Lucene search

K
securityvulnsSecurityvulnsSECURITYVULNS:DOC:24693
HistorySep 10, 2010 - 12:00 a.m.

Mozilla Foundation Security Advisory 2010-59

2010-09-1000:00:00
vulners.com
24

Mozilla Foundation Security Advisory 2010-59

Title: SJOW creates scope chains ending in outer object
Impact: Critical
Announced: September 7, 2010
Reporter: Blake Kaplan
Products: Firefox, Thunderbird

Fixed in: Firefox 3.6.9
Thunderbird 3.1.3
Description

Mozilla developer Blake Kaplan reported that the wrapper class XPCSafeJSObjectWrapper (SJOW), a security wrapper that allows content-defined objects to be safely accessed by privileged code, creates scope chains ending in outer objects. Users of SJOWs which expect the scope chain to end on an inner object may be handed a chrome privileged object which could be leveraged to run arbitrary JavaScript with chrome privileges.

Michal Zalewski's recent contributions helped to identify this architectural weakness.
References

* https://bugzilla.mozilla.org/show_bug.cgi?id=584180
* CVE-2010-2762