You are here: Known Vulnerabilities in Mozilla Products (Firefox 1.0.7) > MFSA 2005-58
Mozilla Foundation Security Advisory 2005-58
Date: September 22, 2005
Severity: Critical
Products: Firefox, Mozilla Suite
Fixed in: Firefox 1.0.7
Mozilla Suite 1.7.12
Fixes for multiple vulnerabilities with an overall severity of "critical" have been released in Mozilla Firefox 1.0.7 and the Mozilla Suite 1.7.12
- Heap overrun in XBM image processing [Critical]
- Crash on "zero-width non-joiner" sequence [Critical]
- XMLHttpRequest header spoofing [Moderate]
- Object spoofing using XBL <implements> [Moderate]
- JavaScript integer overflow [Severe]
- Privilege escalation using about: scheme [Severe]
- Chrome window spoofing [Severe]
- Regression fixes
Heap overrun in XBM image processing
jackerror reports that an improperly terminated XBM image ending with space characters instead of the expected end tag can lead to a heap buffer overrun. This appears to be exploitable to install or run malicious code on the user's machine.
Thunderbird does not support the XBM format and is not affected by this flaw.
Crash on "zero-width non-joiner" sequence
Mats Palmgren discovered that a reported crash on Unicode sequences with "zero-width non-joiner" characters was due to stack corruption that may be exploitable to run arbitrary code.
In the default configuration (JavaScript disabled) Thunderbird will crash, but we do not believe it can be exploited to run the attacker's code. With JavaScript turned on Thunderbird is vulnerable to this exploit.
XMLHttpRequest header spoofing
It was possible to add illegal and malformed headers to an XMLHttpRequest. This could have been used to exploit server or proxy flaws from the user's machine, or to fool a server or proxy into thinking a single request was a stream of separate requests. The severity of this vulnerability depends on the value of servers which might be vulnerable to HTTP request smuggling and similar attacks, or which share an IP address (virtual hosting) with the attacker's page.
For users connecting to the web through a proxy this flaw could be used to bypass the same-origin restriction on XMLHttpRequests by fooling the proxy into handling a single request as multiple pipe-lined requests directed at arbitrary hosts. This could be used, for example, to read files on intranet servers behind a firewall.
Reported independently by Tim Altman and Yutaka Oiwa
- https://bugzilla.mozilla.org/show_bug.cgi?id=297078
- https://bugzilla.mozilla.org/show_bug.cgi?id=302263
Object spoofing using XBL <implements>
moz_bug_r_a4 demonstrated a DOM object spoofing bug similar to MFSA 2005-55 using an XBL control that <implements> an internal interface. The severity depends on the version of Firefox: investigation so far indicates Firefox 1.0.x releases don't expose any vulnerable functionality to interfaces spoofed in this way, but that early Deer Park Alpha 1 versions did.
XBL was changed to no longer allow unprivileged controls from web content to implement XPCOM interfaces.
JavaScript integer overflow
Georgi Guninski reported an integer overflow in the JavaScript engine. We presume this could be exploited to run arbitrary code under favorable conditions.
Privilege escalation using about: scheme
heatsync and shutdown report two different ways to bypass the restriction on loading high privileged "chrome" pages from an unprivileged "about:" page. By itself this is harmless--once the "about" page's privilege is raised the original page no longer has access--but should this be combined with a same-origin violation this could lead to arbitrary code execution.
- https://bugzilla.mozilla.org/show_bug.cgi?id=304754
- https://bugzilla.mozilla.org/show_bug.cgi?id=306261
Chrome window spoofing
moz_bug_r_a4 demonstrates a way to get a blank "chrome" canvas by opening a window from a reference to a closed window. The resulting window is not privileged, but the normal browser UI is missing and can be used to construct a spoof page without any of the safety features of the browser chrome designed to alert users to phishing sites, such as the address bar and the status bar.
Regression fixes
These releases include fixes for the following bugs that were introduced in previous security releases. These were fixed for stability reasons, they do not themselves pose any security risk.
- 291178 InstallTrigger.getVersion gone in Firefox 1.0.3
- 300853 Caps crash on cleanup [@ DomainPolicy::Drop]
- 301180 crash if you stop search and hit the search button again (Mozilla 1.7 only)
- 302100 Firefox 1.0.6 crashes when loading any page if PAC script uses eval