CVE-2007-3670 (GCVE-0-2007-3670)

Vulnerability from cvelistv5 – Published: 2007-07-10 23:00 – Updated: 2024-08-07 14:28
VLAI?
Summary
Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."
Severity ?
No CVSS data available.
CWE
  • n/a
Assigner
References
http://www.vupen.com/english/advisories/2007/2473 vdb-entryx_refsource_VUPEN
http://www.ubuntu.com/usn/usn-503-1 vendor-advisoryx_refsource_UBUNTU
http://www.securitytracker.com/id?1018360 vdb-entryx_refsource_SECTRACK
http://www.securitytracker.com/id?1018351 vdb-entryx_refsource_SECTRACK
http://h20000.www2.hp.com/bizsupport/TechSupport/… vendor-advisoryx_refsource_HP
http://blog.mozilla.com/security/2007/07/10/secur… x_refsource_MISC
http://h20000.www2.hp.com/bizsupport/TechSupport/… vendor-advisoryx_refsource_HP
http://www.mandriva.com/security/advisories?name=… vendor-advisoryx_refsource_MANDRIVA
http://secunia.com/advisories/25984 third-party-advisoryx_refsource_SECUNIA
https://exchange.xforce.ibmcloud.com/vulnerabilit… vdb-entryx_refsource_XF
http://www.us-cert.gov/cas/techalerts/TA07-199A.html third-party-advisoryx_refsource_CERT
http://secunia.com/advisories/28179 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/bid/24837 vdb-entryx_refsource_BID
http://msinfluentials.com/blogs/jesper/archive/20… x_refsource_MISC
http://secunia.com/advisories/26216 third-party-advisoryx_refsource_SECUNIA
http://h20000.www2.hp.com/bizsupport/TechSupport/… vendor-advisoryx_refsource_HP
http://www.virusbtn.com/news/virus_news/2007/07_11.xml x_refsource_MISC
http://www.theregister.co.uk/2007/07/11/ie_firefo… x_refsource_MISC
http://labs.idefense.com/intelligence/vulnerabili… third-party-advisoryx_refsource_IDEFENSE
http://www.vupen.com/english/advisories/2007/2565 vdb-entryx_refsource_VUPEN
http://www.mozilla.org/security/announce/2007/mfs… x_refsource_CONFIRM
http://secunia.com/advisories/26149 third-party-advisoryx_refsource_SECUNIA
http://www.vupen.com/english/advisories/2008/0082 vdb-entryx_refsource_VUPEN
http://osvdb.org/38017 vdb-entryx_refsource_OSVDB
http://www.mozilla.org/security/announce/2007/mfs… x_refsource_CONFIRM
http://www.kb.cert.org/vuls/id/358017 third-party-advisoryx_refsource_CERT-VN
http://www.xs-sniper.com/sniperscope/IE-Pwns-Fire… x_refsource_MISC
http://www.vupen.com/english/advisories/2007/4272 vdb-entryx_refsource_VUPEN
http://larholm.com/2007/07/10/internet-explorer-0… x_refsource_MISC
http://www.novell.com/linux/security/advisories/2… vendor-advisoryx_refsource_SUSE
http://h20000.www2.hp.com/bizsupport/TechSupport/… vendor-advisoryx_refsource_HP
ftp://ftp.slackware.com/pub/slackware/slackware-1… x_refsource_CONFIRM
http://archives.neohapsis.com/archives/fulldisclo… mailing-listx_refsource_FULLDISC
http://support.novell.com/techcenter/psdb/07d098f… x_refsource_CONFIRM
http://secunia.com/advisories/26258 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/28363 third-party-advisoryx_refsource_SECUNIA
http://www.securityfocus.com/archive/1/473276/100… mailing-listx_refsource_BUGTRAQ
http://secunia.com/advisories/26271 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/26204 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/26572 third-party-advisoryx_refsource_SECUNIA
http://secunia.com/advisories/26096 third-party-advisoryx_refsource_SECUNIA
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T14:28:51.407Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "ADV-2007-2473",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2473"
          },
          {
            "name": "USN-503-1",
            "tags": [
              "vendor-advisory",
              "x_refsource_UBUNTU",
              "x_transferred"
            ],
            "url": "http://www.ubuntu.com/usn/usn-503-1"
          },
          {
            "name": "1018360",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018360"
          },
          {
            "name": "1018351",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id?1018351"
          },
          {
            "name": "HPSBUX02156",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/"
          },
          {
            "name": "HPSBUX02153",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
          },
          {
            "name": "MDKSA-2007:152",
            "tags": [
              "vendor-advisory",
              "x_refsource_MANDRIVA",
              "x_transferred"
            ],
            "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:152"
          },
          {
            "name": "25984",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/25984"
          },
          {
            "name": "ie-firefoxurl-command-execution(35346)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35346"
          },
          {
            "name": "TA07-199A",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT",
              "x_transferred"
            ],
            "url": "http://www.us-cert.gov/cas/techalerts/TA07-199A.html"
          },
          {
            "name": "28179",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28179"
          },
          {
            "name": "24837",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/24837"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx"
          },
          {
            "name": "26216",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26216"
          },
          {
            "name": "SSRT061236",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.virusbtn.com/news/virus_news/2007/07_11.xml"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/"
          },
          {
            "name": "20070719 Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability",
            "tags": [
              "third-party-advisory",
              "x_refsource_IDEFENSE",
              "x_transferred"
            ],
            "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565"
          },
          {
            "name": "ADV-2007-2565",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/2565"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2007/mfsa2007-40.html"
          },
          {
            "name": "26149",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26149"
          },
          {
            "name": "ADV-2008-0082",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/0082"
          },
          {
            "name": "38017",
            "tags": [
              "vdb-entry",
              "x_refsource_OSVDB",
              "x_transferred"
            ],
            "url": "http://osvdb.org/38017"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.mozilla.org/security/announce/2007/mfsa2007-23.html"
          },
          {
            "name": "VU#358017",
            "tags": [
              "third-party-advisory",
              "x_refsource_CERT-VN",
              "x_transferred"
            ],
            "url": "http://www.kb.cert.org/vuls/id/358017"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html"
          },
          {
            "name": "ADV-2007-4272",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2007/4272"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://larholm.com/2007/07/10/internet-explorer-0day-exploit/"
          },
          {
            "name": "SUSE-SA:2007:049",
            "tags": [
              "vendor-advisory",
              "x_refsource_SUSE",
              "x_transferred"
            ],
            "url": "http://www.novell.com/linux/security/advisories/2007_49_mozilla.html"
          },
          {
            "name": "SSRT061181",
            "tags": [
              "vendor-advisory",
              "x_refsource_HP",
              "x_transferred"
            ],
            "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt"
          },
          {
            "name": "20070710 Internet Explorer 0day exploit",
            "tags": [
              "mailing-list",
              "x_refsource_FULLDISC",
              "x_transferred"
            ],
            "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html"
          },
          {
            "name": "26258",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26258"
          },
          {
            "name": "28363",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/28363"
          },
          {
            "name": "20070710 Internet Explorer 0day exploit",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/473276/100/0/threaded"
          },
          {
            "name": "26271",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26271"
          },
          {
            "name": "26204",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26204"
          },
          {
            "name": "26572",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26572"
          },
          {
            "name": "26096",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/26096"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2007-07-10T04:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe.  NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE\u0027s opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a \"defense in depth\" fix that will \"prevent IE from sending Firefox malicious data.\""
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-16T00:57:01.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "ADV-2007-2473",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2473"
        },
        {
          "name": "USN-503-1",
          "tags": [
            "vendor-advisory",
            "x_refsource_UBUNTU"
          ],
          "url": "http://www.ubuntu.com/usn/usn-503-1"
        },
        {
          "name": "1018360",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018360"
        },
        {
          "name": "1018351",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id?1018351"
        },
        {
          "name": "HPSBUX02156",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/"
        },
        {
          "name": "HPSBUX02153",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
        },
        {
          "name": "MDKSA-2007:152",
          "tags": [
            "vendor-advisory",
            "x_refsource_MANDRIVA"
          ],
          "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:152"
        },
        {
          "name": "25984",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/25984"
        },
        {
          "name": "ie-firefoxurl-command-execution(35346)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35346"
        },
        {
          "name": "TA07-199A",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT"
          ],
          "url": "http://www.us-cert.gov/cas/techalerts/TA07-199A.html"
        },
        {
          "name": "28179",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28179"
        },
        {
          "name": "24837",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/24837"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx"
        },
        {
          "name": "26216",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26216"
        },
        {
          "name": "SSRT061236",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.virusbtn.com/news/virus_news/2007/07_11.xml"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/"
        },
        {
          "name": "20070719 Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability",
          "tags": [
            "third-party-advisory",
            "x_refsource_IDEFENSE"
          ],
          "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565"
        },
        {
          "name": "ADV-2007-2565",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/2565"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2007/mfsa2007-40.html"
        },
        {
          "name": "26149",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26149"
        },
        {
          "name": "ADV-2008-0082",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/0082"
        },
        {
          "name": "38017",
          "tags": [
            "vdb-entry",
            "x_refsource_OSVDB"
          ],
          "url": "http://osvdb.org/38017"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.mozilla.org/security/announce/2007/mfsa2007-23.html"
        },
        {
          "name": "VU#358017",
          "tags": [
            "third-party-advisory",
            "x_refsource_CERT-VN"
          ],
          "url": "http://www.kb.cert.org/vuls/id/358017"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html"
        },
        {
          "name": "ADV-2007-4272",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2007/4272"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://larholm.com/2007/07/10/internet-explorer-0day-exploit/"
        },
        {
          "name": "SUSE-SA:2007:049",
          "tags": [
            "vendor-advisory",
            "x_refsource_SUSE"
          ],
          "url": "http://www.novell.com/linux/security/advisories/2007_49_mozilla.html"
        },
        {
          "name": "SSRT061181",
          "tags": [
            "vendor-advisory",
            "x_refsource_HP"
          ],
          "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt"
        },
        {
          "name": "20070710 Internet Explorer 0day exploit",
          "tags": [
            "mailing-list",
            "x_refsource_FULLDISC"
          ],
          "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html"
        },
        {
          "name": "26258",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26258"
        },
        {
          "name": "28363",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/28363"
        },
        {
          "name": "20070710 Internet Explorer 0day exploit",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/473276/100/0/threaded"
        },
        {
          "name": "26271",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26271"
        },
        {
          "name": "26204",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26204"
        },
        {
          "name": "26572",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26572"
        },
        {
          "name": "26096",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/26096"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2007-3670",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe.  NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE\u0027s opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a \"defense in depth\" fix that will \"prevent IE from sending Firefox malicious data.\""
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "ADV-2007-2473",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2473"
            },
            {
              "name": "USN-503-1",
              "refsource": "UBUNTU",
              "url": "http://www.ubuntu.com/usn/usn-503-1"
            },
            {
              "name": "1018360",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1018360"
            },
            {
              "name": "1018351",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id?1018351"
            },
            {
              "name": "HPSBUX02156",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579"
            },
            {
              "name": "http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/",
              "refsource": "MISC",
              "url": "http://blog.mozilla.com/security/2007/07/10/security-issue-in-url-protocol-handling-on-windows/"
            },
            {
              "name": "HPSBUX02153",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
            },
            {
              "name": "MDKSA-2007:152",
              "refsource": "MANDRIVA",
              "url": "http://www.mandriva.com/security/advisories?name=MDKSA-2007:152"
            },
            {
              "name": "25984",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/25984"
            },
            {
              "name": "ie-firefoxurl-command-execution(35346)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/35346"
            },
            {
              "name": "TA07-199A",
              "refsource": "CERT",
              "url": "http://www.us-cert.gov/cas/techalerts/TA07-199A.html"
            },
            {
              "name": "28179",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/28179"
            },
            {
              "name": "24837",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/24837"
            },
            {
              "name": "http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx",
              "refsource": "MISC",
              "url": "http://msinfluentials.com/blogs/jesper/archive/2007/07/10/blocking-the-firefox-gt-ie-0-day.aspx"
            },
            {
              "name": "26216",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26216"
            },
            {
              "name": "SSRT061236",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00774579"
            },
            {
              "name": "http://www.virusbtn.com/news/virus_news/2007/07_11.xml",
              "refsource": "MISC",
              "url": "http://www.virusbtn.com/news/virus_news/2007/07_11.xml"
            },
            {
              "name": "http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/",
              "refsource": "MISC",
              "url": "http://www.theregister.co.uk/2007/07/11/ie_firefox_vuln/"
            },
            {
              "name": "20070719 Multiple Vendor Multiple Product URI Handler Input Validation Vulnerability",
              "refsource": "IDEFENSE",
              "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=565"
            },
            {
              "name": "ADV-2007-2565",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/2565"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2007/mfsa2007-40.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2007/mfsa2007-40.html"
            },
            {
              "name": "26149",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26149"
            },
            {
              "name": "ADV-2008-0082",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/0082"
            },
            {
              "name": "38017",
              "refsource": "OSVDB",
              "url": "http://osvdb.org/38017"
            },
            {
              "name": "http://www.mozilla.org/security/announce/2007/mfsa2007-23.html",
              "refsource": "CONFIRM",
              "url": "http://www.mozilla.org/security/announce/2007/mfsa2007-23.html"
            },
            {
              "name": "VU#358017",
              "refsource": "CERT-VN",
              "url": "http://www.kb.cert.org/vuls/id/358017"
            },
            {
              "name": "http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html",
              "refsource": "MISC",
              "url": "http://www.xs-sniper.com/sniperscope/IE-Pwns-Firefox.html"
            },
            {
              "name": "ADV-2007-4272",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2007/4272"
            },
            {
              "name": "http://larholm.com/2007/07/10/internet-explorer-0day-exploit/",
              "refsource": "MISC",
              "url": "http://larholm.com/2007/07/10/internet-explorer-0day-exploit/"
            },
            {
              "name": "SUSE-SA:2007:049",
              "refsource": "SUSE",
              "url": "http://www.novell.com/linux/security/advisories/2007_49_mozilla.html"
            },
            {
              "name": "SSRT061181",
              "refsource": "HP",
              "url": "http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742"
            },
            {
              "name": "ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt",
              "refsource": "CONFIRM",
              "url": "ftp://ftp.slackware.com/pub/slackware/slackware-12.0/ChangeLog.txt"
            },
            {
              "name": "20070710 Internet Explorer 0day exploit",
              "refsource": "FULLDISC",
              "url": "http://archives.neohapsis.com/archives/fulldisclosure/2007-07/0160.html"
            },
            {
              "name": "http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html",
              "refsource": "CONFIRM",
              "url": "http://support.novell.com/techcenter/psdb/07d098f99c9fe6956523beae37f32fda.html"
            },
            {
              "name": "26258",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26258"
            },
            {
              "name": "28363",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/28363"
            },
            {
              "name": "20070710 Internet Explorer 0day exploit",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/473276/100/0/threaded"
            },
            {
              "name": "26271",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26271"
            },
            {
              "name": "26204",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26204"
            },
            {
              "name": "26572",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26572"
            },
            {
              "name": "26096",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/26096"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2007-3670",
    "datePublished": "2007-07-10T23:00:00.000Z",
    "dateReserved": "2007-07-10T04:00:00.000Z",
    "dateUpdated": "2024-08-07T14:28:51.407Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.