296489 - chrome XBL allows arbitrary code execution

Status: RESOLVED DUPLICATE of bug 296397

(Core :: XBL, defect)

Description

[shutdown]

User-Agent:       Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Build Identifier: Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.7.8) Gecko/20050511 Firefox/1.0.4

Any non-privileged web pages can use XBL bindings stored in the
chrome directory (e.g. chrome://xbl-marquee/content/xbl-marquee.xml).
These XBL bindings expose some methods as its bound element's methods,
and and these methods expose the privileged Function() constructor.
Therefore, the attacker can execute arbitrary code with chrome privileges.

Reproducible: Always

Steps to Reproduce:
1. load the testcase.
2. follow "invoke an exploit" link.

Actual Results:  
The testcase alerts "[object nsXPCComponents_Classes]".


Expected Results:  
Permission denied to access Components.classes.

Comment 1

[shutdown]

Attachment: testcase

the testcase. works in firefox 1.0.4 and firefox trunk.
Mozilla/5.0 (Windows; U; Win98; en-US; rv:1.8b2) Gecko/20050602 Firefox/1.0+

Comment 2

[Boris Zbarsky [:bzbarsky]]

*** This bug has been marked as a duplicate of 296397 ***