Internet Explorer Linked to Firefox Security Hole

In an interesting twist on browser-based security issues, security researchers said they have found a flaw in which Microsoft's (Nasdaq: MSFT) Internet Explorer (IE) can cause Mozilla's Firefox to execute remote malicious code.

Security firm Secunia released an advisory Tuesday, ranking the flaw as highly critical. The vulnerability is confirmed on Firefox 2.0.0.4 on a fully patched version of Windows XP SP2.

How It Works

Basically, the end user must use IE to navigate to a malicious Web page and click on a link. The problem only occurs when the user also has Firefox installed -- it does nothing if Firefox isn't installed.

The link, according to Mozilla, can cause IE to invoke another Windows program -- in this case, Firefox -- via the command line and pass that program the URL from the malicious Web page. This can cause data to be passed from the malicious Web page to the second Windows program, which could allow remote code execution in Firefox, the browser's maker notes on its Mozilla Security Blog.

It may be possible to use the same method in IE to invoke action with other Windows programs, but none have yet been reported.

No Immediate Fix

Mozilla and Microsoft don't have an immediate fix, but Mozilla said it will patch the problem on its end in the upcoming 2.0.0.5 release, which will prevent IE from sending Firefox malicious data. Of course, as Internet Explorer is a Microsoft program, Mozilla won't be able to fix the underlying Windows IE catalyst.

"It is important to note that if you are using Firefox to browse the Web, you are not vulnerable to this attack," Mozilla notes on its security blog, adding that the company hasn't seen any evidence of hackers actually exploiting this issue.

Browsing with Firefox solves this particular problem, but Secunia recommends a solution of simply not browsing untrusted sites with IE.

Opening the Door to Malicious Code

"The underlying issue is the number of Web sites that are hosting malicious code," Ronald O'Brien, a senior security analyst for Sophos, told LinuxInsider. "We know there are tens of thousands of Web sites that have been created that lack basic security aspects to them, and as such are readily hacked for the purpose of inserting malicous code onto them."

The likelihood that a computer can become infected sufficiently that it can be controlled remotely has increased dramatically, he noted. What O'Brien finds surprising -- and perhaps this is why there isn't a known exploit out and about in the wild yet -- is that simply getting a user to browse and click on a malicious link is usually enough to generate positive (malicious) results.