BID:6185

Netscape/Mozilla JAR Remote Heap Corruption Vulnerability

Info

Netscape/Mozilla JAR Remote Heap Corruption Vulnerability

Bugtraq ID:	6185
Class:	Boundary Condition Error
CVE:	CVE-2002-1308
Remote:	Yes
Local:	No
Published:	Nov 14 2002 12:00AM
Updated:	Jul 11 2009 07:16PM
Credit:	Discovery of vulnerability is credited to zen-parse.
Vulnerable:	SGI ProPack 2.3 SGI ProPack 2.2.1 Redhat Enterprise Linux WS 2.1 Redhat Enterprise Linux ES 2.1 Redhat Enterprise Linux AS 2.1 Redhat Advanced Workstation for the Itanium Processor 2.1 Netscape Netscape 7.0 Netscape Netscape 6.2.3 Netscape Netscape 6.2.2 Netscape Netscape 6.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Netscape Netscape 6.2 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 Mozilla Browser 1.1 Mozilla Browser 1.0.2 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Advanced Workstation for the Itanium Processor 2.1 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 IA64 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux AS 2.1 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 IA64 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux ES 2.1 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 IA64 + Redhat Enterprise Linux WS 2.1 + Redhat Enterprise Linux WS 2.1 + Sun Linux 5.0.7 Mozilla Browser 1.0.1 Mozilla Browser 1.0 + Mandriva Linux Mandrake 8.2 ppc + Mandriva Linux Mandrake 8.2 + Redhat Linux 8.0 i386 + Redhat Linux 8.0 Mozilla Browser 0.9.9 - FreeBSD FreeBSD 4.5 - FreeBSD FreeBSD 4.4 - FreeBSD FreeBSD 4.3 - FreeBSD FreeBSD 4.2 - FreeBSD FreeBSD 4.1.1 + Redhat Linux 7.3 i386 + Redhat Linux 7.3 + Redhat Linux 7.2 i686 + Redhat Linux 7.2 i586 + Redhat Linux 7.2 i386 + Redhat Linux 7.2 Mozilla Browser 0.9.8 - Apple Mac OS 9 9.2.2 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.9.7 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2.1 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0.4 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.2 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.1 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.4 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.3 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.2 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0.1 - Apple Mac OS X 10.0 - Apple Mac OS X 10.0 - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Microsoft Windows XP 0 Mozilla Browser 0.9.6 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.2 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.1 - Apple Mac OS 9 9.0 - Apple Mac OS 9 9.0 - Be BeOS 5.0 - Be BeOS 5.0 - BSDI BSD/OS 4.2 - BSDI BSD/OS 4.2 - Compaq OpenVMS 7.3 Alpha - Compaq OpenVMS 7.3 Alpha - Compaq OpenVMS 7.2 -2 Alpha - Compaq OpenVMS 7.2 -2 Alpha - Compaq OpenVMS 7.1 -2 Alpha - FreeBSD FreeBSD 4.0 - FreeBSD FreeBSD 4.0 - IBM AIX 4.3.3 - IBM AIX 4.3.3 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP2 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional SP1 - Microsoft Windows 2000 Professional - Microsoft Windows 2000 Professional - Microsoft Windows 95 - Microsoft Windows 95 - Microsoft Windows 98 - Microsoft Windows 98 - Microsoft Windows ME - Microsoft Windows ME - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6a - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP6 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP5 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP4 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP3 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP2 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 SP1 - Microsoft Windows NT 4.0 - Microsoft Windows NT 4.0 - Redhat Linux 7.0 sparc - Redhat Linux 7.0 sparc - Redhat Linux 7.0 i386 - Redhat Linux 7.0 i386 - Redhat Linux 7.0 alpha - Redhat Linux 7.0 alpha - Redhat Linux 6.0 sparc - Redhat Linux 6.0 sparc - Redhat Linux 6.0 alpha - Redhat Linux 6.0 alpha - Redhat Linux 6.0 - Redhat Linux 6.0 - SGI IRIX 6.5 - SGI IRIX 6.5 - Sun Solaris 2.8 - Sun Solaris 2.8 - Sun Solaris 2.7 - Sun Solaris 2.7

Not Vulnerable:

Discussion

Netscape/Mozilla JAR Remote Heap Corruption Vulnerability

A vulnerability has been discovered in the JAR URI handler used by Netscape and Mozilla. By constructing a malformed JAR file containing invalid file length information, it is possible to cause heap corruption in a vulnerable browser.

When a client browser attempts to decompress a malicious JAR file, invalid values will be used to allocate buffer space for the inflated data. As there are no checks to prevent this, an overrun condition in the heap may occur if excessive data is decompressed.

Solution / Fix

Netscape/Mozilla JAR Remote Heap Corruption Vulnerability

Solution:
Red Hat has released a security advisory (RHSA-2003:163-11) to address this issue in Red Hat enterprise Linux. Customers who are potentially affected by this vulnerability are advised to download and apply the appropriate fix as soon as possible. These fixes are available on the Red Hat Network, further information regarding obtaining and applying appropriate fixes is available in the referenced advisory.

Sun have made fixes available to address this issue in Sun Linux 5.0.7. Fixes are linked below.

Red Hat has released an updated advisory RHSA-2003:162-02 to address this issue. See referenced advisory for additional details regarding obtaining and applying fixes.

Red Hat has released advisory RHSA-2003:162-01 to address this issue. See referenced advisory for additional details.

Red Hat has released a security advisory (RHSA-2003-163) including fixes to address this issue in Advanced Workstation and Enterprise server releases. Fixes are available via the Red Hat Network (http://rhn.redhat.com). Further details can be found in the referenced advisory.

Mozilla Browser 0.9.9