Date: Sun, 28 Sep 2008 23:57:35 +0530
From: Aditya K Sood <0kn0ck@secniche.org.>
To: bugtraq@securityfocus.com
Subject: Advisory: Mozilla Firefox User Interface Null Pointer Dereference
Dispatcher Crash and Remote Denial of Service.
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - community1.drvgv.com
X-AntiAbuse: Original Domain - securityfocus.com
X-AntiAbuse: Originator/Caller UID/GID - [47 12] / [47 12]
X-AntiAbuse: Sender Address Domain - secniche.org
X-Virus-Scanned: antivirus-gw at tyumen.ru
Mozilla Firefox User Interface Null Pointer Dereference Dispatcher Crash
and Remote Denial of Service.
*Version Tested:*
Mozilla 3.0.3 - 1.9.0 Branch /(Specifically for Latest Version)/
*Severity:*
High
*Description:*
The mozilla firefox is vulnerable to user interface event dispatcher null
pointer dereference denial of service attacks. The dispatched event created
dynamically leads to firefox crash when it is called directly or in a
defined l
oop with number of generated user interface events.The resultant crash
results in:
Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000007
Crashed Thread: 0
Thread 0 Crashed: 0 libxpcom_core.dylib nsTArray_base::Length() const + 11
(nsTArray.h:66)
1 libgklayout.dylib
nsContentUtils::GetAccelKeyCandidates(nsIDOMEvent*,
nsTArray&) + 261 (nsContentUtils.cpp:4083)
This security issue is a result of unhandled exception which is a result
of null
pointer dereference.
*Links:*
http://www.secniche.org/advisory.html
http://evilfingers.com/advisory/index.php
*Proof of Concept
http://www.secniche.org/moz303/index.html
*
*Detection:*
SecNiche confirmed this vulnerability affects Mozilla Firefox
on Microsoft Windows XP SP2 platform.The versions tested are:
Mozilla 3.0.3 - 1.9.0 Branch
*Disclosure Timeline:*
Disclosed: 28 September 2008
Release Date. 28 September ,2008
*Vendor Response:*
Mozilla confirm this vulnerability.
*
Credit:*
Aditya K Sood
*Disclaimer*
The information in the advisory is believed to be accurate at the time
of publishing based
on currently available information. Use of the information constitutes
acceptance for use
in an AS IS condition. There is no representation or warranties, either
express or implied
by or with respect to anything in this document, and shall not be liable
for a ny implied
warranties of merchantability or fitness for a particular purpose or for
any indirect special
or consequential damages.
