299209 - (CVE-2005-2114) anonymous function expression statement => JS stack overflow [crash in js3250.dll + (0002c7d4)]

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect, P2)

Description

[chris hofmann]

full disclosure deinal of service crash reported to security

evilninja wrote: 
> > Kurczaba Associates Advisories schrieb: 
> > >> >>Date Discovered: June 14, 2005 


here is all that I was able to get out of talback...

Incident ID: 7098019
Stack Signature	js3250.dll + 0x2c7d4 (0x6010c7d4) e08bd997
Email Address	[e-mail]
Product ID	FirefoxTrunk
Build ID	2005062806
Trigger Time	2005-06-29 20:08:16.0
Platform	Win32
Operating System	Windows NT 5.1 build 2600
Module	js3250.dll + (0002c7d4)

Since Last Crash	29061 sec
Total Uptime	29061 sec
Trigger Reason	Access violation
Source File, Line No.	N/A
Stack Trace 	
js3250.dll + 0x2c7d4 (0x6010c7d4)

Comment 1

[chris hofmann]

mail from Paul Kurczaba 
paul at kurczaba.com

Mozilla Team,

We have found a security vulnerability that affects the following Mozilla
applications:
-Mozilla 1.7.8
-Firefox 1.0.4
-Camino 0.8.4

Details:
By using a specially crafted JavaScript function, it is possible to crash the
above named browsers. The script can be executed both with and without user
intervention.

The JavaScript Code:
The following Javascript code is what causes the browsers to crash:

for (a = 0; a <= 10000; a++)
{
   function(){("");}
}

Proof of Concept:
A proof-of-concept example of this vulnerability can be found at:
http://www.kurczaba.com/html/security/unpublished/crash_mozilla.htm

Credit:
Paul and Arnie Kurczaba

Comment 2

[Brendan Eich [:brendan]]

This is a very old bug -- it dates to ECMA-262 Edition 3 work in 1999.  It's not
exploitable.  I'll fix tomorrow.

/be

Comment 3

[Bob Clary [:bc] (inactive)]

Checking in regress-299209.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-299209.js,v  <--  regress-299209.js
initial revision: 1.1

Comment 4

[Daniel Veditz [:dveditz]]

Timeless was looking into this today as well, and some guy came on IRC claiming
it was exploitable but offered no demonstration.

Comment 5

[Brendan Eich [:brendan]]

(In reply to comment #4)
> Timeless was looking into this today as well, and some guy came on IRC claiming
> it was exploitable but offered no demonstration.

That's nice.

It's a JS interpreter stack overflow.  There's no way to forge object references
from script, so I doubt this IRC claim.  Reading garbage from beyond the current
stack chunk might lead to crashes, but not to controlled execution.

/be

Comment 6

[Brendan Eich [:brendan]]

Writing beyond the current stack chunk might corrupt the malloc heap.  That's
not inherently exploitable AFAIK.

If someone (jackerror on IRC is working on it) does come up with an exploit,
please mail me and [e-mail], or even the [e-mail]
mailing list, so we can mark this bug "security sensitive" to restrict access to
it, *then* the exploit can be attached to this bug, and we can award a bounty to
the person demonstrating the exploit.

/be

Comment 7

[Brendan Eich [:brendan]]

Attachment: fix

Simple and direct.

/be

Comment 8

[Mike Shaver (:shaver emeritus)]

Comment on attachment 187857 [details] [diff] [review]
fix

r=shaver.

Comment 9

[Brendan Eich [:brendan]]

Fixed on trunk.  Fix is needed on the branches too.

/be

Comment 10

[Jay Patel [:jay]]

Comment on attachment 187857 [details] [diff] [review]
fix

Brendan, let's get this checked in on the branches as well. a=jay

Comment 11

[Brendan Eich [:brendan]]

Checked appropriately back-ported patch into branches.

/be

Comment 12

[Bob Clary [:bc] (inactive)]

syntax error on trunk and 1.0.5 and no crash.
Error: syntax error
Source File: http://www.kurczaba.com/html/security/unpublished/crash_mozilla.htm
Line: 48, Column: 11
Source Code:
			function(){};

Comment 13

[Bob Clary [:bc] (inactive)]

updated test to reflect expected syntax error
Checking in regress-299209.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-299209.js,v  <--  regress-299209.js
new revision: 1.2; previous revision: 1.1
done

Comment 14

[Erik Fabert]

Bob, your new test doesn't crash without the patch. You have to eval() the 
complete for loop.

Comment 15

[Bob Clary [:bc] (inactive)]

(In reply to comment #14)

Erik, thanks. I tested it and saw a crash in 1.0.4 but must have executed the
old version from the cache. fscking firefox cache. 

Checking in regress-299209.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-299209.js,v  <--  regress-299209.js
new revision: 1.3; previous revision: 1.2
done

Comment 16

[Bob Clary [:bc] (inactive)]

really fixed this time. new revision: 1.4; previous revision: 1.3

Comment 17

[Bob Clary [:bc] (inactive)]

this causes the following failures in the js test suite:

ecma_3/Statements/regress-194364.js: sections 1, 3, 5, 7, 9
js1_5/Regress/regress-224956.js: section 29

was that intentional and the tests need to be changed?

Comment 18

[Brendan Eich [:brendan]]

(In reply to comment #17)
> this causes the following failures in the js test suite:
> 
> ecma_3/Statements/regress-194364.js: sections 1, 3, 5, 7, 9
> js1_5/Regress/regress-224956.js: section 29
> 
> was that intentional and the tests need to be changed?

From ECMA-262 Edition 3, 12.4:

12.4 Expression Statement

Syntax
ExpressionStatement : [lookahead not in {{, function}] Expression ;

Note that an ExpressionStatement cannot start with an opening curly brace
because that might make it ambiguous with a Block. Also, an ExpressionStatement
cannot start with the function keyword because that might make it ambiguous with
a FunctionDeclaration.

/be

Comment 19

[Daniel Veditz [:dveditz]]

Marking security sensitive because we have been sent a testcase that proves this
is exploitable.

Comment 20

[Brendan Eich [:brendan]]

Attachment: [e-mail]'s full exploit doc and code

Sauron (jackerror on IRC) contacted me last week about this bug, and worked
hard to develop an exploit.  I recommend he get a bug bounty for his work, and
I would like to encourage him to file other security-sensitive bugs with
bugzilla.mozilla.org as soon as possible, so he can claim priority and win more
bounties.  He asked that I include his wishes here:

----- begin quote -----
Brendan,

Yes you can attach the exploitation.txt to the bug, Yes I have a bugzilla login
([e-mail]).  As I told to Daniel Veditz, I don't want the exploit to be
made public at anytime, even when a fixed version of mozilla will be available.
The bug take time to exploit because it is located in some part of the code one
as to take the time to understand before being able to do anything. Probably
nobody will code such an exploit and make it public, and I don't want mine to
be made public, I hate to provide destructive tools to clueless people who will
use it to annoy OpenSource users whose main purpose is not security.

Anyway, please can you just put a note about this when attaching the file to
the bug in the bugzilla ?

Thanks
-----end quote-----

I'm not sure how to arrange to *never* disclose his exploit without never
removing the security-sensitive flag from this bug, or else stripping this
attachment via bugzilla database hacks behind the scenes, before removing the
access restriction on this bug.  I'll leave it to dveditz to negotiate a
mutually satisfactory solution with sauron.

/be

Comment 21

[timeless]

*** Bug 299816 has been marked as a duplicate of this bug. ***

Comment 22

[Daniel Veditz [:dveditz]]

Adding distributors

Comment 23

[Brendan Eich [:brendan]]

*** Bug 300955 has been marked as a duplicate of this bug. ***

Comment 24

[Josh Bressers]

Dan,

Is there a reason there is no Mozilla Foundation Security advisory for this issue?

Comment 25

[Brendan Eich [:brendan]]

Josh: see the status whiteboard.

/be

Comment 26

[Mike Shaver (:shaver emeritus)]

Do we need to open this bug to issue an advisory?  We often embargo bug details,
and say so in the advisory text.

Comment 27

[Josh Bressers]

Brendan,

I understand we have to scrub the attachment, but it's not uncommon to release
an MFSA without opening up the bug until a later date.

Comment 28

[Josh Bressers]

Additionally, this issue is CAN-2005-2114.  MITRE has it classified as simply a
DoS right now.  When this issue goes public I'll make sure they update their
description.

Comment 29

[Brendan Eich [:brendan]]

Josh: oh, sorry -- then dveditz should comment, since he updates the known
vulnerabilities page.

/be

Comment 30

[Bob Clary [:bc] (inactive)]

Checking in ecma_3/Statements/regress-194364.js;
/cvsroot/mozilla/js/tests/ecma_3/Statements/regress-194364.js,v  <-- 
regress-194364.js
new revision: 1.4; previous revision: 1.3
done
Checking in js1_5/Regress/regress-224956.js;
/cvsroot/mozilla/js/tests/js1_5/Regress/regress-224956.js,v  <--  regress-224956.js
new revision: 1.7; previous revision: 1.6
done

Comment 31

[Josh Bressers]

Are there any plans to open this bug up to the public?

Comment 32

[timeless]

No. there should be no such plans. not without removing at least the attachment.

comment 20 is perfectly clear on that point.

Comment 33

[Daniel Veditz [:dveditz]]

This appears to be CVE-2005-2114