Member Avatar for kc0arf
kc0arf 68 Posting Virtuoso

Security researchers announced a new vulnerability for users of the Firefox 1.0.6 browsers on a Unix or Linux platform. The problem revolves around a security bug that could allow hackers to execute arbitrary shell commands if they can trick the user into accepting a malicious link on a website.

The problem has been confirmed with RedHat Linux / Fedora Core 4, and Mozilla Firefox version 1.0.6. Users of Firefox on these systems are encouraged to upgrade to Firefox 1.0.7

Christian

  • 1 Contributor
  • 0 Replies
  • 198 Views

Dani AI

Generated

Per 's report, this is the 2005 Linux/Unix command-line URI bug: URLs handed to the browser from other programs were not properly escaped and could contain shell metacharacters that get interpreted by bash, allowing arbitrary command execution. The issue is documented in Mozilla’s MFSA-2005-59 and tracked as CVE-2005-2968. (mozilla.org)

How the vector worked: an external app (mail, chat, etc.) passes a link to the system default browser. On vulnerable builds that hand the raw URI to the shell, an attacker-controlled URI with metacharacters (for example ; or |) could inject commands. The MFSA advisory and linked Bugzilla entry explain the exploit path and affected Mozilla products. (mozilla.org)

Quick, practical checks and mitigations (commands for legacy systems):

# check Firefox version
firefox --version

# RPM-based systems (Fedora/Red Hat)
rpm -q firefox
yum update firefox

# Debian/Ubuntu
dpkg -l | grep firefox
apt-get update && apt-get install --only-upgrade firefox

If an immediate package upgrade is not possible, avoid using the affected build as the system default URL handler or disable automatic opening of links from external clients until patched. Distro advisories and updates were published for Fedora/Ubuntu at the time. (linuxtoday.com)

Historic note: the bug was fixed upstream in the Mozilla releases cited in MFSA-2005-59; modern, supported Firefox releases no longer include this specific flaw. For deep-dive or archival research, consult the MFSA entry and the CVE record for full technical detail. (mozilla.org)

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.