Download Firefox

Firefox is no longer supported on Windows 8.1 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox is no longer supported on macOS 10.14 and below.

Please download Firefox ESR (Extended Support Release) to use Firefox.

Firefox Privacy Notice

Mozilla Foundation Security Advisory 2005-34

PLUGINSPAGE privileged javascript execution

Announced
April 15, 2005
Reporter
Omar Khan
Impact
High
Products
Firefox
Fixed in
  • Firefox 1.0.3

Description

When a webpage requires a plugin that is not installed the user can click to launch the Plugin Finder Service (PFS) to find an appropriate plugin. If the service does not have an appropriate plugin the EMBED tag is checked for a PLUGINSPAGE attribute, and if one is found the PFS dialog will contain a "manual install" button that will load the PLUGINSPAGE url.

Omar Khan reported that if the PLUGINSPAGE attribute contains a javascript: url then pressing the button could launch arbitrary code capable of stealing local data or installing malicious code.

Doron Rosenberg reported a variant that injects script by appending it to a malformed URL of any protocol.

The plugin finder in the Mozilla Suite is not affected by this issue.

Workaround

Do not press the "Manual Install" button on the Firefox plugin finder. Use a search engine to find an appropriate plugin for the content.

References