740583 - Downloading and Executing code on local PC by simply visiting URL

Status: RESOLVED INVALID

(Firefox :: Security, defect)

Description

[serge]

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:11.0) Gecko/20100101 Firefox/11.0
Build ID: 20120312181643

Steps to reproduce:

I'm running latest version of Firefox 11.0 (About screen says "up to date")

I visited one of the following URLs. (I did not CLICK on anything on the page, I closed the Tab within 2 seconds of visiting the URL)

http://thevamsi.com/xYjS3FuU/index.html
http://pulsagram.com/cKAf4D1t/index.html
http://signworld.org/cKAf4D1t/index.html
http://figurinhasmoranguinhobaby.com.br/J7B4Jcdo/index.html
http://radioeja.com/v2NuNqQD/index.html
http://globglo.com/cKAf4D1t/index.html
http://senseoftaste.co.za/J7B4Jcdo/index.html



Actual results:

An .exe app was downloaded and executed without any warnings, notices or confirmations. I needed to use Win Patrol to find and identify it. The app was downloaded to the /Temp folder, disguised as Notepad. Afterwards it executed and tried to connect to the web, which my firewall app detected. It also installed another app and added a scheduled windows event. (Which Win Patrol helped me detect)


Expected results:

Visiting a URL via Firefox shouldn't allow a site to download and execute malicious code on my PC!

Comment 1

[Tim (fmdeveloper)]

Are all your plugins up to date? http://www.mozilla.org/en-US/plugincheck/

Comment 2

[serge]

You're right, 3 were out of date, and Flash had a red warning, maybe this was responsible?

http://imm.io/kvFE

Is there a way to have Firefox update plugins automatically, or at least alert me of new updates?

Thanks,
Serge

Comment 3

[Tim (fmdeveloper)]

Chances are that the out of date plugins are the cause.

I don't know of a way to have Firefox automatically check currently, but you could set http://www.mozilla.org/en-US/plugincheck/ as one of your startup pages, or use 3rd part software like this -> http://secunia.com/vulnerability_scanning/personal/ It has an automatic patching function

Comment 4

[serge]

Ok thanks for the info, but you should check those links with an updated Flash plugin, see if that was in fact the cause.


Test in a sandbox environment ;)

Serge