0DAY Firefox Remote Code Execution and Denial of Service Vulnerability <=1.5.0.2 iframe.contentWindow.focus()

From: <chris_at_splices.org>
Date: 24 Apr 2006 01:35:06 -0000

('binary' encoding is not supported, stored as-is) ---------------------------------------------------
Software:
 Firefox Web Browser
Tested:
 Linux, Windows clients' version 1.5.0.2
Result:
 Firefox Remote Code Execution and Denial of Service
Problem:
 A handling issue exists in how Firefox handles certain Javascript in js310.dll and xpcom_core.dll
regarding iframe.contentWindow.focus(). By manipulating this feature a buffer overflow will occur.
Proof of Concept:
 http://www.securident.com/vuln/ff.txt
Credits:
 splices(splices [dot] org)
 spiffomatic64(spiffomatic64 [dot] com)
 Securident Technologies (securident [dot] com)
------------------------------------------------
Received on Apr 24 2006