|
Brought to you by:
Suppliers of:
|
|
|
| |
| Lack of proper length and value checking allow attacker to cause a buffer overflow and execute arbitrary code or cause a DoS using Gecko based web browsers. |
| |
Credit:
The information has been provided by Juha-Matti Laurio .
The original article can be found at: http://www.mozilla.org/security/announce/mfsa2005-58.html
The bug report can be found at: https://bugzilla.mozilla.org/show_bug.cgi?id=296134
|
| |
Vulnerable Systems:
* Mozilla firefox 1.0.6 and prior
* Netscape Browser version 8.0.3.3
* K-Meleon Browser version 0.9
Immune Systems:
* Mozilla firefox 1.0.7
Stack Corruption:
The problem existed in "zero-width non-joiner" sequence of unicode chars that uses Arabic shaping style. Because the code did not checked for buffer length before manipulating the given text. On a crafted content, it is possible to cause the buffer to be twice the size the actual data, and memory allocated for the buffer itself.
Proof of Concept:
< html>
< body>
& #8204;& #8204;&# 8204;& #8204;& #8204;& #8204;& #8204;& #8204;& #1742;
& #8204;& #8204;& #1740;& #8204;
< /body>
< /html>
CVE Information:
CAN-2005-2702
|
|
|
|
|
