770431 - Arbitrary code execution using bug 768101 and bug 770429

Status: RESOLVED FIXED

(Core :: Security, defect)

Description

[moz_bug_r_a4]

By using bug 768101's trick, content can take advantage of bug 770429 and perform a privilege escalation attack without user interaction.

Comment 1

[moz_bug_r_a4]

Attachment: testcase

This works on fx10-16.

Comment 2

[Bobby Holley (:bholley)]

Presumably, this will be fixed with my fix for bug 770431 (the actual patches are in bug 760109).

Comment 3

[David Bolter [:davidb] (NeedInfo me for attention)]

Assigning to Bobby for book keeping and double checking the fix.

Comment 4

[Daniel Veditz [:dveditz]]

Did those changes end up fixing this problem?

Comment 5

[Al Billings [:abillings - ex-MoCo]]

The testcase doesn't seem to do much on my OS X machine with Firefox 14.0.1 or current nightly. I get a blank iframe on a page.

Comment 6

[Alex Keybl [:akeybl]]

Let's wait for this to be fixed on trunk before tracking for a specific ESR version again.

Bobby - can you try to see if you have better luck than Al?

Comment 7

[Alex Keybl [:akeybl]]

Oh nevermind, bug 760109 has an approval request. We'll leave this at 15+.

Comment 8

[Lukas Blakk [:lsblakk] use ?needinfo]

bug 760109 is landed in 15 and ESR 10.0.7 (15+) but there's still some work here for bug 768101 coming for 16 so bumping up the esr tracking flag for the next release.

Comment 9

[Daniel Veditz [:dveditz]]

This may now be fixed in Firefox 18 since bug 768101 might be. This testcase probably no longer works (I get Error: Access to 'chrome://browser/content/browser.xul' from script denied) because bug 770429 was fixed.

I guess we might as well call this fixed and if there are unfixed variations they can go into new bugs.

Comment 10

[Daniel Veditz [:dveditz]]

calling this fixed in 15 because it's using 768101 to abuse bug 770429, and that was fixed in 15.