783957 - Arbitrary code execution with Flash plugin using bug 783260

Status: VERIFIED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

Fx15,14,10 are exploitable as described in bug 783260 comment 6-8.

Comment 1

[moz_bug_r_a4]

Attachment: testcase 1 - the exploit code is called via NP_GetProperty.

This uses bug 344495's trick.
This works on fx15,14,10.

Comment 2

[moz_bug_r_a4]

Attachment: testcase 2 - the exploit code is called via NP_Invoke.

This uses bug 344495's trick.
This works on fx15,14,10.

Comment 3

[Benjamin Smedberg]

How is this a different bug than bug 783260?

Comment 4

[Bobby Holley (:bholley)]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #3)
> How is this a different bug than bug 783260?

Because it adds remote code execution exploits for it? I thought it was standard practice for moz_bug_r_a4 to put those in a separate bug.

Comment 5

[moz_bug_r_a4]

(In reply to Bobby Holley (:bholley) from comment #4)
> (In reply to Benjamin Smedberg  [:bsmedberg] from comment #3)
> > How is this a different bug than bug 783260?
> 
> Because it adds remote code execution exploits for it? I thought it was
> standard practice for moz_bug_r_a4 to put those in a separate bug.

Er, yes. I filed this bug to attach the testcases.

Comment 6

[Andrew McCreight [:mccr8]]

Setting tracking flags based on comment 0.

Comment 7

[Al Billings [:abillings - ex-MoCo]]

Who can we assign this to in order to get traction?

Comment 8

[Benjamin Smedberg]

bholley, although I'm pretty sure it's a straight dup. I don't understand the bit about the testcases.

Comment 9

[Bobby Holley (:bholley)]

(In reply to Benjamin Smedberg  [:bsmedberg] from comment #8)
> bholley, although I'm pretty sure it's a straight dup. I don't understand
> the bit about the testcases.

Yes, it's a dupe. moz_bug_r_a4 has various tricks that we don't like to reveal when bugs are made public, so we try to post the remote code execution testcases in a separate bug sometimes (this is my understanding, at least).

Comment 10

[moz_bug_r_a4]

(In reply to Bobby Holley (:bholley) from comment #9)
> (In reply to Benjamin Smedberg  [:bsmedberg] from comment #8)
> > bholley, although I'm pretty sure it's a straight dup. I don't understand
> > the bit about the testcases.
> 
> Yes, it's a dupe. moz_bug_r_a4 has various tricks that we don't like to
> reveal when bugs are made public, so we try to post the remote code
> execution testcases in a separate bug sometimes (this is my understanding,
> at least).

When attaching remote code execution testcases to a bug, if persons in that bug seem to be Mozilla staff or seem to already know tricks used by the testcases, I attach the testcases to that bug.  Otherwise, I attach the testcases to a separate bug because I can't create private comments/attachments.

Comment 11

[Bobby Holley (:bholley)]

Resolving this fixed because bug 783260 is now fixed. I mentioned in that bug to verify the testcases here.

Comment 12

[Al Billings [:abillings - ex-MoCo]]

I'm confused by the flags on this bug. Bug 783260 is ESR only and doesn't affect anything else. This bug, based on it, says it is won't fix for Firefox 14 and 15 and comments 1 and 2 repeat that this is exploitable on 14 and 15.

How did 16 wind up unaffected and if 14 and 15 are affected, why doesn't bug 783260 say the same?

Comment 13

[Bobby Holley (:bholley)]

(In reply to Al Billings [:abillings] from comment #12)
> I'm confused by the flags on this bug. Bug 783260 is ESR only and doesn't
> affect anything else. This bug, based on it, says it is won't fix for
> Firefox 14 and 15 and comments 1 and 2 repeat that this is exploitable on 14
> and 15.
> 
> How did 16 wind up unaffected and if 14 and 15 are affected

Because bug 754202 landed for 16.

>  why doesn't bug 783260 say the same?

It did, modulo the fact that status-15 was blank. I just explicitly wontfixed this there.

Anyway, the point here is that this bug only affects 15 and esr10.

Comment 14

[Daniel Veditz [:dveditz]]

(In reply to Bobby Holley (:bholley) from comment #13)
> Anyway, the point here is that this bug only affects 15 and esr10.

Since this is a security bug we prefer marking it "fixed" rather than "unaffected" since we did check in code that fixed it (bug 754202) on mozilla-central

Comment 15

[u279076]

Kamil, can you please test the testcases attached to this bug to verify it's fixed? It should be fixed in the latest Firefox 16, 17, 18, and esr10 builds. Thank you.

Comment 16

[Kamil Jozwiak [:kjozwiak]]

Went through the following builds to make sure that the reported issue is reproducible using Firefox 10,14,15:

Firefox 10(Issue Reproduced): http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/10.0.2/win32/en-US/
- Ran TestCase#1 and received the following prompt: "JS frame :: x :: <TOP_LEVEL> :: line 3"
- Ran TestCase#2 and received the following prompt: "JS frame :: x :: <TOP_LEVEL> :: line 3"
- For both TestCase#1 and TestCase#2, received no error messages in the error console

Firefox 14 (Issue Reproduced): http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/14.0.1/win32/en-US/
- Ran TestCase#1 and received the following prompt: "JS frame :: x :: <TOP_LEVEL> :: line 3"
- Ran TestCase#2 and received the following prompt: "JS frame :: x :: <TOP_LEVEL> :: line 3"
- For both TestCase#1 and TestCase#2, received no error messages in the error console

Firefox 15 (Issue Reproduced): http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/15.0.1/win32/en-US/
- Ran TestCase#1 and received the following prompt: "JS frame :: x :: <TOP_LEVEL> :: line 3"
- Ran TestCase#2 and received the following prompt: "JS frame :: x :: <TOP_LEVEL> :: line 3"
- For both TestCase#1 and TestCase#2, received the following in the error console:
"Error: Exposing chrome JS objects to content without __exposedProps__ is insecure and deprecated. See https://developer.mozilla.org/en/XPConnect_wrappers for more information."

Went through the following builds to ensure that the above issue has been fixed in Firefox 16,17,18,esr10:

Firefox 16 (No Issue): http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/16.0.2/win32/en-US/
- Ran TestCase#1 and didn't receive a prompt message as in Firefox 10,14,15
- Ran TestCase#2 and didn't receive a prompt message as in Firefox 10,14,15
- For both TestCase#1 and TestCase#2, received the following in the error console:
"Error: TypeError: can't redefine non-configurable property 'top'"

Firefox 17 (No Issue): http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/17.0/win32/en-US/
- Ran TestCase#1 and didn't receive a prompt message as in Firefox 10,14,15
- Ran TestCase#2 and didn't receive a prompt message as in Firefox 10,14,15
- Both TestCase#1 and TestCase#2 produced several syntax error related to the test cases (.html files)

Firefox 18 (No Issue): http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/18.0b1/win32/en-US/
- Ran TestCase#1 and didn't receive a prompt message as in Firefox 10,14,15
- Ran TestCase#2 and didn't receive a prompt message as in Firefox 10,14,15
- Both TestCase#1 and TestCase#2 produced several syntax error related to the test cases (.html files)

Firefox esr10 (No Issue): http://ftp.mozilla.org/pub/mozilla.org/firefox/releases/latest-10.0esr/win32/en-US/
- Ran TestCase#1 and didn't receive a prompt message as in Firefox 10,14,15
- Ran TestCase#2 and didn't receive a prompt message as in Firefox 10,14,15
- Both TestCase#1 and TestCase#2 produced several syntax error related to the test cases (.html files)

Comment 17

[u279076]

Thanks a lot, Kamil!