CVE-2013-1055
Potential DoS through abuse of rate limit in libunity-webapps for Firefox
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1, 2.5.0~+14.04.20140409-0ubuntu1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The unity-firefox-extension package could be tricked into dropping a C callback which was still in use, which Firefox would then free, causing Firefox to crash. This could be achieved by adding an action to the launcher and updating it with new callbacks until the libunity-webapps rate limit was hit. Fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1 of unity-firefox-extension and in all versions of libunity-webapps by shipping an empty unity-firefox-extension package, thus disabling the extension entirely and invalidating the attack against the libunity-webapps package.
Timeline
- CVE published
- Record last updated
Affected versions
- Canonical unity-firefox-extension
From 3.0.0 · fixed in 3.0.0+14.04.20140416-0ubuntu1.14.04.1
- Canonical libunity-webapps
From 2.5.0 · fixed in 2.5.0~+14.04.20140409-0ubuntu1