1393624 - (CVE-2017-7825) Domain spoofing thanks to U+0620 ARABIC LETTER rendered as 'space' on Mac OS

Status: RESOLVED FIXED

(Firefox :: Address Bar, defect)

Description

[Khalil Zhani]

Attachment: Screen Shot 2017-08-24 at 23.31.13.png

After reporting issue 1390980 which is fixed in version 57.0a1 Nightly, we have found another character (https://www.compart.com/en/unicode/U+0620) looks like a 'space' on Mac OS

http://important-domain.google.com.xn--fgbaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.bntk.pl/

Comment 1

[Khalil Zhani]

Note: I tested this with macOS X El Capitan 10.11.6

Comment 2

[Jonathan Kew [:jfkthame]]

Looks like this is another character where some of Apple's Chinese fonts (STSong / Songti) incorrectly have a blank glyph.

The same issue also applies to the extended Arabic-script characters 06EE, 06EF and 06FF. And to some (mostly unassigned) Tibetan-block characters: 0F6D 0F6E 0F6F 0F70 0F98 0FBD 0FCD 0FD9..0FFF. (Based on checking the Songti fonts on macOS 10.12.)

This really is an Apple bug, not a Firefox issue, but I guess we can add all these to the exclusion list in gfxMacPlatformFontList.

Comment 3

[Gervase Markham [:gerv]]

jfkthame: have we now gone through all the suspect fonts and blacklisted every character which is encoded as a space?

Gerv

Comment 4

[Jonathan Kew [:jfkthame]]

(In reply to Gervase Markham [:gerv] from comment #3)
> jfkthame: have we now gone through all the suspect fonts and blacklisted
> every character which is encoded as a space?

Not really; that's rather an open-ended project. I found a bunch more in the STSong fonts (comment 2 above), but this may not be exhaustive.

There could easily be additional fonts that have such flaws, but just haven't come to anyone's attention yet. And fonts change with every new OS release... existing fonts are updated, and entirely new fonts may be shipped. In general, of course, we hope that errors are fixed in new releases rather than new ones introduced, but there are no guarantees.

Comment 5

[Jonathan Kew [:jfkthame]]

(In reply to Jonathan Kew (:jfkthame) from comment #2)
> Looks like this is another character where some of Apple's Chinese fonts
> (STSong / Songti) incorrectly have a blank glyph.
> 
> The same issue also applies to the extended Arabic-script characters 06EE,
> 06EF and 06FF.

And 065F.

Comment 6

[Jonathan Kew [:jfkthame]]

Attachment: Blacklist more invalid characters found in Apple's fonts

This adds all the characters mentioned above (plus a few more I found when trawling through the Songti fonts) to our blacklist.

Comment 7

[Khalil Zhani]

I think this is Medium severity based on bug 1390980.

Comment 8

[Jonathan Kew [:jfkthame]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/a87b382c21353cb3d8c3f05a87a435bd9bd0901d

Comment 9

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/a87b382c2135

Comment 10

[Ryan VanderMeulen [:RyanVM]]

I assume we'll want to backport this to Beta/ESR52 as well.

Comment 11

[Jonathan Kew [:jfkthame]]

Comment on attachment 8903080 [details] [diff] [review]
Blacklist more invalid characters found in Apple's fonts

[Approval Request Comment]
If this is not a sec:{high,crit} bug, please state case for ESR consideration:
Not really a Gecko bug, this is a workaround for a buggy Apple font with spurious blank characters that might be used to obscure a spoofed URL.

User impact if declined:
Potential for URL spoofing due to invalid characters in a Chinese font on macOS

Fix Landed on Version: 57

Risk to taking this patch (and alternatives if risky): minimal

String or UUID changes made by this patch: none

Comment 12

[Gerry Chang [:gchang]]

Comment on attachment 8903080 [details] [diff] [review]
Blacklist more invalid characters found in Apple's fonts

Avoid potential for URL spoofing. Beta56+ & ESR52+.

Comment 13

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-beta/rev/fe4bfcfc5db2
https://hg.mozilla.org/releases/mozilla-esr52/rev/db3e2bfb7aa7

Comment 14

[Daniel Veditz [:dveditz]]

Note this bug (and the similar Tibetan ones) also affect Safari, as one would expect since this is a Mac font bug.

Comment 15

[Daniel Veditz [:dveditz]]

We're going to pay a reduced bounty for this one because we've paid before, but we can't afford to be Apple's Bug Bounty program so this will have to be the last one for these bugs that 1) are due to bad Apple fonts, and 2) also affect Safari.

Comment 16

[Khalil Zhani]

See also https://bugs.chromium.org/p/chromium/issues/detail?id=725660 reproted to Chromium.