893008 - Mar file not locked during update

Status: RESOLVED DUPLICATE of bug 890853

(Toolkit :: Application Update, defect)

Description

[Holger Fuhrmannek]

Attachment: poc

The updater has a "Time of check to time of use" bug. It is possible to bypass the signature check in the updater because the .mar file which is used isn't locked during reading. After a succesfull signature check an external program is able to change the .mar file. Essentially it is possible to pass an arbitary .mar file to the updater.

If the maintainservice is installed, it´s easy to exploit the bug (if the attacker find the right timing) because the attacker has an unlimited count of tries.

The following poc does a downgrade of firefox 22 to firefox 20 with a manipulated .mar file with the maintainservice. A downgrade is of course only the easiest way to show the bug. The python script in the poc directory changes the version info of the mar file from 22 to 26 and back in a loop. The poc succeed if while VerifySignature() the version info is 22 and while VerifyProductInformation() the version info is 26.

poc steps:

0.) you need an installed firefox 22
1.) download the poc.zip an extract the directory directory
2.) download "http://releases.mozilla.org/pub/mozilla.org/firefox/releases/20.0/update/win32/de/firefox-20.0.complete.mar" in the poc directory and name it "update.mar".
3.) copy the updater from the firefox directory to the poc directory
4.) alter paths in the start.bat and the poc.py to your paths
5.) start the python script
6.) start the bat file

On my system after a minute the downgrade was successful.

I have tested the poc with ff 22.0 with win7. With my virtual machine with win7 the poc doesen't work.

Comment 2

[Daniel Veditz [:dveditz]]

Is this just a downgrade attack? if you can replace the version number can you replace arbitrary contents and get that installed?

Comment 3

[Brian R. Bondy [:bbondy]]

you can make the mar file contain anything and get that extracted in secure locations, but you cannot execute something elevated from it.

Comment 4

[Brian R. Bondy [:bbondy]]

I think this is a dupe of bug 890853.