1158650 - Memory/Buffer overflow exploit targeting xul.dll

Status: RESOLVED INCOMPLETE

(Core :: JavaScript Engine, defect)

Description

[[e-mail]]

Attachment: Detection and code.txt

User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:37.0) Gecko/20100101 Firefox/37.0
Build ID: 20150415140819

Steps to reproduce:

I was browsing a website. There was a video available and it said click here to watch. I was hit with a Remote exploit. 



Actual results:

I have software with stronger protection than Microsoft's EMET and it caught before it fully exploited the PC. The detection details displayed the entire working exploit code. The software shut down Firefox as a precaution. 

In the code, it checks for certain conditions in both the normal and private browsing windows, then it attempts to cause an overflow.


Expected results:

Had the security software not been installed, my PC would have been infected. It appears that is a buffer overflow or memory corruption exploit. 

The exploit was targeting a specific memory address in xul.dll: Details are in the text file. (I did not write this).

Comment 1

[Daniel Veditz [:dveditz]]

Do you have any of the content, a link to the video or which video it was, even just what website it was, anything like that?

Do you know if it was a Flash video or an "HTML 5" (browser) video? What version of Flash do you have? (you can find out from about:addons, the add-on manager page, or by visiting our site https://www.mozilla.org/en-US/plugincheck/ ).

This may be part of an exploit, but there's not much information here to figure out what Firefox flaw was used before it got to this point. "Something to do with ElementAdder" (use after free?) is at least a start.

https://dxr.mozilla.org/mozilla-central/search?q=ElementAdder&=mozilla-central&redirect=true

Comment 2

[[e-mail]]

I will attempt to look for the video or link. I was using the latest version of Flash Player and Firefox at the time (17.0.0.169) on 4/18/15. I am going to have to look for the link. I had not seen the type of player it was (It didn't look like your typical flash video player from any site that uses a youtube like player). I will go on a hunt for it. It was late at night and about an app review I believe. I had never seen the type of object I clicked on before (I think it said click here to view the video and was in a frame - I should have known better). I checked my event log, and it shows what is in the text file, but that is all.

No video ever played, because the program I use shut firefox down. Is there a log in about:crashes? Of note, this is similar to EMET, and shut down Firefox as it appeared the memory was out of bounds. If you need the Security application name and the mitigations it enables, let me know.

Comment 3

[[e-mail]]

(In reply to Daniel Veditz [:dveditz] from comment #1)
> Do you have any of the content, a link to the video or which video it was,
> even just what website it was, anything like that?
> 
> Do you know if it was a Flash video or an "HTML 5" (browser) video? What
> version of Flash do you have? (you can find out from about:addons, the
> add-on manager page, or by visiting our site
> https://www.mozilla.org/en-US/plugincheck/ ).
> 
> This may be part of an exploit, but there's not much information here to
> figure out what Firefox flaw was used before it got to this point.
> "Something to do with ElementAdder" (use after free?) is at least a start.
> 
> https://dxr.mozilla.org/mozilla-central/search?q=ElementAdder&=mozilla-
> central&redirect=true

So far I have not been able to locate the webpage. I checked the event log and it shows the details posted in the text file. Had DEP been enabled for all programs through the System Protection settings in Windows, I may have more information.

The date was 06/16/2015 at 10:12PM. I have checked for corresponding events, but got nothing. Is there anything else I can door does this render this obsolete?

Comment 4

[[e-mail]]

(In reply to jd2978 from comment #3)
> (In reply to Daniel Veditz [:dveditz] from comment #1)
> > Do you have any of the content, a link to the video or which video it was,
> > even just what website it was, anything like that?
> > 
> > Do you know if it was a Flash video or an "HTML 5" (browser) video? What
> > version of Flash do you have? (you can find out from about:addons, the
> > add-on manager page, or by visiting our site
> > https://www.mozilla.org/en-US/plugincheck/ ).
> > 
> > This may be part of an exploit, but there's not much information here to
> > figure out what Firefox flaw was used before it got to this point.
> > "Something to do with ElementAdder" (use after free?) is at least a start.
> > 
> > https://dxr.mozilla.org/mozilla-central/search?q=ElementAdder&=mozilla-
> > central&redirect=true
> 
> So far I have not been able to locate the webpage. I checked the event log
> and it shows the details posted in the text file. Had DEP been enabled for
> all programs through the System Protection settings in Windows, I may have
> more information.
> 
> The date was 06/16/2015 at 10:12PM. I have checked for corresponding events,
> but got nothing. Is there anything else I can door does this render this
> obsolete?

**Correction 04/16/15

Comment 5

[[e-mail]]

(In reply to Daniel Veditz [:dveditz] from comment #1)
> Do you have any of the content, a link to the video or which video it was,
> even just what website it was, anything like that?
> 
> Do you know if it was a Flash video or an "HTML 5" (browser) video? What
> version of Flash do you have? (you can find out from about:addons, the
> add-on manager page, or by visiting our site
> https://www.mozilla.org/en-US/plugincheck/ ).
> 
> This may be part of an exploit, but there's not much information here to
> figure out what Firefox flaw was used before it got to this point.
> "Something to do with ElementAdder" (use after free?) is at least a start.
> 
> https://dxr.mozilla.org/mozilla-central/search?q=ElementAdder&=mozilla-
> central&redirect=true

I need to email you regarding the issue (sensitive info). I will have to download Thunderbird I am assuming as the new release comes out tomorrow so that it is encypted.

Comment 6

[Reed Loden [:reed]]

(In reply to jd2978 from comment #5)
> I need to email you regarding the issue (sensitive info). I will have to
> download Thunderbird I am assuming as the new release comes out tomorrow so
> that it is encypted.

I just replied to your e-mail, but please just attach any information you have to this bug. If it's sensitive, we can mark it as private so that only trusted personnel can view it.

Comment 7

[[e-mail]]

Attachment: Attachment (Addtn'l info.txt) needs to be marked as private please

Additional information provided in new attachment (please see comments).

I do my best to keep all applications, browsers and plugins on my PC updated (Java is not installed either).

Anything else? Please send me an email.

Plugins installed at the time were: 

Adobe Flash Player
Shockwave Flash 17.0 r0	Up to Date
17.0.0.169

Nitro PDF plugin for Firefox and Chrome (v. 3.5.6.5)
Nitro PDF plugin for Firefox and Chrome	

Microsoft Office 2013 (v. 15.0.4703.1000)
The plugin allows you to have a better experience with Microsoft Lync	

Citrix Online Web Deployment Plugin 1.0.0.104 (v. 1.0.0.104)
Citrix Online App Detector Plugin	

Sticky Password (v. 8.0.3.33)
Autofill Engine for Gecko and Webkit-based web browsers	

Google Update (v. 1.3.26.9)
Google Update

Comment 8

[Matt Wobensmith [:mwobensmith][:matt:]]

We really appreciate that you have taken the time and effort to file these bugs. However, in order to act on them, we really need more information. 

What would really help us would be proper stack traces. You can generate those by using a debug build of Firefox, such as a Nightly debug build from here:

http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2015-05-13-mozilla-central-debug/

Can you try that? Upon hitting a crash, relaunch Firefox and type in "about:crashes" to see a list of links to submitted crash reports. Send us a link from a given incident and we will have a lot more information to go on. Thank you.

Comment 9

[[e-mail]]

Will work on it. Learned that I need to install WinDbg first (CmdPrompt started and crashed).

TO reproduce, it may require infection but I will try it in a VM. 

I understand you need dumps.

Comment 10

[[e-mail]]

(In reply to Matt Wobensmith from comment #8)
> We really appreciate that you have taken the time and effort to file these
> bugs. However, in order to act on them, we really need more information. 
> 
> What would really help us would be proper stack traces. You can generate
> those by using a debug build of Firefox, such as a Nightly debug build from
> here:
> 
> http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2015-05-13-mozilla-
> central-debug/
> 
> Can you try that? Upon hitting a crash, relaunch Firefox and type in
> "about:crashes" to see a list of links to submitted crash reports. Send us a
> link from a given incident and we will have a lot more information to go on.
> Thank you.

In attempting this, Nightly crashes each time upon opening, despite reinstall and deleting the old profile. It crashes with a ntdll error.

Comment 11

[[e-mail]]

I encountered another instance today. I was in InPrivateBrowsing, it did not create a dump file/crash report. IS there a way that I can safely browse the internet with at least good performance w/o getting infected or using a Nightly version on my single "Production" PC (for current college coursework). 

In a VM WinDbg would download 5.x MB worth of symbols (using the path for Mozilla and Microsoft symbol server from the MDN documentation).

I just attached another detection,against xul.dll, except this one is against JSTracer that is attacking the same or similar processes, except more sophisticated.

*A Google search does not reveal whether xul.dll is a component of Firefox, Core, JScript or Flash. Which is it?

The security program force closes it and terminates any malware in process (Force Closing Firefox, maybe that's why it's not dumping?)

Any other suggestions? 

*Should I invite the software developer to the bug or not? He may can provide dumps/traces*

Comment 12

[[e-mail]]

Attachment: HitManPro Alert Screenshot 5-25-15.jpg

Comment 13

[[e-mail]]

Attachment: HitManPro Alert Detection 5-25-15 0358 PM.txt

Comment 14

[Matt Wobensmith [:mwobensmith][:matt:]]

(In reply to [e-mail] from comment #11)

> *Should I invite the software developer to the bug or not? He may can
> provide dumps/traces*

Yes, please. Have them install the debug build and follow the steps to produce a crash report. We need a good stack and/or more data to go on. Thank you.

Comment 15

[Ryan VanderMeulen [:RyanVM]]

(In reply to [e-mail] from comment #11)
> *A Google search does not reveal whether xul.dll is a component of Firefox,
> Core, JScript or Flash. Which is it?

xul.dll is the core DLL of any Gecko-based product.

Comment 16

[Matt Wobensmith [:mwobensmith][:matt:]]

Hi there - this bug and others you've filed (bug 1162862, bug 1163948) require additional information, as requested in comment 8 and comment 14. Otherwise, we won't have any other choice but to resolve them, since we have little to work with.

Comment 17

[[e-mail]]

I just got this email. As in resolved you mean "close the ticket, and it was ruled negligible/unresolved?"

I will reach out to the developers of the software again, until they answer. I believe one of them was on leave/vacation.

Sorry for the delay. I'll forward the email to my main address.

Comment 18

[Matt Wobensmith [:mwobensmith][:matt:]]

(In reply to [e-mail] from comment #17)
> I just got this email. As in resolved you mean "close the ticket, and it was
> ruled negligible/unresolved?"

Without more information, they will be marked resolved/invalid or something similar.

Comment 19

[Matt Wobensmith [:mwobensmith][:matt:]]

Marking incomplete, not enough info.