239401 - nsIOService's |gBadPortList| does not cover all X11 ports

Status: RESOLVED WONTFIX

(Core :: Networking, defect)

Description

[Roland Mainz]

Looking at http://lxr.mozilla.org/mozilla/source/netwerk/base/src/nsIOService.cpp#87
-- snip --
 87 PRInt16 gBadPortList[] = { 
 88   1,    // tcpmux          
 89   7,    // echo     
 90   9,    // discard          
[snip]
140   4045, // lockd
141   6000, // x11        
142   0,    // This MUST be zero so that we can populating the array
143 };
-- snip --

This list contains port 6000 for X11 - which isn't the complete story.
X11 ports can at least cover ports 6000-6100, some implemenation can use ports
6000-6500 (remember that there is stuff like Xterminals, SunRays and Xprint
which reside on higer display numbers).

Comment 1

[Doug Turner (:dougt)]

marking sensitive.

Comment 2

[chris hofmann]

need more detail to understand the vulerability.

Comment 3

[Bradley Baetz (:bbaetz)]

I got the list from ns4.

Yes, X11 covers other ports. However, X11 is binary, so you'd need a very
specific type of buffer overflow to do anything....

I've very loath to add any extra ports for fear of breaking something, given all
the socks problems.

Unless someone can come up with a malicious URL which can affect X in some way,
that is.

Comment 4

[Daniel Veditz [:dveditz]]

The banned-port list isn't a secret, and binary X11 ports don't appear to be a
serious problem. Removing confidential flag.