Cross-browser Firefox/IE flaw worsens

Security researchers Nate McFeters, Billy Rios and Raghav Dube have disclosed information and working exploit code for a similar vulnerability in Trillian. 

Like the Firefox attack, the Trillian exploit uses a Uniform Resource Identifier (URI) function as the point of attack. 

The URI allows the browser to launch a third-party application on the user's system in much the same way that a URL is used to access a web page.

When the user visits a specially-crafted page, the application is launched and attack code is run to crash the application and execute code. The attack could be used to remotely install malware on a user's system.

The researchers claim that, while this attack only affects AIM clients, any application that allows for URI access could be targeted with similar attacks.

McFeters, Rios and Dube recommend that developers disable any unnecessary URI functions from their applications.

A Microsoft spokesperson told vnunet.com that the company is "investigating new public claims of a possible vulnerability in Internet Explorer" but would not elaborate further. 

Microsoft has not received reports of any attacks targeting the vulnerability.

Copyright ©v3.co.uk

flawsecurity