Executive Summary

Informations
Name CVE-2009-2477 First vendor Publication 2009-07-15
Vendor Cve Last vendor Modification 2017-09-19

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2477

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-94 Failure to Control Generation of Code ('Code Injection')

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1

SAINT Exploits

Description Link
Mozilla Firefox JIT Escape Function Memory Corruption More info here

OpenVAS Exploits

Date Description
2009-07-29 Name : Fedora Core 11 FEDORA-2009-7898 (firefox)
File : nvt/fcore_2009_7898.nasl
2009-07-29 Name : FreeBSD Ports: firefox35
File : nvt/freebsd_firefox350.nasl
2009-07-17 Name : Mozilla Firefox JavaScript Compiler Code Execution Vulnerability (Linux)
File : nvt/gb_firefox_js_compiler_code_exec_vuln_lin.nasl
2009-07-17 Name : Mozilla Firefox JavaScript Compiler Code Execution Vulnerability (Win)
File : nvt/gb_firefox_js_compiler_code_exec_vuln_win.nasl

Open Source Vulnerability Database (OSVDB)

Id Description
55846 Mozilla Firefox Just-in-time (JIT) JavaScript Compiler js/src/jstracer.cpp fo...

A memory corruption flaw exists in Firefox. The Just-in-Time (JIT) compiler can enter a corrupt state following native function calls resulting in memory corruption. With a specially crafted request, an attacker can cause arbitrary code execution resulting in a loss of integrity.

Snort® IPS/IDS

Date Description
2014-01-10 Possible generic javascript heap spray attempt
RuleID : 20137 - Revision : 12 - Type : INDICATOR-OBFUSCATION
2014-01-10 Possible generic javascript heap spray attempt
RuleID : 18168 - Revision : 14 - Type : INDICATOR-SHELLCODE
2014-01-10 Possible generic javascript heap spray attempt
RuleID : 18167 - Revision : 14 - Type : INDICATOR-SHELLCODE
2014-01-10 Mozilla Firefox JIT escape function memory corruption attempt
RuleID : 15997 - Revision : 11 - Type : BROWSER-FIREFOX
2014-01-10 Possible generic javascript heap spray attempt
RuleID : 15698 - Revision : 15 - Type : INDICATOR-SHELLCODE
2014-01-10 Mozilla Firefox 3.5 TraceMonkey JavaScript engine uninitialized memory corrup...
RuleID : 15696 - Revision : 4 - Type : SPECIFIC-THREATS

Nessus® Vulnerability Scanner

Date Description
2013-01-08 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201301-01.nasl - Type : ACT_GATHER_INFO
2009-07-23 Name : The remote Fedora host is missing one or more security updates.
File : fedora_2009-7898.nasl - Type : ACT_GATHER_INFO
2009-07-20 Name : The remote FreeBSD host is missing a security-related update.
File : freebsd_pkg_c1ef9b3372a611de82ea0030843d3802.nasl - Type : ACT_GATHER_INFO
2009-07-17 Name : The remote Windows host contains a web browser that is affected by multiple f...
File : mozilla_firefox_351.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

Source Url
BID http://www.securityfocus.com/bid/35660
CERT-VN http://www.kb.cert.org/vuls/id/443060
CONFIRM http://blog.mozilla.com/security/2009/07/14/critical-javascript-vulnerability...
http://www.mozilla.org/security/announce/2009/mfsa2009-41.html
https://bugzilla.mozilla.org/show_bug.cgi?id=503286
EXPLOIT-DB http://www.exploit-db.com/exploits/9137
http://www.exploit-db.com/exploits/9181
https://www.exploit-db.com/exploits/40936/
FEDORA https://www.redhat.com/archives/fedora-package-announce/2009-July/msg00909.html
MISC http://isc.sans.org/diary.html?storyid=6796
http://voices.washingtonpost.com/securityfix/2009/07/stopgap_fix_for_critical...
http://www.h-online.com/security/First-Zero-Day-Exploit-for-Firefox-3-5--/new...
SECUNIA http://secunia.com/advisories/35798
SUNALERT http://sunsolve.sun.com/search/document.do?assetkey=1-66-266148-1
VUPEN http://www.vupen.com/english/advisories/2009/1868

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
Date Informations
2021-05-04 12:09:49
  • Multiple Updates
2021-04-22 01:10:10
  • Multiple Updates
2020-05-23 13:16:53
  • Multiple Updates
2020-05-23 00:24:03
  • Multiple Updates
2017-09-19 09:23:18
  • Multiple Updates
2017-09-03 09:23:30
  • Multiple Updates
2016-04-26 18:58:33
  • Multiple Updates
2014-02-17 10:50:47
  • Multiple Updates
2014-01-19 21:26:00
  • Multiple Updates
2013-05-10 23:53:58
  • Multiple Updates