Full Disclosure: Mozilla Firefox "Host:" Buffer Overflow

From: Tom Ferris <tommy_at_security-protocols.com>
Date: Thu, 8 Sep 2005 23:09:51 -0700 (PDT)

Mozilla Firefox "Host:" Buffer Overflow

Release Date:
September 8, 2005

Date Reported:
September 4, 2005

Severity:
Critical

Vendor:
Mozilla

Versions Affected:
Firefox Win32 1.0.6 and prior
Firefox Linux 1.0.6 and prior
Firefox 1.5 Beta 1 (Deer Park Alpha 2)

Overview:

A buffer overflow vulnerability exists within Firefox version 1.0.6 and
all other prior versions which allows for an attacker to remotely execute
arbitrary code on an affected host.

Technical Details:
The problem seems to be when a hostname which has all dashes causes the
NormalizeIDN call in nsStandardURL::BuildNormalizedSpec to return true,
but is sets encHost to an empty string. Meaning, Firefox appends 0 to
approxLen and then appends the long string of dashes to the buffer
instead. The following HTML code below will reproduce this issue:

Simple, huh? ;-]

Vendor Status:
Mozilla was notified, and im guessing they are working on a patch. Who
knows though?

Discovered by:
Tom Ferris

Related Links:
www.security-protocols.com/firefox-death.html
www.security-protocols.com/advisory/sp-x17-advisory.txt
www.security-protocols.com/modules.php?name=News&file=article&sid=2910

Greetings:
chico, modify, ac1djazz, dmuz, aempirei, Daniel Sergile, tupac shakur, and
the rest of the angrypacket krew.

Thanks,

Tom Ferris
Researcher
www.security-protocols.com
Key fingerprint = 0DFA 6275 BA05 0380 DD91 34AD C909 A338 D1AF 5D78
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
Received on Sep 08 2005