PC Takeover Flaw in Mozilla, Netscape Users At Risk of Remote Code Execution Ryan Naraine
Security researchers have discovered a "highly critical" security hole in the Netscape and Mozilla browsers that puts users at risk of computer takeover.
According to an advisory from iDefense, the vulnerability is caused by an integer overflow within the SOAPParameter object's constructor.
SOAPParameter objects handle support for SOAP (define), the XML-based messaging protocol that defines rules for structuring messages. "Successful exploitation allows the remote attacker to execute arbitrary code in the context of the user running the browser," iDefense warned.
The company warned that the flaw can be exploited via specially created Web pages containing malicious Javascript. Browser products affected include Mozilla 1.6 and versions 7.0 and 7.1 of Netscape.
The open-source Mozilla Foundation has released an update (v1.7.1) to fix the flaw.
"Netscape have not released any information indicating they are intending to release future versions of the Netscape browser, and no longer have any developers working on this project," iDefense said.
The research firm recommends that users disable Javascript in the browsers as a workaround.
