GSD-2007-3670
Vulnerability from gsd - Updated: 2023-12-13 01:21Details
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2007-3670",
"description": "Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE\u0027s opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a \"defense in depth\" fix that will \"prevent IE from sending Firefox malicious data.\"",
"id": "GSD-2007-3670",
"references": [
"https://www.suse.com/security/cve/CVE-2007-3670.html"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2007-3670"
],
"details": "Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE\u0027s opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a \"defense in depth\" fix that will \"prevent IE from sending Firefox malicious data.\"",
"id": "GSD-2007-3670",
"modified": "2023-12-13T01:21:42.186310Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-3670",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE\u0027s opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a \"defense in depth\" fix that will \"prevent IE from sending Firefox malicious data.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "ADV-2007-2473",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/2473"
},
{
"name": "USN-503-1",
"refsource": "UBUNTU",
"url": "http://www.ubuntu.com/usn/usn-503-1"
},
{
"name": "1018360",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1018360"
},
{
"name": "1018351",
"refsource": "SECTRACK",
"url": "http://www.securitytracker.com/id?1018351"
},
{
"name": "HPSBUX02156",
"refsource": "HP",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579"
},
{
"name": "http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/",
"refsource": "MISC",
"url": "http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/"
},
{
"name": "HPSBUX02153",
"refsource": "HP",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
},
{
"name": "MDKSA-2007:152",
"refsource": "MANDRIVA",
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:152"
},
{
"name": "25984",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/25984"
},
{
"name": "ie-firefoxurl-command-execution(35346)",
"refsource": "XF",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35346"
},
{
"name": "TA07-199A",
"refsource": "CERT",
"url": "http://www.us-cert.gov/cas/techalerts/TA07-199A.html"
},
{
"name": "28179",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28179"
},
{
"name": "24837",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/24837"
},
{
"name": "http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx",
"refsource": "MISC",
"url": "http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx"
},
{
"name": "26216",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26216"
},
{
"name": "SSRT061236",
"refsource": "HP",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579"
},
{
"name": "http://www.virusbtn.com/news/virus_news/2007/07_11.xml",
"refsource": "MISC",
"url": "http://www.virusbtn.com/news/virus_news/2007/07_11.xml"
},
{
"name": "http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/",
"refsource": "MISC",
"url": "http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/"
},
{
"name": "20070719 Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability",
"refsource": "IDEFENSE",
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565"
},
{
"name": "ADV-2007-2565",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/2565"
},
{
"name": "http://www.mozilla.org/security/announce/2007/mfsa2007-40.html",
"refsource": "CONFIRM",
"url": "http://www.mozilla.org/security/announce/2007/mfsa2007-40.html"
},
{
"name": "26149",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26149"
},
{
"name": "ADV-2008-0082",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2008/0082"
},
{
"name": "38017",
"refsource": "OSVDB",
"url": "http://osvdb.org/38017"
},
{
"name": "http://www.mozilla.org/security/announce/2007/mfsa2007-23.html",
"refsource": "CONFIRM",
"url": "http://www.mozilla.org/security/announce/2007/mfsa2007-23.html"
},
{
"name": "VU#358017",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/358017"
},
{
"name": "http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html",
"refsource": "MISC",
"url": "http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html"
},
{
"name": "ADV-2007-4272",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2007/4272"
},
{
"name": "http://larholm.com/2007/07/10/internet-explorer-0day-exploit/",
"refsource": "MISC",
"url": "http://larholm.com/2007/07/10/internet-explorer-0day-exploit/"
},
{
"name": "SUSE-SA:2007:049",
"refsource": "SUSE",
"url": "http://www.novell.com/linux/security/advisories/2007_49_mozilla.html"
},
{
"name": "SSRT061181",
"refsource": "HP",
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
},
{
"name": "ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt",
"refsource": "CONFIRM",
"url": "ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt"
},
{
"name": "20070710 Internet Explorer 0day exploit",
"refsource": "FULLDISC",
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html"
},
{
"name": "http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html",
"refsource": "CONFIRM",
"url": "http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html"
},
{
"name": "26258",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26258"
},
{
"name": "28363",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/28363"
},
{
"name": "20070710 Internet Explorer 0day exploit",
"refsource": "BUGTRAQ",
"url": "http://www.securityfocus.com/archive/1/473276/100/0/threaded"
},
{
"name": "26271",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26271"
},
{
"name": "26204",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26204"
},
{
"name": "26572",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26572"
},
{
"name": "26096",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/26096"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:6:sp1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:7.0:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:7.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:internet_explorer:7.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2007-3670"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE\u0027s opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a \"defense in depth\" fix that will \"prevent IE from sending Firefox malicious data.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://larholm.com/2007/07/10/internet-explorer-0day-exploit/",
"refsource": "MISC",
"tags": [],
"url": "http://larholm.com/2007/07/10/internet-explorer-0day-exploit/"
},
{
"name": "http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html",
"refsource": "MISC",
"tags": [],
"url": "http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html"
},
{
"name": "24837",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/24837"
},
{
"name": "25984",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/25984"
},
{
"name": "20070719 Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability",
"refsource": "IDEFENSE",
"tags": [],
"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565"
},
{
"name": "http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/",
"refsource": "MISC",
"tags": [],
"url": "http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/"
},
{
"name": "http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx",
"refsource": "MISC",
"tags": [],
"url": "http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx"
},
{
"name": "http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/",
"refsource": "MISC",
"tags": [],
"url": "http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/"
},
{
"name": "http://www.virusbtn.com/news/virus_news/2007/07_11.xml",
"refsource": "MISC",
"tags": [],
"url": "http://www.virusbtn.com/news/virus_news/2007/07_11.xml"
},
{
"name": "http://www.mozilla.org/security/announce/2007/mfsa2007-23.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.mozilla.org/security/announce/2007/mfsa2007-23.html"
},
{
"name": "ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt",
"refsource": "CONFIRM",
"tags": [],
"url": "ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt"
},
{
"name": "http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html"
},
{
"name": "MDKSA-2007:152",
"refsource": "MANDRIVA",
"tags": [],
"url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:152"
},
{
"name": "SUSE-SA:2007:049",
"refsource": "SUSE",
"tags": [],
"url": "http://www.novell.com/linux/security/advisories/2007_49_mozilla.html"
},
{
"name": "USN-503-1",
"refsource": "UBUNTU",
"tags": [],
"url": "http://www.ubuntu.com/usn/usn-503-1"
},
{
"name": "TA07-199A",
"refsource": "CERT",
"tags": [
"US Government Resource"
],
"url": "http://www.us-cert.gov/cas/techalerts/TA07-199A.html"
},
{
"name": "VU#358017",
"refsource": "CERT-VN",
"tags": [
"US Government Resource"
],
"url": "http://www.kb.cert.org/vuls/id/358017"
},
{
"name": "1018351",
"refsource": "SECTRACK",
"tags": [],
"url": "http://www.securitytracker.com/id?1018351"
},
{
"name": "1018360",
"refsource": "SECTRACK",
"tags": [],
"url": "http://www.securitytracker.com/id?1018360"
},
{
"name": "26096",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26096"
},
{
"name": "26149",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26149"
},
{
"name": "26216",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26216"
},
{
"name": "26204",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26204"
},
{
"name": "26271",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26271"
},
{
"name": "26258",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26258"
},
{
"name": "26572",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/26572"
},
{
"name": "http://www.mozilla.org/security/announce/2007/mfsa2007-40.html",
"refsource": "CONFIRM",
"tags": [],
"url": "http://www.mozilla.org/security/announce/2007/mfsa2007-40.html"
},
{
"name": "28179",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/28179"
},
{
"name": "28363",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/28363"
},
{
"name": "ADV-2007-4272",
"refsource": "VUPEN",
"tags": [],
"url": "http://www.vupen.com/english/advisories/2007/4272"
},
{
"name": "ADV-2007-2473",
"refsource": "VUPEN",
"tags": [],
"url": "http://www.vupen.com/english/advisories/2007/2473"
},
{
"name": "ADV-2007-2565",
"refsource": "VUPEN",
"tags": [],
"url": "http://www.vupen.com/english/advisories/2007/2565"
},
{
"name": "ADV-2008-0082",
"refsource": "VUPEN",
"tags": [],
"url": "http://www.vupen.com/english/advisories/2008/0082"
},
{
"name": "38017",
"refsource": "OSVDB",
"tags": [],
"url": "http://osvdb.org/38017"
},
{
"name": "20070710 Internet Explorer 0day exploit",
"refsource": "FULLDISC",
"tags": [],
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html"
},
{
"name": "HPSBUX02156",
"refsource": "HP",
"tags": [],
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579"
},
{
"name": "HPSBUX02153",
"refsource": "HP",
"tags": [],
"url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
},
{
"name": "ie-firefoxurl-command-execution(35346)",
"refsource": "XF",
"tags": [],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35346"
},
{
"name": "20070710 Internet Explorer 0day exploit",
"refsource": "BUGTRAQ",
"tags": [],
"url": "http://www.securityfocus.com/archive/1/473276/100/0/threaded"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2021-07-23T15:06Z",
"publishedDate": "2007-07-10T19:30Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…