The animated cursor vulnerability in Windows could also affect those using Firefox on Windows machines, according to one of the security researchers who discovered the flaw.
Alexander Sotirov, a researcher for security company Determina, said in an email to security flaw mailing list Full Disclosure that while there was no vulnerability in the Firefox source code itself, a hacker can exploit the Windows flaw through its application programming interface (API) for Firefox. "Firefox uses a Windows API function which uses the vulnerable code in USER32.DLL, so the .ani vulnerability can be exploited through Firefox," Sotirov wrote.
Read this
Talkback comment
"Anyone still using MSIE is flirting with danger. This has been proven to be the most vulnerable, insecure, browser on planet earth."
The flaw — also known as the .ani stack overflow vulnerability — was made public by Microsoft on Thursday last week. By Friday there were reports of widespread exploits, and Microsoft issued a patch — detailed in the MS07-017 security bulletin — a week early, out of its monthly cycle of patching on a Tuesday. The vulnerability affects both Windows XP Service Pack 2 and Vista.
Sotirov said that installing the MS07-017 patch would protect both Internet Explorer and Firefox users against the .ani stack overflow vulnerability, and that he would delay releasing exploit code that could be used against people using Firefox on Windows machines until users had been given a chance to install the Microsoft patch.
Sotirov was adamant that the problem did not lie with the Firefox source code itself. "There is no vulnerability for the Firefox developers to patch. I recommend that they limit their use of the Windows API to avoid being affected by the next Windows vulnerability, but this is application hardening, not a vulnerability fix."
Mozilla Foundation, which heads the development of Firefox, could offer no comment at the time of writing.
