bugtraq - Re[3]: New Flaw in Firefox 2.0: DoS and possible remote code execution

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1403578024.20061101181322@SECURITY.NNOV.RU>
Date: Wed, 1 Nov 2006 18:13:22 +0300
From: 3APA3A <3APA3A@...URITY.NNOV.RU>
To: xxxx@...il.com
Cc: bugtraq@...urityfocus.com
Subject: Re[3]: New Flaw in Firefox 2.0: DoS and possible remote code execution

Dear xxxx@...il.com,

NULL pointer dereference is not exploitable to code execution by itself.
Please read carefully original Michal Zalewski post on the issue you are
pointing
http://securitytracker.com/alerts/2006/Apr/1016001.html

issue  mentioned  is not NULL pointer, but NULL+offset dereference where
offset is believed to be controlled:

-=-=-=-=- start quote Michal Zalewski =-=-=-=-

...this will (usually) cause a NULL pointer + fixed offset (eax+0x28)
dereference in mshtml.dll, the pointer being read from allocated but still
zeroed memory region.

The aforementioned condition is not exploitable, but padding the page with
preceeding OBJECT tag (and other tags), increasing the number of nested
OBJECTs, and most importantly, adding bogus 'type=' parameters of various
length to the final sequence of OBJECTs, will cause that dereference to
become non-NULL on many installations;

-=-=-=-=-          end quote          =-=-=-=-

--Tuesday, October 31, 2006, 11:00:00 PM, you wrote to bugtraq@...urityfocus.com:

xgc> When you have a NULL pointer dereference a code execution is
xgc> also possible, so you can't exclude it at all.
xgc> For example in this old flaw:
xgc> http://securitytracker.com/alerts/2006/Apr/1016001.html
xgc> "The browser does not properly process certain combinations
xgc> of nested OBJECT tags. A remote user can create specially crafted
xgc> HTML that, when loaded by the target user, will trigger a NULL
xgc> pointer dereference and cause the target user's browser to crash or
xgc> execute arbitrary code."

-- 
~/ZARAZA
http://www.security.nnov.ru/