Mozilla Firefox - exploit.company

vendor:

Firefox

by:

Tom Ferris

7,5

CVSS

HIGH

Buffer Overflow DoS

119

CWE

Product Name: Firefox

Affected Version From: Firefox Win32 1.0.6 and prior

Affected Version To: Firefox 1.5 Beta 1 (Deer Park Alpha 2)

Patch Exists: YES

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Win32, Linux

2005

Mozilla Firefox <= 1.0.6 (Host:) Buffer Overflow DoS String

The problem seems to be when a hostname which has all dashes causes the NormalizeIDN call in nsStandardURL::BuildNormalizedSpec to return true, but is sets encHost to an empty string. Meaning, Firefox appends 0 to approxLen and then appends the long string of dashes to the buffer instead. The following HTML code below will reproduce this issue: <A HREF=https:--------------------------------------------- >

Mitigation:

Upgrade to the latest version of Firefox

Source

Exploit-DB raw data:

<!--

Mozilla Firefox <= 1.0.6 (Host:) Buffer Overflow DoS String
Formatted for your tesing /str0ke

Tom Ferris
www.security-protocols.com

Versions Affected:
Firefox Win32 1.0.6 and prior
Firefox Linux 1.0.6 and prior
Firefox 1.5 Beta 1 (Deer Park Alpha 2)

Technical Details:
The problem seems to be when a hostname which has all dashes causes the
NormalizeIDN call in nsStandardURL::BuildNormalizedSpec to return true,
but is sets encHost to an empty string.  Meaning, Firefox appends 0 to
approxLen and then appends the long string of dashes to the buffer
instead.  The following HTML code below will reproduce this issue:

String:
<A HREF=https:--------------------------------------------- >

-->

<A HREF=https: >

# milw0rm.com [2005-09-09]