538310 - (CVE-2010-0177) PluginArray nsMimeType Dangling Pointer Vulnerability (ZDI-CAN-655)

Status: RESOLVED FIXED

(Core Graveyard :: Plug-ins, defect)

Description

[Brandon Sterne (:bsterne)]

ZDI-CAN-655: Mozilla Firefox PluginArray nsMimeType Dangling Pointer Vulnerability

-- ABSTRACT ------------------------------------------------------------

TippingPoint has identified a vulnerability affecting the following  products:

    Mozilla Firefox 3.5.x

-- VULNERABILITY DETAILS -----------------------------------------------

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Mozilla Firefox. User interaction is required to exploit this vulnerability in that a user must be coerced to viewing a malicious document.



The specific flaw exists within the way the application implements the window.navigator.plugins array. Due to the application freeing the contents of the array while a reference to one of the elements is still being used, an attacker can utilize the free reference to call arbitrary code. Successful exploitation can lead to code execution under the context of the application.

The particular vulnerability occurs within the window.navigator.plugins array. This array is implemented within dom/src/base/nsPluginArray.cpp. Each element of this array contains a reference to the mime types installed by that particular plugin.



Upon page reload, the plugin array will reallocate all of it's members without explictly checking the used reference count of each member. If an attacker grabs a reference out of the array, and causes the page to reload itself, the attacker will then have a variable that references data that has been freed by the page refresh.



The mPlugin property contains the reference to the plugin that will get freed.



dom/src/base/nsMimeTypeArray.cpp:304

NS_IMETHODIMP

nsMimeType::GetEnabledPlugin(nsIDOMPlugin** aEnabledPlugin)

{

  nsAutoString type;

  GetType(type);



  PRBool disabled = PR_FALSE;



  if (type.Length() == 1 && type.First() == '*') {

    // Check if the default plugin is disabled.

    disabled =
nsContentUtils::GetBoolPref("plugin.default_plugin_disabled");

  }



  *aEnabledPlugin = disabled ? nsnull : mPlugin;        // XXX: mPlugin



  NS_IF_ADDREF(*aEnabledPlugin);



  return NS_OK;

}



Only place that modifies mPlugin property.

nsMimeType::nsMimeType(nsIDOMPlugin* aPlugin, nsIDOMMimeType*
aMimeType)

{

  mPlugin = aPlugin;       // XXX

  mMimeType = aMimeType;

}



For each plugin, allocate the mime type associated with it.

dom/src/base/nsPluginArray.cpp:405

nsresult

nsPluginElement::GetMimeTypes()

{

  nsresult rv = mPlugin->GetLength(&mMimeTypeCount);

  if (rv == NS_OK) {

    mMimeTypeArray = new nsIDOMMimeType*[mMimeTypeCount];

    if (mMimeTypeArray == nsnull)

      return NS_ERROR_OUT_OF_MEMORY;

    for (PRUint32 i = 0; i < mMimeTypeCount; i++) {

      nsCOMPtr<nsIDOMMimeType> mimeType;

      rv = mPlugin->Item(i, getter_AddRefs(mimeType));

      if (rv != NS_OK)

        break;

      mimeType = new nsMimeType(this, mimeType);    // XXX: /this/
contains our dangling reference

      NS_IF_ADDREF(mMimeTypeArray[i] = mimeType);

    }

  }

  return rv;

}



Reload the entire plugin array

dom/src/base/nsPluginArray.cpp:199

NS_IMETHODIMP

nsPluginArray::Refresh(PRBool aReloadDocuments)

{

  nsresult res = NS_OK;

  if (!AllowPlugins())

    return NS_SUCCESS_LOSS_OF_INSIGNIFICANT_DATA;



Delete every element of an nsPluginArray

dom/src/base/nsPluginArray.cpp:236

  if (mPluginArray != nsnull) {

    for (PRUint32 i = 0; i < mPluginCount; i++) 

      NS_IF_RELEASE(mPluginArray[i]);               // XXX



    delete[] mPluginArray;

  }





Version(s)  tested: FireFox 3.5.6

Platform(s) tested: Windows XP SP3



-- CREDIT --------------------------------------------------------------

This vulnerability was discovered by:
    * regenrecht

Comment 1

[Reed Loden [:reed]]

Did TippingPoint provide a testcase?

Comment 2

[Brandon Sterne (:bsterne)]

No, they didn't.  I'll see if they have one.

Comment 4

[Olli Pettay [:smaug][[e-mail]]]

Attachment: simple fix

This is the smallest fix I could think of.
On trunk we should convert all those raw arrays to nsCOMArray or
nsTArray.
I also filed a followup bug 544875.

Comment 5

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/mozilla-central/rev/0068be501633

Comment 6

[Daniel Veditz [:dveditz]]

Comment on attachment 425799 [details] [diff] [review]
simple fix

Approved for 1.9.2.2, 1.9.1.9 and 1.9.0.19, a=dveditz for release-drivers

Comment 7

[Mike Beltzner [:beltzner, not reading bugmail]]

Are we waiting on anything for landing these?

Comment 8

[Olli Pettay [:smaug][[e-mail]]]

Nope. I'll land this tomorrow.

Comment 9

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/releases/mozilla-1.9.1/rev/12ca3582430b

Comment 10

[Olli Pettay [:smaug][[e-mail]]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/591039ba50fa

Comment 11

[Al Billings [:abillings - ex-MoCo]]

Verified for 1.9.0 using PoC with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.19pre) Gecko/2010031106 GranParadiso/3.0.19pre (.NET CLR 3.5.30729). 

Verified for 1.9.1 with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.9pre) Gecko/20100311 Shiretoko/3.5.9pre (.NET CLR 3.5.30729).

Verified for 1.9.2 with Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.2pre) Gecko/20100311 Namoroka/3.6.2pre (.NET CLR 3.5.30729).