Arbitrary Code Execution Vulnerability in Firefox DLL library Loading

Release date:
Updated on:

Affected Systems:
Mozilla Firefox 3.6.x
Mozilla Firefox 3.5.x
Mozilla Thunderbird 3.1.x
Mozilla Thunderbird 3.0.x
Mozilla SeaMonkey <2.0.9
Unaffected system:
Mozilla Firefox 3.6.11
Mozilla Firefox 3.5.14
Mozilla Thunderbird 3.1.5
Mozilla Thunderbird 3.0.9
Mozilla SeaMonkey 2.0.9
Description:
--------------------------------------------------------------------------------
Bugtraq id: 44250
CVE (CAN) ID: CVE-2010-3181

Firefox is a very popular open-source WEB browser.

The function used to load the external function library on the Windows platform in Firefox uses the relative path to the application loaded by the DLL, therefore, if attackers can place executable files with the same name in the current working directory or other locations where Windows searches for executable files, they will execute the placed malicious programs.

<* Source: Ehsan Akhgari

Link: http://secunia.com/advisories/41244/
Http://www.mozilla.org/security/announce/2010/mfsa2010-71.html
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Mozilla
-------
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://www.mozilla.org/