Last Comment Bug 680880 - (CVE-2011-3647) Security problem with loadSubScript on 1.9.2 branch
: Security problem with loadSubScript on 1.9.2 branch
[sg:critical][qa!] patch in bug 653926
: verified-aurora, verified-beta
Product: Core
Classification: Components
Component: Security (show other bugs)
: 1.9.2 Branch
: x86 Windows XP
-- normal (vote)
: ---
Assigned To: Blake Kaplan (:mrbkap)
: David Keeler [:keeler] (use needinfo?)
Depends on: CVE-2011-3004
Blocks: 678924
  Show dependency treegraph
Reported: 2011-08-22 06:19 PDT by moz_bug_r_a4
Modified: 2012-01-19 10:28 PST (History)
9 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Description User image moz_bug_r_a4 2011-08-22 06:19:19 PDT
On 1.9.2, using loadSubScript with a content object as the scope object is
potentially unsafe.

On 1.9.2, the parent chain of XPCNativeWrapper/SJOW reaches to a content
window, thus the subscript can directly access content objects.

For example:
* An object created in the subscript is not a SJOW.
* When the scope object is an XPCNativeWrapper, "document" is not an XPCNativeWrapper.
  in subscript:
  window.toString() -> [object XPCNativeWrapper [object Window]]
  window.document.toString() -> [object XPCNativeWrapper [object HTMLDocument]]
  document.toString() -> [object HTMLDocument]
Comment 1 User image moz_bug_r_a4 2011-08-22 06:21:50 PDT
Created attachment 554841 [details]
test extension
Comment 2 User image moz_bug_r_a4 2011-08-22 06:23:22 PDT
Created attachment 554842 [details]
testcase - arbitrary code execution

This works in Firefox 3.6.20 (and 5, 6, 7 due to bug 653926).
Comment 3 User image Daniel Veditz [:dveditz] 2011-08-26 10:23:33 PDT
Hopefully Firefox 7 and later are fixed by bug 653926 but setting it to track those releases to make sure.

mrbkap: is there anything in the fix for bug 653926 that can be applied to the 1.9.2 branch or do you have to come up with something else? Or is fixing it even possible?
Comment 4 User image Johnny Stenback (:jst, 2011-09-01 13:35:54 PDT
qa, can we get help verifying that this is fixed for 7 and beyond? Please see previous comment.
Comment 5 User image Marcia Knous [:marcia - use ni] 2011-09-08 13:56:14 PDT
moz_bug: Can you help QA with verification steps? I installed the extension but it is unclear what we are supposed to see. Thanks.
Comment 6 User image moz_bug_r_a4 2011-09-09 14:23:53 PDT
Steps to reproduce:
1. Install "test extension".
2. Load the testcase.
3. Click "test" button on the top of the browser's toolbox.
a) If the bug is not fixed, an alert dialog that shows Components.stack will
b) If the bug is fixed by bug 653926, the Error Console shows "Security Error:
   Content at ... may not load or link to chrome:...".
Comment 7 User image Johnny Stenback (:jst, 2011-09-22 13:08:46 PDT
Not tracking this for 7 any more. Marcia, can you get someone to verify this one? Thanks!
Comment 8 User image Marcia Knous [:marcia - use ni] 2011-09-22 14:21:09 PDT
Mozilla/5.0 (Windows NT 5.1; rv:9.0a1) Gecko/20110920 Firefox/9.0a1,
Mozilla/5.0 (Windows NT 5.1; rv:8.0a2) Gecko/20110921 Firefox/8.0a2,
Mozilla/5.0 (Windows NT 5.1; rv:7.0) Gecko/20100101 Firefox/7.0 (Firefox Beta 6 build)

In all 3 builds I do not get the alert dialog, but I get Error: uncaught exception: [Exception... "Component returned failure code: 0x80004005 (NS_ERROR_FAILURE) [nsIDOMLocation.assign]"  nsresult: "0x80004005 (NS_ERROR_FAILURE)"  location: "JS frame :: chrome://lss-content-test2/content/sub.js :: <TOP_LEVEL> :: line 2"  data: no] in the console. So this looks good from a verification perspective.
Comment 9 User image Johnny Stenback (:jst, 2011-10-27 21:53:18 PDT
For 1.9.2 this should be fixed by bug 653926.
Comment 10 User image Blake Kaplan (:mrbkap) 2011-10-31 15:59:27 PDT
See bug 653926.
Comment 11 User image Huzaifa Sidhpurwala 2011-11-07 21:48:00 PST
Based on the above comment, does it imply that this bug is a duplicate of 653926?
But 653926 has a different CVE id?
Comment 12 User image Huzaifa Sidhpurwala 2011-11-07 21:51:44 PST
Ah, sorry i think i missed comment #10, for 1.9.2 the issue is fixed in bug 653926
Comment 13 User image Tracy Walker [:tracy] 2011-12-05 08:52:55 PST
verified on 8, 9 and 10

Note You need to log in before you can comment on or make changes to this bug.