[NEWS] Gecko Based Browser IDN Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -

Gecko Based Browser IDN Buffer Overflow
------------------------------------------------------------------------

SUMMARY

A buffer overflow vulnerability exists within Gecko based web browsers
that allows for a remote attacker to execute arbitrary code on a remote
host.

DETAILS

Vulnerable Systems:
* Firefox version 1.0.6 and prior
* Firefox version 1.5 Beta 1 (Deer Park Alpha 2)
* Mozilla Suite version 1.7.11 and prior
* Netscape version 7.x
* Netscape version 8.x

The problem seems to be when a hostname which has all dashes causes the
NormalizeIDN call in nsStandardURL::BuildNormalizedSpec to return true,
but is sets encHost to an empty string. Meaning, Firefox appends 0 to
approxLen and then appends the long string of dashes to the buffer
instead.

Debug information:
(gdb) x/i $eip
0x867926c <_ZN16nsTypedSelection5ClearEP14nsIPresContext+2236>:
call *0x4(%eax)
(gdb) info reg eax
eax 0x61616161 1633771873

Proof of Concept:
Create a link as followed:
< A HREF=https:--------------------------------------------- >

Vendor Status:
Mozilla foundeation has released a patch for Firefox:
<http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.6/patches/307259.xpi> http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.6/patches/307259.xpi

Installing the Patch:
1. In the Software Installation window, click the "Install Now" button.
2. Exit and restart your Mozilla or Firefox browser.
3. To verify the fix in Firefox and the Mozilla Suite, be sure to restart
the browser and then follow these steps:
4. In Firefox Click Help -> About Mozilla Firefox and verify that the
user agent string contains "(noIDN)"
5. In the Mozilla Suite Click Help -> About Mozilla and verify that the
user agent string contains "(noIDN)"

Manually Configuring the Browser:
To manually change the browser configuration for Firefox or the Mozilla
Suite, follow these instructions:
1. Type about:config into the address field and hit Enter.
2. In the Filter toolbar, type network.enableIDN.
3. Right click on the the network.enableIDN item and select toggle to
change value to false.

To verify the fix in your Firefox or Mozilla application, be sure to
restart the browser and then follow these steps.
1. Type about:config into the address field and hit Enter.
2. In the Filter toolbar, type network.enableIDN.
3. Ensure that the the value for this item is set to false.

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2871>
CAN-2005-2871

Disclosure Timeline:
September 4, 2005 Reported
September 4, 2005 Public Released

ADDITIONAL INFORMATION

The information has been provided by <mailto:juha-matti.laurio@netti.fi>
Juha-Matti Laurio,
<mailto:venglin@freebsd.lublin.pl> Przemyslaw Frasunek
The vendor advisory can be found at:
<https://addons.mozilla.org/messages/307259.html>
https://addons.mozilla.org/messages/307259.html
The vendor bug report can be found at:
<https://bugzilla.mozilla.org/show_bug.cgi?id=307259>
https://bugzilla.mozilla.org/show_bug.cgi?id=307259
The CERT advisory can be found at:
<http://www.kb.cert.org/vuls/id/573857>
http://www.kb.cert.org/vuls/id/573857
The original advisory can be found at:
<http://security-protocols.com/advisory/sp-x17-advisory.txt>
http://security-protocols.com/advisory/sp-x17-advisory.txt

========================================

This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@securiteam.com

====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.