Firefox 2.0: new vulnerability

16th July 2007

The company Secunia reported the discovery of a new critical vulnerability in Mozilla Firefox version 2.0. The problem consists in how Firefox treats registration of URI, through which the attacker can gain access to the command line of the browser. Testing was carried out on Firefox 2.0.0.4 under Windows XP SP2 with the latest updates. It is noticed, that the vulnerability applies to Internet Explorer as well. Since Mozilla has not yet released a suitable patch, Secunia strongly recommends avoiding any suspicious sites. The vulnerability has been publicly revealed, so Firefox users can only rely on Mozilla competence. Owners of Internet Explorer are in a more difficult situation - the next patch for the browser will be available only in a month. MS releases “extra” patches quite rarely and only in emergency cases.