K-Meleon 1.5.3 Remote Array Overrun (Arbitrary code execution)

2009-11-2000:00:00

vulners.com

JSON

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

[ K-Meleon 1.5.3 Remote Array Overrun (Arbitrary code execution) ]

Author: Maksymilian Arciemowicz and sp3x
http://SecurityReason.com
Date:

- Dis.: 07.05.2009
- Pub.: 20.11.2009

CVE: CVE-2009-0689
Risk: High
Remote: Yes

Affected Software:

- K-Meleon 1.5.3

NOTE: Prior versions may also be affected.

Original URL:
http://securityreason.com/achievement_securityalert/72

— 0.Description —
K-Meleon is an extremely fast, customizable, lightweight web browser based on the Gecko layout
engine developed by Mozilla which is also used by Firefox. K-Meleon is free, open source software
released under the GNU General Public License and is designed specifically for Microsoft Windows
(Win32) operating systems.
— 1. K-Meleon 1.5.3 Remote Array Overrun (Arbitrary code execution) —
The main problem exist in dtoa implementation. K-Meleon has the same dtoa as a KDE, Opera and all
BSD systems. This issue has been fixed in Firefox 3.5.4 and fix

http://securityreason.com/achievement_securityalert/63

but fix for SREASONRES:20090625, used by openbsd was not good.
More information about fix for openbsd and similars SREASONRES:20091030,

http://securityreason.com/achievement_securityalert/69

We can create any number of float, which will overwrite the memory. In Kmax has defined 15.
Functions in dtoa, don't checks Kmax limit, and it is possible to call 16<= elements of freelist
array.

— 2. Proof of Concept (PoC) —

K-Meleon will crash with

Unhandled exception at 0x01800754 in k-meleon.exe: 0xC0000005: Access violation reading location
0x0bc576ec.

01800754 mov eax,dword ptr [ecx]

EAX 00000002
ECX 0BC576EC
EDI 028FEB51

— 3. SecurityReason Note —

Officialy SREASONRES:20090625 has been detected in:

- OpenBSD
- NetBSD
- FreeBSD
- MacOSX
- Google Chrome
- Mozilla Firefox
- Mozilla Seamonkey
- KDE (example: konqueror)
- Opera
- K-Meleon

This list is not yet closed. US-CERT declared that will inform all vendors about this issue,
however, they did not do it. Even greater confusion caused new CVE number "CVE-2009-1563". Secunia
has informed that this vulnerability was only detected in Mozilla Firefox, but nobody was aware that
the problem affects other products like ( KDE, Chrome ) and it is based on "CVE-2009-0689". After
some time Mozilla Foundation Security Advisory
("http://www.mozilla.org/security/announce/2009/mfsa2009-59.html")
was updated with note :
"The underlying flaw in the dtoa routines used by Mozilla appears to be essentially the same as that
reported against the libc gdtoa routine by Maksymilian Arciemowicz ( CVE-2009-0689)".
This fact ( new CVE number for Firefox Vulnerability )and PoC in javascript (from Secunia), forced
us to official notification all other vendors. We publish all the individual advisories, to formally
show all vulnerable software and to avoid wrong CVE number. We do not see any other way to fix this
issue in all products.

Please note:
Patch used in Firefox 3.5.4 does not fully solve the problem. Dtoa algorithm is not optimal and
allows remote Denial of Service in Firefox 3.5.5 giving long float number.

— 4. Fix —
NetBSD fix (optimal):
http://cvsweb.netbsd.org/bsdweb.cgi/src/lib/libc/gdtoa/gdtoaimp.h

— 5. Credits —
Discovered by Maksymilian Arciemowicz and sp3x from SecurityReason.com.
— 6. Greets —
Infospec p_e_a pi3
— 7. Contact —
Email:
- cxib {a.t] securityreason [d0t} com
- sp3x {a.t] securityreason [d0t} com