SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Browser)  >   Mozilla Browser Vendors:   Mozilla.org
Mozilla Buffer Overflow in Processing NNTP URLs Lets Remote Users Execute Arbitrary Code
SecurityTracker Alert ID:  1012726
SecurityTracker URL:  http://securitytracker.com/id/1012726
CVE Reference:   CVE-2004-1316   (Links to External Site)
Updated:  Jan 4 2005
Original Entry Date:  Dec 30 2004
Impact:   Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  
Version(s): 1.7.3
Description:   A heap overflow vulnerability was reported in Mozilla in the processing of NNTP URLs. A remote user can execute arbitrary code on the target system.

Maurycy Prodeus of iSEC Security Research reported that a remote user can create a specially crafted 'news://' URL that, when loaded by the target user, will trigger a buffer overflow and execute arbitrary code on the target user's system. The code will run with the privileges of the target user.

The flaw resides in the *MSG_UnEscapeSearchUrl() function in 'nsNNTPProtocol.cpp'.

The original advisory is available at:

http://isec.pl/vulnerabilities/isec-0020-mozilla.txt

Impact:   A remote user can create a URL that, when loaded by the target user, will execute arbitrary code on the target user's system with the privileges of the target user.
Solution:   The vendor has issued a fixed version (1.7.5), available at:

http://www.mozilla.org/products/mozilla1.x/

Vendor URL:  www.mozilla.org/ (Links to External Site)
Cause:   Boundary error
Underlying OS:  Linux (Any), UNIX (Any), Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Mar 24 2005 (Red Hat Issues Fix) Mozilla Buffer Overflow in Processing NNTP URLs Lets Remote Users Execute Arbitrary Code
Red Hat has released a fix.
Apr 20 2005 (HP Issues Fix for HP/UX) Mozilla Buffer Overflow in Processing NNTP URLs Lets Remote Users Execute Arbitrary Code
HP has issued a fix.



 Source Message Contents

Subject:  Heap overflow in Mozilla Browser <= 1.7.3 NNTP code.


  This message is in MIME format.  The first part should be readable text,
  while the remaining parts are likely unreadable without MIME-aware tools.
  Send mail to mime@docserver.cac.washington.edu for more info.

--1858155129-1232383134-1104355461=:19156
Content-Type: TEXT/PLAIN; CHARSET=US-ASCII
Content-ID: <Pine.LNX.4.44.0412292228442.19239@isec.pl>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Synopsis:  Heap overflow in Mozilla Browser <= 1.7.3 NNTP code.
Product:   Mozilla Browser
Version:   <= 1.7.3
Vendor:    http://www.mozilla.org/
URL:       http://isec.pl/vulnerabilities/isec-0020-mozilla.txt
CVE:       not assigned
Author:    Maurycy Prodeus <z33d@isec.pl>
Date:      Dec 29, 2004



Issue:
======

A critical security vulnerability has been found in Mozilla Project code
handling NNTP protocol.


Details:
========

Mozilla browser supports NNTP urls. Remote side is able to trigger  news://
connection to any server. I found a flaw in NNTP handling code which may
cause heap overflow and allow remote attacker to execute arbitrary code on
client machine.

Bugus function from nsNNTPProtocol.cpp:

char *MSG_UnEscapeSearchUrl (const char *commandSpecificData)
329 {
330     char *result = (char*) PR_Malloc (PL_strlen(commandSpecificData) + 1);
331     if (result)
332     {
333         char *resultPtr = result;
334         while (1)
335         {
336             char ch = *commandSpecificData++;
337             if (!ch)
338                 break;
339             if (ch == '\\')
340             {
341                 char scratchBuf[3];
342                 scratchBuf[0] = (char) *commandSpecificData++;
343                 scratchBuf[1] = (char) *commandSpecificData++;
344                 scratchBuf[2] = '\0';
345                 int accum = 0;
346                 PR_sscanf(scratchBuf, "%X", &accum);
347                 *resultPtr++ = (char) accum;
348             }
349             else
350                 *resultPtr++ = ch;
351         }
352         *resultPtr = '\0';
353     }
354     return result;
355 }

When commandSpecificData points to last (next is NULL) character which
is '\\' copying loop may omit termination of source char array and overflow
result buffer.


Affected Versions
=================

Mozilla Browser <= 1.7.3 with mozilla-mail

Solution
=========

This bug is fixed in Mozilla 1.7.5. (Bug 264388)
Mozilla developer Dan Veditz claims that it cannot be exploitable:
"A '\' on the end will certainly trash memory, but at that point you're no
longer reading attacker-supplied data;".

On my RedHat 9.0 with Mozilla 1.7.3 attached proof of concept code
overflows the buffer using attacker-supplied data. I decided to make this
bug public because Mozilla Team hasn't warned users.


Exploitation
============

I have attached proof of concept HTML file which causes heap corruption
and crashes Mozilla 1.7.3 browser (with mozilla-mail). News server must be
existing and available.


- --
Maurycy Prodeus
iSEC Security Research
http://isec.pl/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)

iD8DBQFB0yG+C+8U3Z5wpu4RAp8qAKCitfHBZ3P83KX9noILeElskR7TGQCeLhGt
91jIwGcqBiuRNNFc3xvcuog=
=51XF
-----END PGP SIGNATURE-----


--1858155129-1232383134-1104355461=:19156
Content-Type: TEXT/plain; name="nntp_crash.txt"
Content-Transfer-Encoding: BASE64
Content-ID: <Pine.LNX.4.44.0412292229270.19239@isec.pl>
Content-Description: PoC
Content-Disposition: attachment; filename="nntp_crash.txt"

PGh0bWw+DQo8c2NyaXB0Pg0KaSA9ICJuZXdzOi8vbmV3cy5pbmRpdmlkdWFs
Lm5ldC9BQUFBQUFBQUFBQUFBQT8iOw0KZm9yKGwgPSAwOyBsIDwgMTYzNzY7
IGwrKykNCiAgaT1pKyJBIjsNCmk9aSsiLz9wcm9maWxlLyI7DQpmb3IobCA9
IDA7IGwgPCAxNjM4NDsgbCsrKQ0KICBpPWkrIkEiOw0KaT1pKyJcXCI7DQp3
aW5kb3cub3BlbihpKTsNCjwvc2NyaXB0Pg0KPC9odG1sPg0K
--1858155129-1232383134-1104355461=:19156--

 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2021, SecurityGlobal.net LLC