554449 - (CVE-2010-3773) Fix in bug 504021 can be circumvented

Status: RESOLVED FIXED

(Core :: XPConnect, defect)

Description

[moz_bug_r_a4]

In nsXPCWrappedJSClass::CallMethod, JS_GetMethod is called before pushing a
principal, and XPCConvert::JSData2Native is called after popping the principal.

On 1.9.0, in nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject,
OBJ_GET_PROPERTY is called before pushing a principal.

1.9.0 is exploitable by bug 504021.  (On trunk/1.9.2/1.9.1, bug 504021 was
fixed by bug 503926.)

A testcase for bug 554448 (which is trunk-only) depends on this bug.

Comment 1

[moz_bug_r_a4]

Attachment: testcase (requires Firebug)

This uses bug 344495's trick.

This works on fx3.0.19 candidate.

Comment 2

[Daniel Veditz [:dveditz]]

Comment on attachment 434347 [details]
testcase (requires Firebug)

What is the Firebug pattern you're abusing here? Something we're likely to see in other add-ons?

Comment 3

[moz_bug_r_a4]

(In reply to comment #2)
> (From update of attachment 434347 [details])
> What is the Firebug pattern you're abusing here? Something we're likely to see
> in other add-ons?

Please see bug 504021 comment 0.  Add-ons that access content xhr.on* could be
exploitable on 1.9.0.

Comment 4

[Jesse Ruderman]

1.9.0.x branch is EOL.

Comment 5

[moz_bug_r_a4]

Ah, I intended this bug to cover trunk and all branches.  Patches for trunk and
all branches in bug 504021 have flaws I described in the first paragraph of
comment 0.

Comment 6

[Damon Sicore (:damons)]

Blake, can we get an ETA here?

Comment 7

[Blake Kaplan (:mrbkap) (inactive)]

Attachment: Proposed fix

Comment 8

[Blake Kaplan (:mrbkap) (inactive)]

And note: that patch is m-c only... Older branches that call QI on content objects will need more patching.

Comment 9

[Blake Kaplan (:mrbkap) (inactive)]

http://hg.mozilla.org/mozilla-central/rev/87ceb85b85df

Comment 10

[Daniel Veditz [:dveditz]]

Blake: you said this was "more involved" on the branches so now would be a good time to start working on it for the next set of releases.

Comment 11

[Blake Kaplan (:mrbkap) (inactive)]

Comment on attachment 440367 [details] [diff] [review]
Proposed fix

This actually applies as-is to these two branches. I must have been confusing this bug with another one.

Comment 12

[Blake Kaplan (:mrbkap) (inactive)]

(that being said, I'm having trouble reproducing the exploit on my 1.9.2 tree, I wonder if a change in Firebug is masking the problem)

Comment 13

[LegNeato]

Comment on attachment 440367 [details] [diff] [review]
Proposed fix

a=LegNeato for 1.9.2.13 and 1.9.1.16. Please submit by the end of today PST.

Comment 14

[moz_bug_r_a4]

(In reply to comment #12)
> (that being said, I'm having trouble reproducing the exploit on my 1.9.2 tree,
> I wonder if a change in Firebug is masking the problem)

The testcase in this bug worked only on 1.9.0 branch.

Please see bug 560466.  A testcase in bug 560466 depends on this bug.

Comment 15

[Reed Loden [:reed]]

http://hg.mozilla.org/releases/mozilla-1.9.2/rev/81f0ff4d3cbb
http://hg.mozilla.org/releases/mozilla-1.9.1/rev/eab9c1dd1f17

Comment 16

[Mike Hommey [:glandium]]

Attachment: Backport for 1.9.0

So, interestingly, this backport does fix bug 560466, but not this one. Am I missing something?

Comment 17

[Johnny Stenback (:jst)]

Comment on attachment 496155 [details] [diff] [review]
Backport for 1.9.0

Looks good to me, but mrbkap should have a look as well, and may know why this may not fix this bug but fixes bug 560466.

Comment 18

[moz_bug_r_a4]

(In reply to comment #16)
> So, interestingly, this backport does fix bug 560466, but not this one. Am I
> missing something?

1.9.0 needs to fix nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject (or fix
bug 503926) to stop the testcase in this bug.

Comment 19

[Mike Hommey [:glandium]]

(In reply to comment #18)
> 1.9.0 needs to fix nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject (or fix
> bug 503926) to stop the testcase in this bug.

Applying the patch from bug 503926 fixes the issue, indeed. What is strange is that bug 503926 was supposed to be required to fix CVE-2010-0179 (bug 504021), which was fixed in 1.9.0.19, but bug 503926 isn't in 1.9.0.19.

Comment 20

[moz_bug_r_a4]

Please see bug 504021 comment #19, #55, #56.  The 1.9.0 patch modified 
nsXPCWrappedJSClass::CallQueryInterfaceOnJSObject instead of fixing bug 503926.

Comment 21

[Al Billings [:abillings - ex-MoCo]]

Blake gave this a superreview+ on January 29, 2012. Are we doing something further with this bug?

Comment 22

[:Ms2ger (he/him; ⌚ UTC+1/+2)]

Apart from not refreshing the bug and moving it to another component? :)

Comment 23

[Al Billings [:abillings - ex-MoCo]]

Damn it. This is the second time that this has happened. I'm blaming some interaction of Nightly and Bugzilla here. I certainly didn't specifically select any components to change.