// back

Netscape/Mozilla Javascript Function.thaw() Vulnerabilities

12.29.03

BACKGROUND

The Netscape browser is a derivative of the Mozilla browser, an open
source webbrowser. More information is available from
http://browsers.netscape.com/.

DESCRIPTION

Improper input to the Javascript Function.thaw() method in Netscape and
Mozilla allows execution of arbitrary code.

The Function object's thaw() method contains an integer overflow which
allows exploitable heap corruption.

Additionally a user suppliable array index is not checked for validity,
which allows a pointer to be stored at an arbitrary index. A webpage can
be constructed to leverage this into execution of arbitrary code.

This issue was resolved by removal of the thaw() and freeze() methods
from the Function object in Mozilla 1.5, however there has not been a
new release of Netscape since the fix was made.

ANALYSIS

Successful exploitation allows the remote attacker to execute abitrary
code in the context of the user running the browser.

DETECTION

DEFENSE has confirmed this vulnerability in Netscape 6.2.3, 7.0 and 7.1.
All versions from Netscape 6.0 upwards are vulnerable.

All versions of Mozilla prior to version 1.5 are also vulnerable.

WORKAROUND

S

Disabling Javascript will prevent exploitation of this vulnerability.
This may, however, reduce functionality of some sites.

VENDOR RESPONSE

Mozilla users should upgrade to the latest version.

A fix for Netscape is not available.

CVE INFORMATION

The Common Vulnerabilities and Exposures (CVE) project has assigned the
name CAN-2004-0508 to this issue. This is a candidate for inclusion in
the CVE list (http://cve.mitre.org), which standardizes names for
security problems.

DISCLOSURE TIMELINE

10/13/2003    Exploit acquired by iDEFENSE
10/19/2003    Initial vendor notification
12/22/2003    iDEFENSE Clients notified
12/29/2003    Public Disclosure

CREDIT

zen-parse is credited with this discovery.

Get paid for vulnerability research
http://www.idefense.com/poi/teams/vcp.jsp

LEGAL NOTICES

Copyright © 2004 Verisign, Inc.

Permission is granted for the redistribution of this alert
electronically. It may not be edited in any way without the express
written consent of iDEFENSE. If you wish to reprint the whole or any
part of this alert in any other medium other than electronically, please
email customerservice@idefense.com for permission.

Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information. Use
of the information constitutes acceptance for use in an AS IS condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct, indirect,
or consequential loss or damage arising from use of, or reliance on,
this information.