
Full-Disclosure - We believe in it.
- Mozilla Security Advisory 2004-07-08 dveditz (Jul 08)