Bug 883165 (CVE-2013-1715)

Medium integrity DLL Hijacking - Firefox Full installer and Stub installer

VERIFIED FIXED in Firefox 23

Status

()

Toolkit
NSIS Installer
VERIFIED FIXED
4 years ago
5 months ago

People

(Reporter: rstrong, Assigned: rstrong)

Tracking

({csectype-priv-escalation, sec-moderate})

unspecified
mozilla24
x86_64
Windows 7
csectype-priv-escalation, sec-moderate
Points:
---
Dependency tree / graph
Bug Flags:
in-testsuite -

Firefox Tracking Flags

(firefox21 wontfix, firefox22+ wontfix, firefox23+ verified, firefox24+ verified, firefox-esr17- wontfix, b2g18 unaffected)

Details

(Whiteboard: [adv-main23+][include 811557 in this advisory])

Attachments

(2 attachments)

+++ This bug was initially created as a clone of Bug #811557 which was initially created as a clone of Bug #792106 +++

Specifically (from bug 811557 comment #42)
Windows 8 x64:
C:\Windows\SysWOW64\oleacc.dll <- CMD.EXE was launched in MEDIUM integrity

Windows XP Pro SP2 x64:
C:\WINDOWS\SysWOW64\apphelp.dll <- Several CMD.EXE where launched (not sure what integrity level)

Full results are being added here as we test:
https://intranet.mozilla.org/User:Ahughes@mozilla.com/DLL_Hijacking
Created attachment 762724 [details] [diff] [review]
patch rev1 - oleacc.dll and apphelp.dll
Assignee: nobody → robert.bugzilla
Status: NEW → ASSIGNED
Attachment #762724 - Flags: review?(netzen)
Whiteboard: [stub?]
Comment on attachment 762724 [details] [diff] [review]
patch rev1 - oleacc.dll and apphelp.dll

Review of attachment 762724 [details] [diff] [review]:
-----------------------------------------------------------------

We need another patch with a new sfx too
Attachment #762724 - Flags: review?(netzen) → review+
Yep, I'll create one today
Created attachment 762747 [details] [diff] [review]
new 7zip sfx

Brian, could you verify that I got the version and manifest correct? Thanks!
Attachment #762747 - Flags: review?(netzen)
Changing from sec-high to sec-moderate since this is for medium integrity dll's
Keywords: sec-high → sec-moderate
Attachment #762747 - Flags: review?(netzen) → review+

Updated

4 years ago
status-firefox22: affected → wontfix
Pushed to mozilla-inbound
https://hg.mozilla.org/integration/mozilla-inbound/rev/1393fe579803
Target Milestone: --- → mozilla24
This will also need a comm-central/ patch (likely in a new bug) for TB and SeaMonkey

https://hg.mozilla.org/comm-central/file/788084ca950a/other-licenses/7zstub
(In reply to Justin Wood (:Callek) from comment #7)
> This will also need a comm-central/ patch (likely in a new bug) for TB and
> SeaMonkey
> 
> https://hg.mozilla.org/comm-central/file/788084ca950a/other-licenses/7zstub
If you file the bug I'll submit the patch.

Updated

4 years ago
Blocks: 883322
(In reply to Robert Strong [:rstrong] (do not email) from comment #8)
> (In reply to Justin Wood (:Callek) from comment #7)
> > This will also need a comm-central/ patch (likely in a new bug) for TB and
> > SeaMonkey
> > 
> > https://hg.mozilla.org/comm-central/file/788084ca950a/other-licenses/7zstub
> If you file the bug I'll submit the patch.

Bug 883322
https://hg.mozilla.org/mozilla-central/rev/1393fe579803
Status: ASSIGNED → RESOLVED
Last Resolved: 4 years ago
status-firefox24: affected → fixed
Resolution: --- → FIXED
Kamil, could you verify the two dll's that have been added? Thanks!
Flags: needinfo?(kamiljoz)
Keywords: verifyme
Comment on attachment 762724 [details] [diff] [review]
patch rev1 - oleacc.dll and apphelp.dll

For both patches

[Approval Request Comment]
Bug caused by (feature/regressing bug #): This has been around since we have had Firefox installers.
User impact if declined: possibility of launching a process in the user's security context.
Testing completed (on m-c, etc.): has baked for a few days on m-c. This only adds 2 dll's to the existing dll's to preload and this code has been in use for some time now.
Risk to taking this patch (and alternatives if risky): minimal
String or IDL/UUID changes made by this patch: none
Attachment #762724 - Flags: approval-mozilla-aurora?

Updated

4 years ago
Attachment #762724 - Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
Pushed combined patch to mozilla-aurora
https://hg.mozilla.org/releases/mozilla-aurora/rev/3f7234d9c1d9

Note: this affects the full installer as well so adding affected to esr as well.
status-firefox23: affected → fixed
status-firefox-esr17: unaffected → affected
Flags: in-testsuite-
Firefox 23 Testing/Verification Results:

Tested the issue using the full installer & stub executable from the following build:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-06-18-00-40-18-mozilla-aurora/

Windows 8 x64:

C:\Windows\SysWOW64\oleacc.dll <- Passed (cmd.exe was not executed)

- Went through both FULL & Stub installers

Windows XP Pro SP2 x64:

C:\WINDOWS\SysWOW64\apphelp.dll <- Passed (cmd.exe was not executed)

- Went through both FULL & STUB installers
status-firefox24: fixed → verified
Thanks Kamil!
Flags: needinfo?(kamiljoz)
Keywords: verifyme
Firefox 24 Testing/Verification Results:

Tested the issue using the full installer & stub executable from the following build:
http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-06-18-03-13-35-mozilla-central/

Windows 8 x64:

C:\Windows\SysWOW64\oleacc.dll <- Passed (cmd.exe was not executed)

- Went through both the FULL & STUB installers

Windows XP Pro SP2 x64:

C:\WINDOWS\SysWOW64\apphelp.dll <- Passed (cmd.exe was not executed)

- Went through both FULL & STUB installers
status-firefox23: fixed → verified
(In reply to Robert Strong [:rstrong] (do not email) from comment #15)
> Thanks Kamil!

no worries! I accidentally selected the incorrect build to mark as verified so the "Verified" messages are switched but tested both and everything works without any issues.
Status: RESOLVED → VERIFIED
Whiteboard: [include 811557 in this advisory]

Updated

4 years ago
tracking-firefox-esr17: --- → -
Whiteboard: [include 811557 in this advisory] → [adv-main23+][include 811557 in this advisory]
Alias: CVE-2013-1715
status-firefox-esr17: affected → wontfix
Group: core-security
You need to log in before you can comment on or make changes to this bug.