333394 - [1.0.8] "Set as wallpaper" arbitrary execution using <object> src property

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[Daniel Veditz [:dveditz]]

Spun off from bug 333305, see bug 333305 comment 8 and testcase in attachment 217800 [details] (full credit to moz_bug_r_a4 here).

The regression bug 333305 didn't introduce this security hole, the security hole exists in firefox 1.0.7 and presumably mozilla 1.7.12. The regressions from the fix for bug 293527 had the side-effect of "fixing" this security hole, but as we've fixed those regressions the original broken state was restored.

This is a variant on bug 292737, using an image <object> with a spoofed content-supplied .src property to get around the fix in that bug. In 1.8 this exploit is prevented by "shared wrappers" which will not let chrome access the content-defined .src property.

Comment 1

[moz_bug_r_a4]

(In reply to comment #0)
> the security hole exists in firefox 1.0.7 and presumably mozilla 1.7.12.

Mozilla suite is not affected by "Set As Wallpaper" attack, since Mozilla suite
does not use "setWallpaper.xul".
http://lxr.mozilla.org/mozilla1.7/source/xpfe/communicator/resources/content/nsContextMenu.js#615

Comment 2

[Daniel Veditz [:dveditz]]

Attachment: make <object> work as wallpaper

Comment 3

[Daniel Veditz [:dveditz]]

Attachment: prevent <object> wallpaper

Alternate patches, both prevent this problem. This second patch simply bails out for <object> images -- prevents the exploit, and no loss of functionality since bugs prevented them from being used as wallpaper anyway.

The first patch reads the correct data attribute for <object> images. This also stops the exploit, but adds functionality over 1.0.7 (though intended functionality).

Comment 4

[:Gavin Sharp [email: [e-mail]]]

Attachment: patch from bug 333305

This was given r+sr+a and landed as part of bug 333305, attaching here for reference.

Comment 5

[:Gavin Sharp [email: [e-mail]]]

Here's a bonsai link for the checkins fixing this bug:
http://bonsai.mozilla.org/cvsquery.cgi?branch=&branchtype=match&who=gavin%25gavinsharp.com&whotype=match&date=explicit&mindate=2006-04-10+12%3A33&maxdate=2006-04-10+12%3A35