Intrusion PreventionMS.IE.FirefoxURL.Protocol.Handler.Command.Injection
Description
An argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross browser scripting attacks and execute arbitrary commands. This can be accomplished via shell metacharacters in a FirefoxURL or FirefoxHTML URI, which is inserted into the command line that is created when invoking firefox.exe.
Affected Products
Microsoft Internet Explorer 6.0 SP1
Microsoft Internet Explorer 6.0
Microsoft Internet Explorer 7.0 beta3
Microsoft Internet Explorer 7.0 beta2
Microsoft Internet Explorer 7.0 beta1
Microsoft Internet Explorer 7.0
Impact
System compromise.
Recommended Actions
Do not browse untrusted sites.
Disable the "Firefox URL" URI handler.
Telemetry
Coverage
| IPS (Regular DB) | |
| IPS (Extended DB) |
| ID | 14774 |
| Created | Jul 11, 2007 |
| Updated | Mar 26, 2022 |
| Risk |
|
| CVE ID | CVE-2007-3670 |
| Exploit Prediction Score | 22.82% |
| Default Action | drop |
| Active | |
| Affected OS | Windows |
| Affected App | IE |