Closed Bug 650252 (CVE-2011-2981) Opened 13 years ago Closed 13 years ago

Universal XSS using setTimeout

Categories

(Core :: Security, defect)

Product:
Core
Component:
Security
Version:
1.9.2 Branch
Platform:
x86
Windows XP
Type:
defect
Priority:
Not set
Severity:
normal

Tracking

()

Status:
VERIFIED FIXED
Tracking Flags:
Tracking Status
firefox5 --- unaffected
firefox7 - unaffected
firefox8 - unaffected
firefox9 - unaffected
firefox10 - unaffected
blocking2.0 --- -
status2.0 --- wanted
blocking1.9.2 --- .20+
status1.9.2 --- .20-fixed
blocking1.9.1 --- needed
status1.9.1 --- wanted

People

(Reporter: moz_bug_r_a4, Assigned: mrbkap)

References

Details

(Whiteboard: [sg:high]) 

By loading a target page in the middle of nsJSContext::CallEventHandler, it's
possible to perform an XSS attack.

On trunk, this is fixed by bug 614151 and bug 643450.
Attached file testcase 1 (1.9.x) — 
This tries to get cookies for www.mozilla.com.
This works on 1.9.2/1.9.1 branches.

This is fixed by bug 614151 on trunk and 2.0.
This uses bug 344495's trick.
This tries to get cookies for www.mozilla.com.
This works on 2.0 and 1.9.2/1.9.1 branches.

This is fixed by bug 643450 on trunk.

Note: this crashes 2.0 debug build, and the crash problem is fixed by bug
642022 on trunk.
blocking1.9.1: --- → ?
blocking1.9.2: --- → ?
blocking2.0: --- → ?
Whiteboard: [sg:high]
blocking1.9.1: ? → needed
blocking1.9.2: ? → .18+
status1.9.1: --- → wanted
status1.9.2: --- → wanted
status2.0: --- → wanted
Depends on: 614151, 643450, 642022
--> mrbkap who fixed the bugs that fixed this on trunk.
Assignee: nobody → mrbkap
blocking2.0: ? → -
status-firefox5: --- → unaffected
Summary: XSS using setTimeout → Universal XSS using setTimeout
bug 614151 and bug 643450 have 1.9.2 versions of their respective patches ready to be checked in except for a stamp. I guess they'll get stamped tomorrow?
blocking1.9.2: .18+ → .19+
(In reply to comment #4)
> bug 614151 and bug 643450 have 1.9.2 versions of their respective patches
> ready to be checked in except for a stamp. I guess they'll get stamped
> tomorrow?

Which they got for 1.9.2.18 and never landed... Please get these into 1.9.2.20
Version: unspecified → 1.9.2 Branch
Fixed by checkins to the 1.9.2 branch for bug 614151 and bug 643450.
Status: NEW → RESOLVED
Closed: 13 years ago
status1.9.2: wanted → .20-fixed
Resolution: --- → FIXED
Alias: CVE-2011-2981
Both of the attached testcases are fixed in 1.9.2.20 build 1 (Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.7; en-US; rv:1.9.2.20) Gecko/20110803 Firefox/3.6.20).
Status: RESOLVED → VERIFIED
blocking1.9.2: .20+ → .21+
status1.9.2: .20-fixed → .21-fixed
Don't know how the versions got bumped, but there were already shipped and announced in MFSA 2011-30
blocking1.9.2: .23+ → .20+
status1.9.2: .23-fixed → .20-fixed
Group: core-security
You need to log in before you can comment on or make changes to this bug.