HTTP: Mozilla NNTP URL Handling Buffer Overflow

A vulnerability has been reported in the way the Mozilla browser handles NNTP URLs. Due to insufficient input validation, a specially crafted URI using the scheme news:// can overflow a heap buffer. By enticing a user to follow a specially crafted NNTP URI, an attacker can remotely exploit this vulnerability in a way that allows for code injection and execution with the privileges of the currently logged in user. In a simple exploit attempt, an instance of a vulnerable Mozilla browser will open a connection with the server listening at the address and the port provided in the specially crafted news:// URI. When the vulnerable function is called to process the commands embedded in the URI, the application will terminate with a memory access violation error. In a more sophisticated attack case, the process flow can be diverted allowing for arbitrary code execution. In such a case, the behaviour of the target is dependent on the nature of the injected code.

Extended Description

A remote heap-overflow vulnerability affects Mozilla Browser's network news transport protocol (NNTP) functionality. This issue is due to the application's failure to properly validate the length of user-supplied strings before copying them into dynamically allocated process buffers. An attacker may exploit this issue to execute arbitrary code with the privileges of the user that activated the vulnerable application. This may facilitate unauthorized access or privilege escalation.

Affected Products

Mozilla browser

References

BugTraq: 12131

CVE: CVE-2004-1316

Short Name

HTTP:STC:MOZILLA:NNTP-URL

Severity

Minor

Recommended

False

Recommended Action

Drop

HTTP: Mozilla NNTP URL Handling Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?