[NEWS] Gecko Based Browser IDN Buffer Overflow

The following security advisory is sent to the securiteam mailing list, and can 
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html 

- - - - - - - - -



  Gecko Based Browser IDN Buffer Overflow
------------------------------------------------------------------------


SUMMARY

A buffer overflow vulnerability exists within Gecko based web browsers 
that allows for a remote attacker to execute arbitrary code on a remote 
host.

DETAILS

Vulnerable Systems:
 * Firefox version 1.0.6 and prior
 * Firefox version 1.5 Beta 1 (Deer Park Alpha 2)
 * Mozilla Suite version 1.7.11 and prior
 * Netscape version 7.x
 * Netscape version 8.x

The problem seems to be when a hostname which has all dashes causes the 
NormalizeIDN call in nsStandardURL::BuildNormalizedSpec to return true, 
but is sets encHost to an empty string. Meaning, Firefox appends 0 to 
approxLen and then appends the long string of dashes to the buffer 
instead.

Debug information:
(gdb) x/i $eip
0x867926c <_ZN16nsTypedSelection5ClearEP14nsIPresContext+2236>:
    call *0x4(%eax)
(gdb) info reg eax
eax 0x61616161 1633771873

Proof of Concept:
Create a link as followed:
< A HREF=https:--------------------------------------------- >

Vendor Status:
Mozilla foundeation has released a patch for Firefox:  
<http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.6/patches/307259.xpi>
 
http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/1.0.6/patches/307259.xpi

Installing the Patch:
 1. In the Software Installation window, click the "Install Now" button.
 2. Exit and restart your Mozilla or Firefox browser.
 3. To verify the fix in Firefox and the Mozilla Suite, be sure to restart 
the browser and then follow these steps:
 4. In Firefox Click Help -> About Mozilla Firefox and verify that the 
user agent string contains "(noIDN)"
 5. In the Mozilla Suite Click Help -> About Mozilla and verify that the 
user agent string contains "(noIDN)"

Manually Configuring the Browser:
To manually change the browser configuration for Firefox or the Mozilla 
Suite, follow these instructions:
 1. Type about:config into the address field and hit Enter.
 2. In the Filter toolbar, type network.enableIDN.
 3. Right click on the the network.enableIDN item and select toggle to 
change value to false.

To verify the fix in your Firefox or Mozilla application, be sure to 
restart the browser and then follow these steps.
 1. Type about:config into the address field and hit Enter.
 2. In the Filter toolbar, type network.enableIDN.
 3. Ensure that the the value for this item is set to false.

CVE Information:
 <http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-2871> 
CAN-2005-2871

Disclosure Timeline:
September 4, 2005 Reported
September 4, 2005 Public Released


ADDITIONAL INFORMATION

The information has been provided by  <mailto:juha-matti.laurio@xxxxxxxx> 
Juha-Matti Laurio,
 <mailto:venglin@xxxxxxxxxxxxxxxxx> Przemyslaw Frasunek
The vendor advisory can be found at:  
<https://addons.mozilla.org/messages/307259.html> 
https://addons.mozilla.org/messages/307259.html
The vendor bug report can be found at:  
<https://bugzilla.mozilla.org/show_bug.cgi?id=307259> 
https://bugzilla.mozilla.org/show_bug.cgi?id=307259
The CERT advisory can be found at:  
<http://www.kb.cert.org/vuls/id/573857> 
http://www.kb.cert.org/vuls/id/573857
The original advisory can be found at:  
<http://security-protocols.com/advisory/sp-x17-advisory.txt> 
http://security-protocols.com/advisory/sp-x17-advisory.txt



======================================== 


This bulletin is sent to members of the SecuriTeam mailing list. 
To unsubscribe from the list, send mail with an empty subject line and body to: 
list-unsubscribe@xxxxxxxxxxxxxx 
In order to subscribe to the mailing list, simply forward this email to: 
list-subscribe@xxxxxxxxxxxxxx 


==================== 
==================== 

DISCLAIMER: 
The information in this bulletin is provided "AS IS" without warranty of any 
kind. 
In no event shall we be liable for any damages whatsoever including direct, 
indirect, incidental, consequential, loss of business profits or special 
damages.