vendor:
Firefox
by:
Abysssec
9.3
CVSS
HIGH
Code Execution Vulnerability in Mozilla Firefox <= 3.6.16
N/A
CWE
Product Name: Firefox
Affected Version From: Mozilla Firefox <= 3.6.16
Affected Version To: N/A
Patch Exists: YES
Related CWE: N/A
CPE: N/A
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: Windows XP and Windows 7
2011
Abysssec Public Exploit
This module exploits a code execution vulnerability in Mozilla Firefox <= 3.6.16 caused by nsTreeSelection element. The specific flaw exists within the way Firefox handles user defined functions of a nsTreeSelection element. When executing the function invalidateSelection it is possible to free the nsTreeSelection object that the function operates on. Any further operations on the freed object can result in remote code execution. This exploit module is only tested on win7 and used a Another JAVA ROP to defeat DEP/ASLR (due to there is no more non-aslr module in Firefox) and in my tests works reliably on Windows7. There is two version of this exploit XP and 7 and both use different method that used in MSF Exploit bounty !
Mitigation:
Upgrade to the latest version of Mozilla Firefox
