Ads

DoS Vulnerability in Firefox <= 1.0.7 PDF Print E-mail
Wednesday, 22 February 2006
This issue was originally (?) discovered by Yuan Qi who posted it on
Bugzilla [1] on 11th November 2004 [2]. I rediscovered this
vulnerability on 1st October 2005 and reported it several weeks later
to the Mozilla Software Foundation [3] because I did not find any
advisory or bugzilla post about this problem..

I decided to release an advisory about this DoS vulnerability, even
though its an old issue.

o Description:
=============

The award-winning Web browser is better than ever. Browse the Web
with confidence - Firefox protects you from viruses, spyware and
pop-ups. Enjoy improvements to performance, ease of use and privacy.

Visit http://www.mozilla.com/firefox/ for detailed information.

o Denial of Service:
===================

Following HTML code forces Firefox to crash:
>
>



Online-demo:
http://morph3us.org/security/pen-te...8143204906.html

The access violation results in a null pointer dereference and is not
exploitable.

o Vulnerable versions:
=====================

The DoS vulnerability was successfully tested on:
> Firefox 1.0.7 - GNU/Linux (Gentoo, Slackware, Debian)
> Firefox 1.0.7 - Solaris
> Firefox 1.0.7 - Windoze 2k / XP SP2
> Firefox 1.0.6 - XP SP2
> Firefox 1.0.4 - GNU/Linux (Gentoo, Slackware, Debian)
> Firefox 1.0.4 - XP SP2
> Firefox 1.0.1 - XP SP2
> Firefox 1.0.0 - XP SP2

o Disclosure Timeline:
=====================

01 Oct 05 - DoS vulnerability discovered.
15 Dec 05 - Vendor contacted.
17 Dec 05 - Vendor confirmed vulnerability.
15 Feb 06 - Public release.

o Solution:
==========

Upgrade to Firefox 1.5.0.1.

o Credits:
=========

Thomas Waldegger < This email address is being protected from spam bots, you need Javascript enabled to view it >
BuHa-Security Community - http://buha.info/board/

If you have questions, suggestions or criticism about the advisory feel
free to send me a mail. The address This email address is being protected from spam bots, you need Javascript enabled to view it is more a
spam address than a regular mail address therefore its possible that I
ignore some mails. Please use the contact details at
http://morph3us.org/
to contact me.

Greets fly out to cyrus-tc, destructor, nait, trappy and all members
of BuHa.

Advisory online:
http://morph3us.org/advisories/20060215-firefox-107.txt

[1] https://bugzilla.mozilla.org/
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=269095
[3] https://bugzilla.mozilla.org/show_bug.cgi?id=320463


-----BEGIN PGP SIGNATURE-----
Version: n/a
Comment: http://morph3us.org/
 
< Prev   Next >
[ Back ]