Re: Mozilla protocol abuse

[bugtraq () cgisecurity net]

Does anyone know of a full list of Protocol handlers on the major browsers in a central location?

- Robert
http://www.cgisecurity.com/ Application Security news and more.

 
> The Mozilla application platform currently has an unpatched input 
> validation flaw which allows you to specify arbitrary command line 
> arguments to any registered URL protocol handler process. Jesper 
> Johansson already detailed parts of this on his blog on July 20, 
> http://msinfluentials.com/blogs/jesper/. I wrote a vulnerability report 
> on July 18 together with a proof-of-concept exploit that targeted 
> Thunderbird 2.0.0.4.
>
> Thunderbird 2.0.0.5 was released on July 19 and incidentally fixed this 
> specific attack vector through its "osint" command line flag. It is now 
> 6 days later and people should have had time to update their Thunderbird 
> installations, so I have decided to publish my vulnerability report 
> together with the exploits as they detail how to handle XPI exploitation.
>
> The HTML version can be found at
>
> http://larholm.com/2007/07/25/mozilla-protocol-abuse/
>
> A ZIP file with the report and the XPI exploits can be found at
>
> http://larholm.com/media/2007/7/mozillaprotocolabuse.zip 
>
>
> Cheers
> Thor Larholm
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/