New flaw in the Firefox "jar" protocol handler...

General Topics
1

Hi malware fighters,

A new protocol handling problem has been found in the Firefox “jar” protocol handler, exposing users to site scripting attacks.

Important advisory: latest NoScript development
version offers protection against the XSS dangers
originated by jar: URIs. Please help us testing this
beta.
http://noscript.net/

pol

2

Hi malware fighters,

Allthough FF developers knew about the hole since Febr. last, they are still working on a final patch that seems round the corner now:
http://blog.mozilla.com/security/2007/11/16/jar-protocol-xss-security-issues/

pol

3

There is always the latest windows patch which is supposed to address the URI issue with XP and IE7, patch is also for IE6.

http://www.microsoft.com/technet/security/Bulletin/MS07-061.mspx

Vulnerability in Windows URI Handling Could Allow Remote Code Execution (943460)
4

Is it available through Windows Updates?

5

Yes it is in the Nov 2007 batch of security updates.

6

Hi malware fighters,

See how NoScript protects you:
https://bugzilla.mozilla.org/attachment.cgi?id=289243

pol

7

Thanks for the test. I’m fully protected.

8

polonus

Thanks for the test and i am protected as well.

Cheers crofty59

9

polonus-i uninstalled firefox because of all the security issues,extensions problems i was having and all the other issues it’s having of late-using opera mainly now-will go back to using firefox also when the smoke clears :wink: