CVE-2005-2262

Vulnerability

Firefox versions 1.0.3 and 1.0.4, as well as Netscape 8.0.2, mishandle the "Set As Wallpaper" (Firefox) or "Set as Background" (Netscape) context menu option when applied to a javascript: URL instead of an image. The browser evaluates the javascript: URL in the local machine zone, enabling arbitrary code execution [3].

Exploitation

An attacker must trick the user into right-clicking on a crafted element that appears as an image but is actually a javascript: URL containing malicious code. The user must then select the "Set As Wallpaper" or "Set as Background" menu item. No authentication or network access beyond delivering the malicious content is required; successful exploitation relies on user interaction.

Impact

Successful exploitation leads to arbitrary code execution on the victim's system with the privileges of the current user. This can result in full compromise of confidentiality, integrity, and availability, including installation of malware or unauthorized data access.

Mitigation

Red Hat released RHSA-2005-586 addressing this vulnerability [3]. Users should update to Firefox 1.0.6 or a later version. For Netscape, users should apply vendor patches. No workaround is available aside from avoiding the "Set As Wallpaper" option on untrusted content.