Mozilla is working to fix a flaw in the JAR URL handler that could leave Firefox users open to cross-site scripting attacks that are impossible for anti-virus programs to prevent.
It turns out that the vulnerability, first reported in February by Jesse Ruderman, is far more serious than first realized. In fact, it turns out to be endemic to "almost everything that smells like Web 2.0," security researcher Petko D. Petkov, also known as "pdp" of GNUCitizen, wrote in a Nov. 7 posting.
At risk are any applications that allow the upload of JAR/Zip files, such as Web mail clients, collaboration systems or document sharing systems, Petkov wrote. A JAR (Java Archive) file, used for aggregating multiple files into one, is generally used to distribute Java classes and associated metadata, but the protocol is not restricted to use with Java archives and will open any .zip format file.
Document formats, such as the ODT (OpenDocument Text) file format in OpenOffice and the Microsoft Office 2007 Open Document Format, are both based on Zip and as such are particularly vulnerable, Petkov said.
To continue reading this article by Lisa Vaas at eWEEK.com, go here.
