bugtraq - Re : [Firefox Bug 302187] New: Shared section vulnerability when opening microsoft office document resulting in DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20050727092816.24491.qmail@securityfocus.com>
Date: 27 Jul 2005 09:28:16 -0000
From: sylvain.roger@...ucom.fr
To: bugtraq@...urityfocus.com
Subject: Re : [Firefox Bug 302187] New: Shared section vulnerability when
 opening microsoft office document resulting in DoS

Hello, 

More details about the potentiel vulnerability : Firefox is just starting a new process in the standard way, using CreateProcess
(see
<http://lxr.mozilla.org/seamonkey/source/nsprpub/pr/src/md/windows/ntmisc.c#391>).
Firefox is already passing NULL to lpProcessAttributes and lpThreadAttributes, so
it is using the "default" security descriptor. That might be the way that IE is
using, by using a modified descriptor. Windows is the issue if the default behaviour
provokes this error. But firefox in this case can't really be blamed for this problem, every
applicition that launches another one will need to be fixed.

Regards, 

Sylvain ROGER
Security Consultant
http://www.solucom.fr