Title: Mozilla Browser Network News Transport Protocol Remote Heap Overflow Vulnerability
Severity: HIGH
Description:
A remote heap-overflow vulnerability affects Mozilla Browser's network news transport protocol (NNTP) functionality. The application fails to properly validate the length of user-supplied strings before copying them into dynamically allocated process buffers.
This issue presents itself specifically when the 'MSG_UnEscapeSearchUrl()' function tries to parse NNTP URIs. Due to an unterminated loop that is used to insecurely copy data into a finite heap-based buffer, an attacker can trigger an overflow.
This issue occurs specifically when the final character in the user input string 'commandSpecificData' ends with a '\' character. In this case, the unterminated loop will increment a pointer that references the 'commandSpecificData' string past its endpoint, causing the finite heap-based buffer to be overrun.
An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.
Affected Products:
- HP HP-UX B.11.00
- HP HP-UX B.11.11
- HP HP-UX B.11.11
- HP HP-UX B.11.22
- HP HP-UX B.11.23
- HP Tru64 5.1.0 A PK6
- HP Tru64 5.1.0 A PK6 (BL24)
- HP Tru64 5.1.0 B-2 PK4
- HP Tru64 5.1.0 B-2 PK4 (BL25)
- HP Tru64 5.1.0 b PK4
- MandrakeSoft Linux Mandrake 8.2.0
- MandrakeSoft Linux Mandrake 8.2.0 ppc
- MandrakeSoft Linux Mandrake 9.2.0
- MandrakeSoft Linux Mandrake 9.2.0 amd64
- Mozilla Browser 1.0.0
- Mozilla Browser 1.0.1
- Mozilla Browser 1.0.2
- Mozilla Browser 1.1.0
- Mozilla Browser 1.2.0
- Mozilla Browser 1.2.1
- Mozilla Browser 1.3.0
- Mozilla Browser 1.3.1
- Mozilla Browser 1.4.0
- Mozilla Browser 1.4.0a
- Mozilla Browser 1.4.0b
- Mozilla Browser 1.4.1
- Mozilla Browser 1.4.2
- Mozilla Browser 1.5.0
- Mozilla Browser 1.5.1
- Mozilla Browser 1.6.0
- Mozilla Browser 1.7.0
- Mozilla Browser 1.7.0 rc1
- Mozilla Browser 1.7.0 rc2
- Mozilla Browser 1.7.0 rc3
- Mozilla Browser 1.7.1
- Mozilla Browser 1.7.2
- Mozilla Browser 1.7.3
- Mozilla Thunderbird 0.6.0
- Mozilla Thunderbird 0.7.0
- Mozilla Thunderbird 0.7.1
- Mozilla Thunderbird 0.7.2
- Mozilla Thunderbird 0.7.3
- Mozilla Thunderbird 0.8.0
- RedHat Advanced Workstation for the Itanium Processor 2.1.0
- RedHat Enterprise Linux AS 2.1
- RedHat Enterprise Linux AS 2.1 IA64
- RedHat Enterprise Linux ES 2.1
- RedHat Enterprise Linux ES 2.1 IA64
- RedHat Enterprise Linux WS 2.1
- RedHat Enterprise Linux WS 2.1 IA64
- RedHat Fedora Core1
- RedHat Fedora Core2
- RedHat Linux 7.3.0
- RedHat Linux 7.3.0 i386
- RedHat Linux 7.3.0 i686
- RedHat Linux 8.0.0
- RedHat Linux 8.0.0 i386
- RedHat Linux 9.0.0 i386
- S.u.S.E. Linux 8.0.0
- S.u.S.E. Linux 8.0.0 i386
- S.u.S.E. Linux 8.1.0
- S.u.S.E. Linux Personal 10.0.0 OSS
- S.u.S.E. Linux Personal 8.2.0
- S.u.S.E. Linux Personal 9.0.0
- S.u.S.E. Linux Personal 9.0.0 x86_64
- S.u.S.E. Linux Personal 9.1.0
- S.u.S.E. Linux Personal 9.1.0 x86_64
- S.u.S.E. Linux Personal 9.2.0
- S.u.S.E. Linux Personal 9.2.0 x86_64
- S.u.S.E. Linux Personal 9.3.0
- S.u.S.E. Linux Personal 9.3.0 x86_64
- S.u.S.E. Linux Professional 10.0.0
- S.u.S.E. Linux Professional 10.0.0 OSS
- S.u.S.E. Linux Professional 9.1.0
- S.u.S.E. Linux Professional 9.1.0 x86_64
- S.u.S.E. Linux Professional 9.2.0
- S.u.S.E. Linux Professional 9.2.0 x86_64
- S.u.S.E. Linux Professional 9.3.0
- S.u.S.E. Linux Professional 9.3.0 x86_64
- SGI ProPack 3.0.0
- Sun Linux 5.0.7
References:
- HP: HPSBTU01114 - SSRT5895 rev.0 - Tru64 Unix Mozilla Application Suite 1.7.3
- HP: SSRT5940 rev.0 - HP-UX Mozilla remote, unauthorized user may execute privileged
- Mozilla: Heap overflow in MSG_UnEscapeSearchUrl
- Mozilla Foundation: Mozilla Homepage
Juniper Networks provides this content via a wide variety of sources and production methods. If notified of errors or omissions in the content of this page, Juniper Networks, at its discretion, will modify or remove the page or leave the content as is, depending on various factors including but not limited to the reputation and authority of the party providing the notification. Please use the contact information displayed elsewhere on this page to report any errors or omissions regarding the content on this page.
