Mozilla Firefox "nsTreeRange" Dangling Pointer Exploit

                                                Advisory :


Abysssec Public Exploit :

This module exploits a code execution vulnerability in Mozilla
Firefox <= 3.6.16 caused by nsTreeSelection element. The specific flaw
exists within the way Firefox handles user defined functions of
a nsTreeSelection element. When executing the function
invalidateSelection it is possible to free the nsTreeSelection object
that the function operates on. Any further operations on the freed
object can result in remote code execution.this exploit module is only
tested on win7 and used a Another JAVA ROPto defeat DEP/ASLR (due to
there is no more non-aslr module in Firefox) and in my tests works
reliably on Windows7.

there is two version of this exploit XP and 7 and both use different
method that used in MSF Exploit bounty !

XP   Version: http://www.exploit-db.com/sploits/nsTreeRange_XP.zip
Win7 Version: http://www.exploit-db.com/sploits/nsTreeRange_7.zip




questions / comments : Info [at] abysssec.com