bugtraq - Advisory: Mozilla Firefox User Interface Null Pointer Dereference Dispatcher Crash and Remote Denial of Service.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Sun, 28 Sep 2008 23:57:35 +0530
From: Aditya K Sood <0kn0ck@...niche.org>
To: bugtraq@...urityfocus.com
Subject: Advisory: Mozilla Firefox User Interface Null Pointer Dereference
 Dispatcher Crash and Remote Denial of Service.

Mozilla Firefox User Interface Null Pointer Dereference Dispatcher Crash
and Remote Denial of Service.

*Version Tested:*
Mozilla 3.0.3 - 1.9.0 Branch /(Specifically for Latest Version)/

*Severity:*
High

*Description:*
The mozilla firefox is vulnerable to user interface event dispatcher null
pointer dereference denial of service attacks. The dispatched event created
dynamically leads to firefox crash when it is called directly or in a
defined l
oop with number of generated  user interface events.The resultant crash
results in:

Exception Type: EXC_BAD_ACCESS (SIGBUS)
Exception Codes: KERN_PROTECTION_FAILURE at 0x0000000000000007
Crashed Thread: 0
Thread 0 Crashed: 0 libxpcom_core.dylib nsTArray_base::Length() const + 11
(nsTArray.h:66)
1 libgklayout.dylib
nsContentUtils::GetAccelKeyCandidates(nsIDOMEvent*,
nsTArray&) + 261 (nsContentUtils.cpp:4083)

This security issue is a result of unhandled exception which is a result
of null
pointer dereference.

*Links:*
http://www.secniche.org/advisory.html
http://evilfingers.com/advisory/index.php

*Proof of Concept
http://www.secniche.org/moz303/index.html
*
*Detection:*
SecNiche confirmed this vulnerability affects  Mozilla Firefox
on Microsoft Windows XP SP2 platform.The versions tested are:

Mozilla 3.0.3 - 1.9.0 Branch

*Disclosure Timeline:*
Disclosed: 28 September 2008
Release Date. 28 September ,2008

*Vendor Response:*
Mozilla confirm this vulnerability.
*
 Credit:*
Aditya K Sood

*Disclaimer*
The information in the advisory is believed to be accurate at the time
of publishing based
on currently available information. Use of the information constitutes
acceptance for use
 in an AS IS condition. There is no representation or warranties, either
express or implied
by or with respect to anything in this document, and shall not be liable
for a ny implied
warranties of merchantability or fitness for a particular purpose or for
any indirect special
or consequential damages.