|
|
|
|
| |
| A buffer overflow vulnerability exists within Gecko based web browsers that allows for a remote attacker to execute arbitrary code on a remote host. |
| |
Credit:
The information has been provided by Juha-Matti Laurio,
Przemyslaw Frasunek
The vendor advisory can be found at: https://addons.mozilla.org/messages/307259.html
The vendor bug report can be found at: https://bugzilla.mozilla.org/show_bug.cgi?id=307259
The CERT advisory can be found at: http://www.kb.cert.org/vuls/id/573857
The original advisory can be found at: http://security-protocols.com/advisory/sp-x17-advisory.txt
|
| |
Vulnerable Systems:
* Firefox version 1.0.6 and prior
* Firefox version 1.5 Beta 1 (Deer Park Alpha 2)
* Mozilla Suite version 1.7.11 and prior
* Netscape version 7.x
* Netscape version 8.x
The problem seems to be when a hostname which has all dashes causes the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec to return true, but is sets encHost to an empty string. Meaning, Firefox appends 0 to approxLen and then appends the long string of dashes to the buffer instead.
Debug information:
(gdb) x/i $eip
0x867926c <_ZN16nsTypedSelection5ClearEP14nsIPresContext+2236>:
call *0x4(%eax)
(gdb) info reg eax
eax 0x61616161 1633771873
Proof of Concept:
Create a link as followed:
< A HREF=https:--------------------------------------------- >
Vendor Status:
Mozilla foundeation has released a patch for Firefox: http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.6/patches/307259.xpi
Installing the Patch:
1. In the Software Installation window, click the "Install Now" button.
2. Exit and restart your Mozilla or Firefox browser.
3. To verify the fix in Firefox and the Mozilla Suite, be sure to restart the browser and then follow these steps:
4. In Firefox Click Help -> About Mozilla Firefox and verify that the user agent string contains "(noIDN)"
5. In the Mozilla Suite Click Help -> About Mozilla and verify that the user agent string contains "(noIDN)"
Manually Configuring the Browser:
To manually change the browser configuration for Firefox or the Mozilla Suite, follow these instructions:
1. Type about:config into the address field and hit Enter.
2. In the Filter toolbar, type network.enableIDN.
3. Right click on the the network.enableIDN item and select toggle to change value to false.
To verify the fix in your Firefox or Mozilla application, be sure to restart the browser and then follow these steps.
1. Type about:config into the address field and hit Enter.
2. In the Filter toolbar, type network.enableIDN.
3. Ensure that the the value for this item is set to false.
CVE Information:
CAN-2005-2871
Disclosure Timeline:
September 4, 2005 Reported
September 4, 2005 Public Released
|
|
|
|
|
|
|
|
|
|
