Mozilla Unchecked Allocation Remote Code Execution

Notification Type: IBM Internet Security Systems Protection Advisory
Notification Date: November 13, 2008
Notification Version: 1.1
   
Name: Mozilla Unchecked Allocation Remote Code Execution
Public disclosure/
In the wild date:		 November 12, 2008 (vuln disclosure)
Aliases:

Mozilla Foundation Security Advisory 2008-54
CVE:

CVE-2008-0017
Description:

Mozilla Firefox and Mozilla SeaMonkey are vulnerable to remote code execution by enticing a user to click on a malicious URL.
Discoverer: Justin Schuh of the IBM X-Force

 

ISS Coverage
Product Content Version
Proventia Network IDS
Proventia Network IPS
Proventia Network MFS
Proventia Server (Linux)
RealSecure Network
RealSecure Server Sensor		 28.060
Proventia Desktop
Proventia Server IPS (Windows)		 2200
Propagation Techniques ISS Protection Available

remote exploit

HTTP_Client_Converter_Null_Ptr_BO

May 13, 2008

Detailed Description
Business Impact:

Compromise of machines using affected versions of Firefox or other Mozilla-based applications may lead to exposure of confidential information, loss of productivity, and further compromise. An attacker must cause the victim user to browse to a malicious web page, click a link in a malicious email, or similar operation in order to perform a successful attack. Successful exploitation grants an attacker the privileges of the victim.

CVSS: Base Score: 9.3
  Access Vector: Network
Access Complexity: Medium
Authentication: None
Confidentiality Impact: Complete
Integrity Impact: Complete
Availability Impact: Complete
Adjusted Temporal Score: 7.3
  Exploitability: Proof-of-Concept
Remediation Level: Official-Fix
Report Confidence: Confirmed
Affected Products: Mozilla Firefox and Mozilla SeaMonkey.  See references for details.
Technical Description: The http-index-format parser does not check for an allocation failure on a format array. The resulting array is then terminated with a sentinel value of 0xFFFFFFFF. A malicious party can exploit this issue to execute arbitrary code by overwriting a sensitive memory location (such as a buffer length or boolean variable).
Remediation:

Patches are available for this issue. See References for details.

References
XFDB: http://xforce.iss.net/xforce/xfdb/42089
Mozilla: http://www.mozilla.org/security/announce/2008/mfsa2008-54.html

Revision History
1.0 Initial publication.
1.1 In the CVSS calculation, changed Access complexity to medium, added PoC released in Mozilla advisory, and adjusted base and temporal scores accordingly.


About IBM Internet Security Systems
IBM Internet Security Systems is the trusted security advisor to thousands of the world's leading businesses and governments, providing pre-emptive protection for networks, desktops and servers. An established leader in security since 1994, the IBM Proventia® integrated security platform is designed to automatically protect against both known and unknown threats, helping to keep networks up and running and shielding customers from online attacks before they impact business assets. IBM Internet Security Systems products and services are based on the proactive security intelligence of its X-Force® research and development team – the unequivocal world authority in vulnerability and threat research. The Internet Security Systems product line is also complemented by comprehensive Managed Security Services and Professional Security Services. For more information, visit the Internet Security Systems Web site at www.iss.net or call 800-776-2362.