vendor:
Firefox and Navigator
by:
SecurityFocus
7.5
CVSS
HIGH
Protocol Handler Injection
94
CWE
Product Name: Firefox and Navigator
Affected Version From: Mozilla Firefox 2.0.0.5, 3.0a6 and Netscape Navigator 9
Affected Version To: Mozilla Firefox 2.0.0.5, 3.0a6 and Netscape Navigator 9
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows
2007
Multiple Browsers Protocol Handler Injection Vulnerability
Multiple browsers are prone to vulnerabilities that let attackers inject commands through various protocol handlers. Exploiting these issues allows remote attackers to pass and execute arbitrary commands and arguments through processes such as 'cmd.exe' by employing various URI handlers. An attacker can exploit these issues to carry out various attacks by executing arbitrary commands on a vulnerable computer.
Mitigation:
Ensure that all user input is validated and filtered before being passed to the protocol handler. Additionally, ensure that the application is running with the least privileges necessary to perform its function.
