762920 - Bug 754202 regressed IsCapabilityEnabled

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

When there is no frame, the result of IsCapabilityEnabled is always true.  This is not good since event listeners can be called with no frame.

Comment 1

[moz_bug_r_a4]

Attachment: testcase - arbitrary code execution

This uses bug 344495's trick.
This works on trunk.

Comment 2

[David Bolter [:davidb] (NeedInfo me for attention)]

Over to Bobby.

Comment 3

[Boris Zbarsky [:bzbarsky]]

mmmm... did we have no tests for this?

Comment 4

[(no longer active)]

Hmm, the testcase doesn't work for me on trunk...

Comment 5

[Bobby Holley (:bholley)]

(In reply to Boris Zbarsky (:bz) from comment #3)
> mmmm... did we have no tests for this?

That used moz_bug_r_a4's stack frame trick? I wasn't sure those were ever checked in.

Comment 6

[Daniel Veditz [:dveditz]]

We don't want to check in tests demonstrating the exploit, but often the specific problem can be demonstrated without using that trick (sometimes requires a chrome testcase to show the wrong thing is getting used/returned in places).

Comment 7

[Daniel Veditz [:dveditz]]

This should be fixed by the backout in bug 754202 comment 41 right? I don't think it makes sense to leave open in case we reland it, but of course we should test it again.

Comment 8

[Al Billings [:abillings - ex-MoCo]]

I can't get this testcase to do anything on pre-fix trunk builds. The only thing I see that is different pre and post fix on my mozilla central builds is that pre-fix has the following in the webconsole:

[12:02:01.330] Error: Permission denied for <https://bug762920.bugzilla.mozilla.org> to get property XPCComponents.utils

I see the same whether I load it locally or from bugzilla, as in above. Do we have something that repros that issue?

Comment 9

[Bobby Holley (:bholley)]

There should be a specific window, between when bug 754202 landed and when it was backed out, where you should get an alert popup (indicating that the exploit was successful).

Comment 10

[Al Billings [:abillings - ex-MoCo]]

Yeah, I thought I had it. I'll keep digging.

Comment 11

[Al Billings [:abillings - ex-MoCo]]

All right. I was a day off last time. Bug repro's in 6/9 Mozilla Central build and was fixed after back out off bug 754202.

Comment 12

[Daniel Veditz [:dveditz]]

bug 754202 has relanded so it'd be safest to reverify this bug.