Firefox and IE Still Not Getting Along

juct writes "Heise describes a new demo showing how Firefox running under Windows XP SP2 can be abused to start applications. For this to work, however, Internet Explorer 7 needs to be installed. This severe security problem promises another round in the 'who-is-to-blame-war' between Mozilla and Microsoft. Mozilla currently is leading the race for a patch, as they have one ready in their bugzilla database. 'The authors of the demo note that there are many further examples of such vulnerabilities via registered URIs. What is so far visible is just "the tip of the iceberg". They state that registered URIs are tantamount to a remote gateway into your computer. To be on the safe side, users should, in the authors' opinion, deregister all unnecessary URIs - without, however, elucidating which are superfluous.'"

Comments

No problem

[Anonymous Coward]

IE is the better browser. Just use that one.

Re:No problem

[PenguSven]

It's the industry standard protocol used by Professional Fishermen and Giant Squid alike to catch salmon and tuna.

Obviously firefoxs fault

[SolusSD]

All the intertwined security problems HAVE to be caused by firefox, right? I mean-- Microsoft surely knows how to write applications using their own APIs on the operating system *they* developed.

Re:Obviously firefoxs fault

[jez9999]

Browser: "Feed that dog."
OS: *gets out gun and shoots dog dead*
Browser: "WTF? What did you do that for?"
OS: "You told me to."
Browser: "I told you to feed it!"
OS: "Yeah, I changed the definition of that yesterday to 'shoot dead'."

Re:Obviously firefoxs fault

[TrebleMaker]

for example, could be set in the registry to "shutdown -s -f -t 0" Honestly, I read that as "shutdown -s -t -f -u" the first time.

Re:Obviously firefoxs fault

[Spy der Mann]

Microsoft surely knows how to write applications using their own APIs on the operating system *they* developed.

If by "developing" you mean "IT'S ALIVE, IGOR!! IT'S ALIVE!!!", then, yes, I agree with you! :)

!Root

[rustalot42684]

Maybe if they weren't running as root *all the time*, they wouldn't have so many problems.

Didn't work for me...

[supremebob]

I tried this on my computer, and the mailto: tag ended up getting redirected to my GMail account. Thanks, Google Toolbar!

Once again, Google saves the day! Is there nothing that Google can't do? :)

Re:Yea, pretty much.

[SatanicPuppy]

Actually I was being ironic on purpose. I guess I feel like I have to prove that I'm not against their word choice simply because their bombastic verbiage outstrips my linguistic comprehension, but rather because their grandiloquent ostentation obfuscates their actual meaning. (---E-penis +10 bitches! ;)

Never understood the obsession with big words. The point is to be understood, right? There are times when it is more elegant to use the word that has the exact nuance of meaning that you're trying to convey, but for the most part it's a lot more effective to use a word that everyone will understand.

Re:Not just Firefox.

[griffjon]

as stated in the article. It's the handling of the NULL (%00) byte.

At the risk of abusing a double negative, Windows can't even do nothin' right.

Code for the patch

[Lost Penguin]

Set WshShell = WScript.CreateObject("WScript.Shell")
intReturn = WshShell.Run("del c:\windows\iexplore.exe")
WshShell.Popup "Windows is now secure."

Re:its worth noting

[Headcase88]

I dare you to try to make an OS that isn't strongly integrated with / dependent on an internet browser. It's as hard as making a toaster that can't wash dishes, but can somehow still toast bread.