A "highly critical" security flaw has been discovered in Firefox, which could allow a malicious attacker to gain remote control of a user's system, according to an advisory issued by Secunia.
The security flaw is found in Firefox 2.0 and later versions, due to the way it registers the "firefoxurl://" URI (uniform resource identifier) handler, which allows the browser to interact with specific resources on the Web.
"A new URI handler was registered on Windows systems to allow Web sites to force launching Firefox if the 'firefoxurl://' URI was called, like ftp://, http://, or similar would call other applications," explained Thomas Kristensen, Secunia chief technology officer.
But because of the way the URI handler was registered by Firefox, it causes any parameter--which activates a program to perform a particular task--to be passed from Microsoft's Internet Explorer, or another application, to Firefox, when firefoxurl:// is activated.
|