what you don't know can hurt you

Register | Login

FilesNewsUsersAuthors

Home Files News &[SERVICES_TAB]About Contact Add New

Showing 1 - 1 of 1

OSVDB: OSVDB-72087

Mozilla Firefox "nsTreeRange" Dangling Pointer Vulnerability

Posted Jul 11, 2011

Authored by regenrecht, xero | Site metasploit.com

This Metasploit module exploits a code execution vulnerability in Mozilla Firefox 3.6.x <= 3.6.16 and 3.5.x <= 3.5.17 found in nsTreeSelection. By overwriting a subfunction of invalidateSelection it is possible to free the nsTreeRange object that the function currently operates on. Any further operations on the freed object can result in remote code execution. Utilizing the call setup the function provides it's possible to bypass DEP without the need for a ROP. Sadly this exploit is still either dependent on Java or bound by ASLR because Firefox doesn't employ any ASLR-free modules anymore.

tags | exploit, java, remote, code execution

advisories | CVE-2011-0073, OSVDB-72087

SHA-256 | bd0456bbc29964266747946f68aee47392e1ba55e7169a60b1f4a5db2ea04edd

Download | Favorite | View