Mozilla Firefox CSSValue array buffer overflow
| firefox-cssvalue-bo (43167) |  High Risk |
Description:
Mozilla Firefox is vulnerable to a buffer overflow, caused by improper bounds checking by the internal CSSValue array data structure when handling reference counters. By persuading a victim to visit a specially-crafted Web site and sending an overly large number of references to a CSS object, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the browser to crash.
Platforms Affected:
- Canonical, Ubuntu 6.06 LTS
- Canonical, Ubuntu 7.04
- Canonical, Ubuntu 7.10
- Canonical, Ubuntu 8.04 LTS
- Debian, Debian Linux 4.0
- MandrakeSoft, Mandrake Linux 2008.0 X86_64
- MandrakeSoft, Mandrake Linux 2008.0
- MandrakeSoft, Mandrake Linux 2008.1
- MandrakeSoft, Mandrake Linux 2008.1 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 3.0
- MandrakeSoft, Mandrake Linux Corporate Server 3.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0 X86_64
- MandrakeSoft, Mandrake Linux Corporate Server 4.0
- Mozilla, Firefox 2.0
- Mozilla, Firefox 2.0.0.1
- Mozilla, Firefox 2.0.0.10
- Mozilla, Firefox 2.0.0.11
- Mozilla, Firefox 2.0.0.12
- Mozilla, Firefox 2.0.0.13
- Mozilla, Firefox 2.0.0.14
- Mozilla, Firefox 2.0.0.2
- Mozilla, Firefox 2.0.0.3
- Mozilla, Firefox 2.0.0.4
- Mozilla, Firefox 2.0.0.5
- Mozilla, Firefox 2.0.0.6
- Mozilla, Firefox 2.0.0.7
- Mozilla, Firefox 2.0.0.8
- Mozilla, Firefox 2.0.0.9
- Mozilla, Firefox 3.0
- RedHat, Enterprise Linux 2.1 WS
- RedHat, Enterprise Linux 2.1 AS
- RedHat, Enterprise Linux 2.1 ES
- RedHat, Enterprise Linux 3 WS
- RedHat, Enterprise Linux 3 ES
- RedHat, Enterprise Linux 3 AS
- RedHat, Enterprise Linux 3 Desktop
- RedHat, Enterprise Linux 4 WS
- RedHat, Enterprise Linux 4 Desktop
- RedHat, Enterprise Linux 4 ES
- RedHat, Enterprise Linux 4 AS
- RedHat, Enterprise Linux 4.5.z AS
- RedHat, Enterprise Linux 4.5.z ES
- RedHat, Enterprise Linux 5
- RedHat, Enterprise Linux 5 Client
- RedHat, Enterprise Linux 5 Client Workstation
- RedHat, Enterprise Linux Optional Productivity Applications 5 Server
- RedHat, Linux Advanced Workstation 2.1 Itanium
Remedy:
Refer to MFSA 2008-34 for patch, upgrade or suggested workaround information. See References.
For other distributions:
Apply the appropriate update for your system. See References.
Consequences:
Gain Access
References:
- MFSA 2008-34, Remote code execution by overflowing CSS reference counter at http://www.mozilla.org/security/announce/2008/mfsa2008-34.html.
- Mozilla Web site, Firefox web browser | Faster, more secure, & customizable at http://www.mozilla.com/en-US/firefox/.
- NORTEL BULLETIN ID: 2009009505, Rev 1, Nortel Response to Sun Alert 256408 - Solaris 10 - Vulnerabilities in Firefox May Allow Execution of Arbitrary Code at http://support.nortel.com/go/main.jsp?cscat=BLTNDETAIL&DocumentOID=909495&poid=.
- Sun Alert ID: 256408, Multiple Security Vulnerabilities in Firefox Versions Before 2.0.0.19 May Allow Execution of Arbitrary Code or Access to Unauthorized Data at http://sunsolve.sun.com/search/document.do?assetkey=1-66-256408-1.
- ZDI-08-044, Mozilla Firefox CSSValue Array Memory Corruption Vulnerability at http://www.zerodayinitiative.com/advisories/ZDI-08-044/.
- Zero Day Initiative Blog, Wed 18 Jun 2008 14:58pm, Mozilla Firefox 3.0 Vulnerability at http://dvlabs.tippingpoint.com/blog/2008/06/18/vulnerability-in-mozilla-firefox-30.
- ASA-2008-314: Thunderbird security update (RHSA-2008-0616)
- ASA-2008-315: seamonkey security update (RHSA-2008-0599)
- ASA-2008-316: firefox security update (RHSA-2008-0598)
- ASA-2009-158: Multiple Security Vulnerabilities in Firefox Versions Before 2.0.0.19 May Allow Execution of Arbitrary Code or Access to unauthorized Data (Sun 256408)
- BID-29802: Mozilla Firefox CSSValue Array Data Structure Remote Code Execution Vulnerability
- CVE-2008-2785: Mozilla Firefox before 2.0.0.16 and 3.x before 3.0.1, Thunderbird before 2.0.0.16, and SeaMonkey before 1.1.11 use an incorrect integer data type as a CSS object reference counter in the CSSValue array (aka nsCSSValue:Array) data structure, which allows remote attackers to execute arbitrary code via a large number of references to a common CSS object, leading to a counter overflow and a free of in-use memory, aka ZDI-CAN-349.
- DSA-1614: iceweasel -- several vulnerabilities
- DSA-1615: xulrunner -- several vulnerabilities
- DSA-1621: icedove -- several vulnerabilities
- DSA-1697: iceape -- several vulnerabilities
- MDVSA-2008:148: Updated Firefox packages fix vulnerabilities
- MDVSA-2008:155: Updated Thunderbird packages fix multiple vulnerabilities
- MDVSA-2008:155-1: Updated Thunderbird packages fix multiple vulnerabilities
- RHSA-2008-0597: Critical: firefox security update
- RHSA-2008-0598: Critical: firefox security update
- RHSA-2008-0599: Critical: seamonkey security update
- RHSA-2008-0616: Moderate: thunderbird security update
- SA30761: Mozilla Firefox Unspecified Code Execution Vulnerability
- SECTRACK ID: 1020336: Mozilla Firefox CSS Reference Counter Bug Lets Remote Users Execute Arbitrary Code
- USN-623-1: Firefox vulnerabilities
- USN-626-1: Firefox and xulrunner vulnerabilities
- USN-626-2: Devhelp, Epiphany, Midbrowser and Yelp update
- USN-629-1: Thunderbird vulnerabilities
- VUPEN/ADV-2008-1873: Mozilla Products Code Execution and Injection Vulnerabilities
Reported:
Jun 18, 2008
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net