[VU:130923] Mozilla Firefox command line URI handling vulnerability

Overview

Mozilla Firefox contains a vulnerability that may allow an attacker to bypass security restrictions by opening specially crafted URIs using the Firefox command line interface.

Impact

A remote attacker may be able to use this vulnerability to bypass security restrictions, or to aid in the exploitation of other vulnerabilities.

Solution

Upgrade
Per Mozilla Foundation Security Advisory 2008-35 this issue has been addressed in Firefox 3.0.1 and Firefox 2.0.0.16.

Acknowledgements

Thanks to Mozilla for information that was used in this report. Mozilla credits Billy Rios for reporting this issue and Ben Turner and Dan Veditz for discovering additional attack vectors.