Skypher » Firefox http://skypher.com The blog for absolutely nothing! Fri, 16 Jul 2010 08:26:58 +0000 en hourly 1 http://wordpress.org/?v=3.0 Apple QuickTime memory corruption when loading BMP file http://skypher.com/index.php/2010/04/12/apple-quicktime-memory-corruption-when-loading-bmp-file/ http://skypher.com/index.php/2010/04/12/apple-quicktime-memory-corruption-when-loading-bmp-file/#comments Mon, 12 Apr 2010 11:53:01 +0000 SkyLined http://skypher.com/?p=455 From http://support.apple.com/kb/HT4104: CVE-ID: CVE-2010-0536

Impact: Opening a maliciously crafted BMP image may lead to an unexpected application termination or arbitrary code execution

Description: A memory corruption issue exists in the handling of BMP images...]]> From http://support.apple.com/kb/HT4104:
CVE-ID: CVE-2010-0536

Impact: Opening a maliciously crafted BMP image may lead to an unexpected application termination or arbitrary code execution

Description: A memory corruption issue exists in the handling of BMP images. Opening a maliciously crafted BMP image may lead to an unexpected application termination or arbitrary code execution. This update addresses the issue by performing additional validation of BMP images.

More details here:
http://code.google.com/p/skylined/issues/detail?id=11

]]> http://skypher.com/index.php/2010/04/12/apple-quicktime-memory-corruption-when-loading-bmp-file/feed/ 0 Advances in heap spraying #1: when size matters. http://skypher.com/index.php/2010/01/18/advances-in-heap-spraying-size/ http://skypher.com/index.php/2010/01/18/advances-in-heap-spraying-size/#comments Mon, 18 Jan 2010 15:08:02 +0000 SkyLined http://skypher.com/?p=146 http://skypher.com/SkyLined/heap_spray/small_heap_spray_generator.html

I’ve created a heap-spray generator...]]> http://skypher.com/SkyLined/heap_spray/small_heap_spray_generator.html

I’ve created a heap-spray generator. It generates a small piece of JavaScript that sprays the heap using the following customizable settings:


  • Shellcode, easy to enter using hexadecimal byte values (see also BETA3).

  • Target address and block size.

  • heap header size based on target browsers or manual value.


The resulting code is smaller than any heap-spray I’ve seen in the wild:

  • The heap-spray code itself is just over 70 bytes.

  • The shellcode can be encoded using a custom-build 7-bit encoding.


Most exploits contain shellcode encoded as “\uXXXX” or even “%uXXXX”. The resulting encoded shellcode data contains 3 bytes for every byte in the original shellcode. Because this is very wasteful, it is quite easy to improve on this by creating a custom en-/decoder. The “7-bit” encoding I created converts the 16-bit characters in the unicode string that contains the shellcode to a series of 7-bit values, which are encoded into latin-1 characters. The resulting encoded shellcode data contains only 1.125 bytes for every byte in the shellcode, a saving of almost 63% compared to conventional encodings.
The heap-spray will of course need some additional code to decode the shellcode, so the combined code+data will only be smaller for large enough shellcodes. Because my decoder is also rather small (just under 130 bytes), the break-even point is just under 70 bytes of shellcode. For a a 100 byte shellcode, you save about 50 bytes and for a 200 bytes shellcode, you save about 200 bytes!

You can try out the heap-spray generator here.

]]> http://skypher.com/index.php/2010/01/18/advances-in-heap-spraying-size/feed/ 1 Memory corruption when loading/unloading Adobe objects through EMBED tag in Firefox http://skypher.com/index.php/2009/10/13/memory-corruption-when-loadingunloading-adobe-objects-through-embed-tag-in-firefox/ http://skypher.com/index.php/2009/10/13/memory-corruption-when-loadingunloading-adobe-objects-through-embed-tag-in-firefox/#comments Tue, 13 Oct 2009 19:46:52 +0000 SkyLined http://skypher.com/?p=262 (a.k.a. CVE-2009-2983)

Adobe fixed a bug in various COM objects. Loading and unloading these objects in a webpage in Firefox allows memory corruption, which can be exploited to execute arbitrary code...]]> (a.k.a. CVE-2009-2983)

Adobe fixed a bug in various COM objects. Loading and unloading these objects in a webpage in Firefox allows memory corruption, which can be exploited to execute arbitrary code. Here are a number of repro cases for various MIME types:

application/pdf
application/vnd.adobe.xdp+xml
application/vnd.adobe.xfd+xml
application/vnd.adobe.xfdf
application/vnd.fdf

PS. Adobe mentions that “arbitrary code execution has not been demonstrated” without explaining how this is relevant, let me know if you know! :P

]]> http://skypher.com/index.php/2009/10/13/memory-corruption-when-loadingunloading-adobe-objects-through-embed-tag-in-firefox/feed/ 0 Cross browser parallel asynchronous XMLHttpRequests with timeout. http://skypher.com/index.php/2009/09/29/cross-browser-parallel-asynchronous-xmlhttprequests-with-timeout/ http://skypher.com/index.php/2009/09/29/cross-browser-parallel-asynchronous-xmlhttprequests-with-timeout/#comments Tue, 29 Sep 2009 20:50:33 +0000 SkyLined http://skypher.com/?p=232 AsyncXMLHttpRequest is an extension of XMLHttpRequest with the following improvements: Uniform behavior on multiple different browsers (Apple Safari, Google Chrome, Microsoft Internet Explorer, Mozilla Firefox and Opera). Event handlers are called with the AsyncXMLHttpRequest object to which they apply as the first argument...]]> AsyncXMLHttpRequest is an extension of XMLHttpRequest with the following improvements:

  • Uniform behavior on multiple different browsers (Apple Safari, Google Chrome, Microsoft Internet Explorer, Mozilla Firefox and Opera).

  • Event handlers are called with the AsyncXMLHttpRequest object to which they apply as the first argument. This makes it easy to have multiple parallel requests because there is no need to find out for which object an event has fired.

  • A timeout attribute can be set to a number of milliseconds , the request is aborted if it didn’t complete within the given number of milliseconds after calling send().

  • A timedout attribute has been added that is false as long as the request has not been aborted because of a time out and true when it has.

  • Arguments passed to the open() and send() methods are saved in attributes of the object for later reference. These attributes are: method, url, user and password for open() and body for send().

  • Three additional events have been added: onload, onerror and ontimeout. These are called when the readyState has changed to 4 and the request has, respectively, succeeded (no timeout, status == 2xx), failed (no timeout, status != 2xx) or has timed out.

Cross Browser Uniform Behavior
To make AsyncXMLHttpRequest work uniformly across different browsers, it catches and handles some exceptions that are throw in some browsers, but not in others. Specifically, Firefox, MSIE and Opera throw exceptions when calling the open() and send() methods for certain invalid or cross-origin urls. If any of these exceptions are caught and handled, the request will fail similar to other browser by having status == 0 after the readyState has changed to 4.

Parallel Requests
To allow any number of parallel requests to take place and still keep track of which request is in what state, all event handlers are passed the AsyncXMLHttpRequest object to which they apply. In other words, when a certain AsyncXMLHttpRequest object is done (readyState == 4), the onreadystatechange event handler is called with the AsyncXMLHttpRequest object to which it applies as the first argument of the call.

Source
Available through Google code.

Example
This example shows that you can create any number of parallel requests (the browser or OS may have a built in limit) without having to keep track of which object an event is firing for because it is passes as an argument to the event handler:


<HTML>
<BODY onload=”go()”></BODY>
<SCRIPT src=”AsyncXMLHttpRequest.js”></SCRIPT>
<SCRIPT>
function go() {
for (var i = 0; i < 30; i++) {
request(location + “?” + i);
}
}
function request(url) {
span = document.createElement(“DIV”);
document.body.appendChild(span);
span.innerHTML = “<B>” + url + “</B>”;
xmlhttp = new AsyncXMLHttpRequest();
xmlhttp.span = span;
xmlhttp.onload = load;
xmlhttp.onerror = error;
xmlhttp.ontimeout = timeout;
xmlhttp.timeout = 1000;
xmlhttp.onreadystatechange = rs;
xmlhttp.open(“GET”, url);
xmlhttp.send();
}
function rs(xmlhttp) {
xmlhttp.span.innerHTML += ” rs:” + xmlhttp.readyState;
}
function load(xmlhttp) {
xmlhttp.span.innerHTML += ” load:” + xmlhttp.status;
}
function error(xmlhttp) {
xmlhttp.span.innerHTML += ” error:” + xmlhttp.status;
}
function timeout(xmlhttp) {
xmlhttp.span.innerHTML += ” timeout:” + xmlhttp.status;
}
</SCRIPT>
</HTML>
 

]]> http://skypher.com/index.php/2009/09/29/cross-browser-parallel-asynchronous-xmlhttprequests-with-timeout/feed/ 2 Security contacts http://skypher.com/index.php/2008/12/10/security-contacts/ http://skypher.com/index.php/2008/12/10/security-contacts/#comments Wed, 10 Dec 2008 17:52:49 +0000 SkyLined http://skypher.com/?p=78 I’ve created a table with contact information for security teams for mayor software vendors. I’m hoping you’ll find the information useful when you’re trying to report a vulnerability...]]> I’ve created a table with contact information for security teams for mayor software vendors. I’m hoping you’ll find the information useful when you’re trying to report a vulnerability. If you have any more contact information or find an error in the list, let me know.

The list is here:
http://skypher.com/wiki/index.php?title=List_of_security_teams_contact_information

]]> http://skypher.com/index.php/2008/12/10/security-contacts/feed/ 0 JavaScript stack trace http://skypher.com/index.php/2008/08/26/javascript-stack-trace/ http://skypher.com/index.php/2008/08/26/javascript-stack-trace/#comments Tue, 26 Aug 2008 10:07:43 +0000 SkyLined http://skypher.com/?p=38 I’ve created an example script that outputs a stack dump in JavaScript. It shows all the functions that have been called, their arguments and the values of these arguments. I find it to be very useful while writing complex JavaScripts – I use it in asserts and error handlers to find out why things go wrong quickly...]]> I’ve created an example script that outputs a stack dump in JavaScript. It shows all the functions that have been called, their arguments and the values of these arguments. I find it to be very useful while writing complex JavaScripts – I use it in asserts and error handlers to find out why things go wrong quickly. It works in Internet Explorer, FireFox and Safari, but not in Opera.

Available here

]]> http://skypher.com/index.php/2008/08/26/javascript-stack-trace/feed/ 0 Google Enhancements http://skypher.com/index.php/2008/08/15/google-enhancements/ http://skypher.com/index.php/2008/08/15/google-enhancements/#comments Fri, 15 Aug 2008 13:43:48 +0000 Cipher http://skypher.com/?p=36 I’ve updated my userscripts for Google with Greasemonkey.

Google Instant Type

I added the Classic homepage to the list where it should add the buttons...]]> I’ve updated my userscripts for Google with Greasemonkey.

Google Instant Type

I added the Classic homepage to the list where it should add the buttons. I also added a button to search Google News.

Google Own Language

Fixed the layout crash due to Google’s tiny HTML adjustment. Also added support for Google News and Images.

Please feel free to respond if you have a request!

]]> http://skypher.com/index.php/2008/08/15/google-enhancements/feed/ 0 iGoogle enhancement http://skypher.com/index.php/2008/04/30/igoogle-enhancement/ http://skypher.com/index.php/2008/04/30/igoogle-enhancement/#comments Wed, 30 Apr 2008 07:50:49 +0000 Cipher http://skypher.com/?p=7 I was talking to Skylined about greasemonkey and my language enhancement of the results of Google, when we came up with another one, dubbed: Instant Search Type.

This new script removes the “I’m feeling Lucky” button and adds an Images and a Maps button...]]> I was talking to Skylined about greasemonkey and my language enhancement of the results of Google, when we came up with another one, dubbed: Instant Search Type.

This new script removes the “I’m feeling Lucky” button and adds an Images and a Maps button. Using these buttons, you can instantly search Images or Maps.

More information, installation and a preview is available at userscripts.org (http://userscripts.org/scripts/show/25596)

Enjoy!

]]> http://skypher.com/index.php/2008/04/30/igoogle-enhancement/feed/ 0 Google Language Change http://skypher.com/index.php/2008/04/09/google-language-change/ http://skypher.com/index.php/2008/04/09/google-language-change/#comments Wed, 09 Apr 2008 17:23:25 +0000 Cipher http://skypher.com/?p=3 Recently I discovered greasemonkey throu the lifehacker website. After it’s possibilities sank in, I figured out one of my main frustrations: Google. in particular, it’s language settings...]]> Recently I discovered greasemonkey throu the lifehacker website.
After it’s possibilities sank in, I figured out one of my main frustrations: Google. in particular, it’s language settings. Once you switch to Dutch, it’s hard to switch back.
Greasemonkey offers the possibility to add custom JavaScript to any website.
So I wrote a small script to add small links to either Dutch or English results.

The current version can make links for x script languages. To change the languages please download the script from userscripts.org and alter the little array (code comment will guide you). Or install it directly if you think Dutch, English and French are sufficient.

[update 11 April]

I’ve updated the script. You can now change language tags on the fly, using the Greasemonkey User Script Commands Menu. Throu the same menu, you can change the font size.

]]> http://skypher.com/index.php/2008/04/09/google-language-change/feed/ 0