April 4th, 2007
Mozilla to ship Firefox 'workaround' for .ANI exploit
Mozilla is considering a "workaround" to block the attack vector that puts Firefox users at risk of attacks exploiting the Windows animated cursor (.ani) vulnerability.
Because Firefox uses the Windows API function that triggers the vulnerable code, the .ani vulnerability can be exploited through Firefox. (See this Flash demo by Alexander Sotirov, the researcher who discovered the vulnerability).
However, there is no vulnerability for the Firefox developers to patch (once the MS07-017 patch is applied, the user is protected). Still, Mozilla's VP of engineering Mike Schroepfer said the company is mulling a workaround to reduce the attack surface for Windows users.
"The ANI vulnerability is caused by a Windows error…it can be exploited through both Firefox and Internet Explorer," Schroepfer stressed.
The workaround, which will amount to application hardening, will be fitted into a future Firefox security update.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
And that's the rest of the story.
