Closed
Bug 883165
(CVE-2013-1715)
Opened 10 years ago
Closed 10 years ago
Medium integrity DLL Hijacking - Firefox Full installer and Stub installer
Categories
(Toolkit :: NSIS Installer, defect)
Tracking
()
VERIFIED
FIXED
mozilla24
People
(Reporter: robert.strong.bugs, Assigned: robert.strong.bugs)
References
Details
(Keywords: csectype-priv-escalation, sec-moderate, Whiteboard: [adv-main23+][include 811557 in this advisory])
Attachments
(2 files)
1.35 KB,
patch
|
bbondy
:
review+
akeybl
:
approval-mozilla-aurora+
|
Details | Diff | Splinter Review |
80.24 KB,
patch
|
bbondy
:
review+
|
Details | Diff | Splinter Review |
+++ This bug was initially created as a clone of Bug #811557 which was initially created as a clone of Bug #792106 +++ Specifically (from bug 811557 comment #42) Windows 8 x64: C:\Windows\SysWOW64\oleacc.dll <- CMD.EXE was launched in MEDIUM integrity Windows XP Pro SP2 x64: C:\WINDOWS\SysWOW64\apphelp.dll <- Several CMD.EXE where launched (not sure what integrity level) Full results are being added here as we test: https://intranet.mozilla.org/User:Ahughes@mozilla.com/DLL_Hijacking
![]() |
Assignee | |
Comment 1•10 years ago
|
||
Assignee: nobody → robert.bugzilla
Status: NEW → ASSIGNED
Attachment #762724 -
Flags: review?(netzen)
![]() |
Assignee | |
Updated•10 years ago
|
Whiteboard: [stub?]
Comment 2•10 years ago
|
||
Comment on attachment 762724 [details] [diff] [review] patch rev1 - oleacc.dll and apphelp.dll Review of attachment 762724 [details] [diff] [review]: ----------------------------------------------------------------- We need another patch with a new sfx too
Attachment #762724 -
Flags: review?(netzen) → review+
![]() |
Assignee | |
Comment 3•10 years ago
|
||
Yep, I'll create one today
![]() |
Assignee | |
Comment 4•10 years ago
|
||
Brian, could you verify that I got the version and manifest correct? Thanks!
Attachment #762747 -
Flags: review?(netzen)
![]() |
Assignee | |
Comment 5•10 years ago
|
||
Changing from sec-high to sec-moderate since this is for medium integrity dll's
Keywords: sec-high → sec-moderate
Updated•10 years ago
|
Attachment #762747 -
Flags: review?(netzen) → review+
Updated•10 years ago
|
![]() |
Assignee | |
Comment 6•10 years ago
|
||
Pushed to mozilla-inbound https://hg.mozilla.org/integration/mozilla-inbound/rev/1393fe579803
Target Milestone: --- → mozilla24
Comment 7•10 years ago
|
||
This will also need a comm-central/ patch (likely in a new bug) for TB and SeaMonkey https://hg.mozilla.org/comm-central/file/788084ca950a/other-licenses/7zstub
![]() |
Assignee | |
Comment 8•10 years ago
|
||
(In reply to Justin Wood (:Callek) from comment #7) > This will also need a comm-central/ patch (likely in a new bug) for TB and > SeaMonkey > > https://hg.mozilla.org/comm-central/file/788084ca950a/other-licenses/7zstub If you file the bug I'll submit the patch.
Comment 9•10 years ago
|
||
(In reply to Robert Strong [:rstrong] (do not email) from comment #8) > (In reply to Justin Wood (:Callek) from comment #7) > > This will also need a comm-central/ patch (likely in a new bug) for TB and > > SeaMonkey > > > > https://hg.mozilla.org/comm-central/file/788084ca950a/other-licenses/7zstub > If you file the bug I'll submit the patch. Bug 883322
Comment 10•10 years ago
|
||
https://hg.mozilla.org/mozilla-central/rev/1393fe579803
Status: ASSIGNED → RESOLVED
Closed: 10 years ago
Resolution: --- → FIXED
![]() |
Assignee | |
Comment 11•10 years ago
|
||
Kamil, could you verify the two dll's that have been added? Thanks!
Flags: needinfo?(kamiljoz)
Keywords: verifyme
![]() |
Assignee | |
Comment 12•10 years ago
|
||
Comment on attachment 762724 [details] [diff] [review] patch rev1 - oleacc.dll and apphelp.dll For both patches [Approval Request Comment] Bug caused by (feature/regressing bug #): This has been around since we have had Firefox installers. User impact if declined: possibility of launching a process in the user's security context. Testing completed (on m-c, etc.): has baked for a few days on m-c. This only adds 2 dll's to the existing dll's to preload and this code has been in use for some time now. Risk to taking this patch (and alternatives if risky): minimal String or IDL/UUID changes made by this patch: none
Attachment #762724 -
Flags: approval-mozilla-aurora?
Updated•10 years ago
|
Attachment #762724 -
Flags: approval-mozilla-aurora? → approval-mozilla-aurora+
![]() |
Assignee | |
Comment 13•10 years ago
|
||
Pushed combined patch to mozilla-aurora https://hg.mozilla.org/releases/mozilla-aurora/rev/3f7234d9c1d9 Note: this affects the full installer as well so adding affected to esr as well.
![]() |
Assignee | |
Updated•10 years ago
|
Flags: in-testsuite-
Comment 14•10 years ago
|
||
Firefox 23 Testing/Verification Results: Tested the issue using the full installer & stub executable from the following build: http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-06-18-00-40-18-mozilla-aurora/ Windows 8 x64: C:\Windows\SysWOW64\oleacc.dll <- Passed (cmd.exe was not executed) - Went through both FULL & Stub installers Windows XP Pro SP2 x64: C:\WINDOWS\SysWOW64\apphelp.dll <- Passed (cmd.exe was not executed) - Went through both FULL & STUB installers
![]() |
Assignee | |
Comment 15•10 years ago
|
||
Thanks Kamil!
![]() |
Assignee | |
Updated•10 years ago
|
Flags: needinfo?(kamiljoz)
Comment 16•10 years ago
|
||
Firefox 24 Testing/Verification Results: Tested the issue using the full installer & stub executable from the following build: http://ftp.mozilla.org/pub/mozilla.org/firefox/nightly/2013-06-18-03-13-35-mozilla-central/ Windows 8 x64: C:\Windows\SysWOW64\oleacc.dll <- Passed (cmd.exe was not executed) - Went through both the FULL & STUB installers Windows XP Pro SP2 x64: C:\WINDOWS\SysWOW64\apphelp.dll <- Passed (cmd.exe was not executed) - Went through both FULL & STUB installers
Comment 17•10 years ago
|
||
(In reply to Robert Strong [:rstrong] (do not email) from comment #15) > Thanks Kamil! no worries! I accidentally selected the incorrect build to mark as verified so the "Verified" messages are switched but tested both and everything works without any issues.
![]() |
Assignee | |
Updated•10 years ago
|
Status: RESOLVED → VERIFIED
Updated•10 years ago
|
Whiteboard: [include 811557 in this advisory]
Updated•10 years ago
|
tracking-firefox-esr17:
--- → -
Updated•10 years ago
|
Whiteboard: [include 811557 in this advisory] → [adv-main23+][include 811557 in this advisory]
Updated•10 years ago
|
Alias: CVE-2013-1715
Updated•10 years ago
|
Updated•9 years ago
|
Group: core-security
You need to log in
before you can comment on or make changes to this bug.
Description
•