exploit the possibilities

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

OSVDB: OSVDB-96019

Firefox 15.0.1 Code Execution

Posted Dec 23, 2013

Site metasploit.com

On versions of Firefox from 5.0 to 15.0.1, the InstallTrigger global, when given invalid input, would throw an exception that did not have an __exposedProps__ property set. By re-setting this property on the exception object's prototype, the chrome-based defineProperty method is made available. With the defineProperty method, functions belonging to window and document can be overriden with a function that gets called from chrome-privileged context. From here, another vulnerability in the crypto.generateCRMFRequest function is used to "peek" into the context's private scope. Since the window does not have a chrome:// URL, the insecure parts of Components.classes are not available, so instead the AddonManager API is invoked to silently install a malicious plugin.

tags | exploit, cryptography

advisories | CVE-2012-3993, CVE-2013-1710, OSVDB-86111, OSVDB-96019

SHA-256 | f9c391aa7b550b10c8e9686f804da688eca5b3b20ea450df0a1b9e0dac71ac00

Download | Favorite | View