Home Page | Skip to Navigation | Skip to Content | Skip to Search | Skip to Footer

Update Protection against Mozilla Firefox nsPropertyTable PropertyList Memory Corruption

Subscribe

Check Point Reference: CPAI-2010-118
Date Published:
Severity:
Last Updated:
Source: Secunia Advisory SA36671
Industry Reference(s): CVE-2009-3070
Protection Provided by: Security Gateway
  • R71
  • R70
IPS-1
  • IPS-1
  • IPS-1 NGX R65
Who is Vulnerable?
Mozilla Foundation Firefox 3.5.x prior to 3.5.3
Mozilla Foundation Firefox 3.0.x prior to 3.0.14
Vulnerability Description
A memory corruption vulnerability has been reported in Mozilla Firefox web browser. The vulnerability is due to improper handling of PropertyLists in nsPropertyTable while parsing a specially crafted web page. Remote attackers can exploit this vulnerability by convincing a target user to visit a malicious web page, potentially leading to arbitrary code injection and execution on the target system.
Update/Patch Available
The vendor, Mozilla Foundation, has released an advisory addressing this vulnerability.
Vulnerability Details
The vulnerability can be exploited to spoof the URL of a trusted site via Unicode characters having a tall line-height. Successful exploitation could result in arbitrary code injection and execution with the privileges of the logged in user.

Protection Overview
This protection will detect and block HTML documents with some combination of invalid position property lists.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, Protection tab and select the version of your choice.

To configure the defense, select your product from the list below and follow the related protection steps.

Security Gateway: R70/R71

How Can I Protect My Network?
1. In the IPS tab, click Protections > By Protocol > Web Intelligence > HTTP Client Protections > Mozilla Firefox Vulnerabilities.
2. In the right pane, double-click the Mozilla Firefox nsPropertyTable PropertyList Memory Corruption protection.
3. In the Protection Details window, click on Edit. Choose the protection's Action (Override IPS Policy with: Prevent/Detect), and apply Additional Settings.
4. Install policy on all modules.

How Do I Know if My Network is Under Attack?
SmartView Tracker will log the following entries:

Attack Name: Web Client Enforcement Violation
Attack Information: Mozilla Firefox nsPropertyTable PropertyList memory corruption

IPS-1 & IPS-1 NGX R65

How Can I Protect My Network?
1. In the IPS-1 Policy Manager, click on the Protection tab.
2. In the Protection tree, click Web Intelligence > HTML, and select the Firefox protection group.
3. Click Firefox Document Height Change Vulnerability (IPS-1 NGX R65 only).
4. In the configuration pane, under Settings, check Active.
5. Click on Install Policy.

How Do I Know if My Network is Under Attack?
Upon attack, the following entries will be logged:

Alert Name: Firefox Vulnerabilities
Description: Firefox Document Height Change Vulnerability