Mozilla Firefox onload和onmouseover脚本拒绝服务漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1195692 漏洞类型 未知
发布时间 2006-03-19 更新时间 2006-03-27
CVE编号 CVE-2006-1273 CNNVD-ID CNNVD-200603-321
漏洞平台 N/A CVSS评分 7.8
|漏洞来源
https://cxsecurity.com/issue/WLB-2006030085
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200603-321
|漏洞详情
**有异议**MozillaFirefox1.0.7和1.5.0.1可以让远程攻击者通过以下途径制造拒绝服务(崩溃):一个带大量诸如onload和onmouseover脚本操作句柄的HTML标识,当用户查看网页源代码时会引起崩溃。注:RedHat已讨论过此问题,认为"报告人可能在运行IETab扩展",而且Mozilla也证实这不是Firefox本身问题。
|漏洞EXP
Good morning,

This might not come as a surprise, but there appears to be a *very*
interesting and apparently very much exploitable overflow in Microsoft
Internet Explorer (mshtml.dll).

This vulnerability can be triggered by specifying more than a couple
thousand script action handlers (such as onLoad, onMouseMove, etc) for any
single HTML tag. Due to a programming error, MSIE will then attempt to
write memory array out of bounds, at an offset corresponding to the ID of
the script action handler multiplied by 4 (due to 32-bit address clipping,
the result is a small positive integer).

The list of IDs can be found on the Web, and is as follows (values in
parentheses = resulting offsets):

onhelp = 0x8001177d (+0x45df4)
  onclick = 0x80011778 (+0x45de0)
  ondblclick = 0x80011779 (+0x45de4)
  onkeyup = 0x80011776 (+0x45dd8)
  onkeydown = 0x80011775 (+0x45dd4)
  onkeypress = 0x80011777 (+0x45ddc)
  onmouseup = 0x80011773 (+0x45dcc)
  onmousedown = 0x80011772 (+0x45dc8)
  onmousemove = 0x80011774 (+0x45dd0)
  onmouseout = 0x80011771 (+0x45dc4)
  onmouseover = 0x80011770 (+0x45dc0)
  onreadystatechange = 0x80011789 (+0x45e24)
  onafterupdate = 0x80011786 (+0x45e18)
  onrowexit = 0x80011782 (+0x45e08)
  onrowenter = 0x80011783 (+0x45e0c)
  ondragstart = 0x80011793 (+0x45e4c)
  onselectstart = 0x80011795 (+0x45e54)

What happens next depends on the structure of the page in which the
malicious tag is embedded, as well as previously visited page and
previously initialized extensions (all these factors can be controlled by
the attacker).

When the offending page contains no additional elements, and the user is
not redirected from elsewhere, the browser will typically crash
immediately, because there is no allocated memory at the resulting offset.
In all other cases, crashes will typically occur later, due to attempted
use of unrelated but corrupted in-memory buffers -for example, when the
user attempts to leave or reload the page. Another good example is coming
from a page that contains Macromedia Flash - this usually causes the Flash
plugin itself to choke on corrupted memory on cleanup.

For non-believers, there's a short but fiery demonstration page available
at http://lcamtuf.coredump.cx/iedie.html (yes, it will probably crash your
browser).

Tested on MSIE 6.0.2900.2180.xpsp2.040806-1825 on Windows XP SP2. As far
as I can tell, other browser makes (Firefox, Opera) are not susceptible to
this attack.

I eagerly await due reprimend from Microsoft for not disclosing this
vulnerability in a manner that benefits them most, not passing start, not
collecting $200 (from iDefense?).

Regards,
/mz
http://lcamtuf.coredump.cx/silence/
|参考资料

来源:BUGTRAQ
名称:20060318Re:Re:RemoteoverflowinMSIEscriptactionhandlers(mshtml.dll)
链接:http://www.securityfocus.com/archive/1/archive/1/428159/100/0/threaded
来源:BUGTRAQ
名称:20060317Re:Re:RemoteoverflowinMSIEscriptactionhandlers(mshtml.dll)
链接:http://www.securityfocus.com/archive/1/archive/1/427977/100/0/threaded
来源:OSVDB
名称:31833
链接:http://osvdb.org/31833
来源:SREASON
名称:593
链接:http://securityreason.com/securityalert/593