CVE-2011-2486: Permissions, Privileges, and Access Controls (CWE-264)
value: nspluginwrapper before 1.4.4 does not properly provide access to NPNVprivateModeBool variable settings, which could prevent Firefox plugins from determining if they should run in Private Browsing mode and allow remote attackers to bypass intended access restrictions, as demonstrated using Flash.
CWE description: Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Published: 2012-11-19T12:10Z
Repository: https://github.com/davidben/nspluginwrapper
Language: C
Files changed: src/npw-rpc.c, src/npw-viewer.c, src/utils.c
Commit date: 2011-03-26 02:14:26 -0400
Commit message: Support all the new variables added

Diff: diff --git a/src/npw-rpc.c b/src/npw-rpc.c
index 569aa0c..ecb99a4 100644
--- a/src/npw-rpc.c
+++ b/src/npw-rpc.c
@@ -39,10 +39,12 @@ int rpc_type_of_NPNVariable(int variable)
   case NPNVjavascriptEnabledBool:
   case NPNVasdEnabledBool:
   case NPNVisOfflineBool:
   case NPNVSupportsXEmbedBool:
   case NPNVSupportsWindowless:
+  case NPNVprivateModeBool:
+  case NPNVsupportsAdvancedKeyHandling:
 	type = RPC_TYPE_BOOLEAN;
 	break;
   case NPNVToolkit:
   case NPNVnetscapeWindow:
 	type = RPC_TYPE_UINT32;
@@ -63,10 +65,11 @@ int rpc_type_of_NPPVariable(int variable)
   int type;
   switch (variable) {
   case NPPVpluginNameString:
   case NPPVpluginDescriptionString:
   case NPPVformValue: // byte values of 0 does not appear in the UTF-8 encoding but for U+0000
+  case NPPVpluginNativeAccessibleAtkPlugId:
 	type = RPC_TYPE_STRING;
 	break;
   case NPPVpluginWindowSize:
   case NPPVpluginTimerInterval:
 	type = RPC_TYPE_INT32;
@@ -74,10 +77,14 @@ int rpc_type_of_NPPVariable(int variable)
   case NPPVpluginNeedsXEmbed:
   case NPPVpluginWindowBool:
   case NPPVpluginTransparentBool:
   case NPPVjavascriptPushCallerBool:
   case NPPVpluginKeepLibraryInMemory:
+  case NPPVpluginUrlRequestsDisplayedBool:
+  case NPPVpluginWantsAllNetworkStreams:
+  case NPPVpluginCancelSrcStream:
+  case NPPVSupportsAdvancedKeyHandling:
 	type = RPC_TYPE_BOOLEAN;
 	break;
   case NPPVpluginScriptableNPObject:
 	type = RPC_TYPE_NP_OBJECT;
 	break;
diff --git a/src/npw-viewer.c b/src/npw-viewer.c
index 384b9a7..c37813c 100644
--- a/src/npw-viewer.c
+++ b/src/npw-viewer.c
@@ -1300,10 +1300,12 @@ g_NPN_GetValue(NPP instance, NPNVariable variable, void *value)
   case NPNVSupportsWindowless:
 #endif
   case NPNVSupportsXEmbedBool:
   case NPNVWindowNPObject:
   case NPNVPluginElementNPObject:
+  case NPNVprivateModeBool:
+  case NPNVsupportsAdvancedKeyHandling:
 	return g_NPN_GetValue_real(instance, variable, value);
   default:
 	switch (variable & 0xff) {
 	case 13: /* NPNVToolkit */
 	  if (NPW_TOOLKIT == NPNVGtk2) {
diff --git a/src/utils.c b/src/utils.c
index 842b1e9..f87a29d 100644
--- a/src/utils.c
+++ b/src/utils.c
@@ -245,10 +245,15 @@ const char *string_of_NPPVariable(int variable)
 	_(NPPVjavascriptPushCallerBool);
 	_(NPPVpluginKeepLibraryInMemory);
 	_(NPPVpluginNeedsXEmbed);
 	_(NPPVpluginScriptableNPObject);
 	_(NPPVformValue);
+	_(NPPVpluginUrlRequestsDisplayedBool);
+	_(NPPVpluginWantsAllNetworkStreams);
+	_(NPPVpluginNativeAccessibleAtkPlugId);
+	_(NPPVpluginCancelSrcStream);
+	_(NPPVSupportsAdvancedKeyHandling);
 #undef _
   default:
 	switch (variable & 0xff) {
 #define _(VAL, VAR) case VAL: str = #VAR; break
 	  _(10, NPPVpluginScriptableInstance);
@@ -281,10 +286,12 @@ const char *string_of_NPNVariable(int variable)
 	_(NPNVToolkit);
 	_(NPNVSupportsXEmbedBool);
 	_(NPNVWindowNPObject);
 	_(NPNVPluginElementNPObject);
 	_(NPNVSupportsWindowless);
+	_(NPNVprivateModeBool);
+	_(NPNVsupportsAdvancedKeyHandling);
 #undef _
   default:
 	switch (variable & 0xff) {
 #define _(VAL, VAR) case VAL: str = #VAR; break
 	  _(10, NPNVserviceManager);

Fixed code:   case NPNVprivateModeBool:
  case NPNVsupportsAdvancedKeyHandling:
  case NPPVpluginNativeAccessibleAtkPlugId:
  case NPPVpluginUrlRequestsDisplayedBool:
  case NPPVpluginWantsAllNetworkStreams:
  case NPPVpluginCancelSrcStream:
  case NPPVSupportsAdvancedKeyHandling:
  case NPNVprivateModeBool:
  case NPNVsupportsAdvancedKeyHandling:
	_(NPPVpluginUrlRequestsDisplayedBool);
	_(NPPVpluginWantsAllNetworkStreams);
	_(NPPVpluginNativeAccessibleAtkPlugId);
	_(NPPVpluginCancelSrcStream);
	_(NPPVSupportsAdvancedKeyHandling);
	_(NPNVprivateModeBool);
	_(NPNVsupportsAdvancedKeyHandling);