The browser
flaw which allows attackers to hijack a computer by using
Internet
Explorer to launch
Firefox is affecting
other applications as well.
Security researchers
Nate
McFeters, Billy Rios and Raghav Dube have disclosed information and working
exploit code for a similar vulnerability in
Trillian.
Like the Firefox attack, the Trillian exploit uses a
Uniform
Resource Identifier (URI) function as the point of attack.
The URI allows the browser to launch a third-party application on the user's
system in much the same way that a URL is used to access a web page.
When the user visits a specially-crafted page, the application is launched
and attack code is run to crash the application and execute code. The attack
could be used to remotely install malware on a user's system.
The researchers claim that, while this attack only affects AIM clients, any
application that allows for URI access could be targeted with similar attacks.
McFeters, Rios and Dube recommend that developers disable any unnecessary URI
functions from their applications.
A
Microsoft
spokesperson told
vnunet.com
that the company is "investigating new public claims of a possible vulnerability
in Internet Explorer" but would not elaborate further.
Microsoft has not received reports of any attacks targeting the
vulnerability.
Do you agree?
Have your say on this article