CVE-2009-2477
EXPLOITEDFirefox 3.5 - Remote Code Execution via TraceMonkey JIT Escape Function
Title source: llmExploitation Summary
CVE-2009-2477 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 6 public exploits from researchers including Hacker Fantastic, Metasploit, netsoul, including a Metasploit module exploits/multi/browser/firefox_escape_retval.
AI-analyzed exploit summary This exploit targets CVE-2009-2477, a heap-based buffer overflow in Adobe Reader and Acrobat. It uses JavaScript heap spraying and ROP gadgets to achieve remote code execution, delivering a reverse shell payload.
Description
js/src/jstracer.cpp in the Just-in-time (JIT) JavaScript compiler (aka TraceMonkey) in Mozilla Firefox 3.5 before 3.5.1 allows remote attackers to execute arbitrary code via certain use of the escape function that triggers access to uninitialized memory locations, as originally demonstrated by a document containing P and FONT elements.
Exploits (6)
This exploit targets CVE-2009-2477, a heap-based buffer overflow in Adobe Reader and Acrobat. It uses JavaScript heap spraying and ROP gadgets to achieve remote code execution, delivering a reverse shell payload.
This Metasploit module exploits a memory corruption vulnerability in Firefox 3.5's JavaScript interpreter, where the escape() function fails to preserve its return value, leading to uninitialized memory usage. The exploit uses heap spraying to achieve remote code execution.
This exploit leverages a heap spray technique to execute arbitrary shellcode in Firefox 3.5 via a crafted HTML page. The shellcode is encoded with Shikata Ga Nai and binds a shell to port 5500.
This exploit leverages a heap spray technique to achieve remote code execution in Firefox 3.5 by triggering a vulnerability in the browser's handling of JavaScript. It delivers a shellcode payload (encoded with Shikata Ga Nai) that binds a shell to port 5500.
This exploit leverages a heap spray technique to trigger a vulnerability in Firefox 3.5, executing arbitrary shellcode (calc.exe) via JavaScript. The PoC demonstrates memory corruption by spraying the heap with NOP sleds and shellcode, then manipulating DOM elements to achieve code execution.
This Metasploit module exploits a memory corruption vulnerability in Firefox 3.5 (CVE-2009-2477) by leveraging a bug in the JavaScript interpreter's handling of the escape() function's return value. It uses heap spraying to achieve remote code execution via a malicious HTML page.