Researchers hack into newest Firefox with zero-day flaw

ID: IRCNE2012031431
Date: 2012-03-10

According to "zdnet", Mozilla’s Firefox is the latest browser to fall victim to hackers at this year’s Pwn2Own hacker contest.
Two researchers working together – Willem Pinckaers and Vincenzo Iozzo — exploited a single zero-day vulnerability in the latest Firefox 10.0.2 (Windows 7 SP1).
The exploit was triggered against a use-after-free vulnerability in the open-source browser and successfully evaded DEP and ALSR, two significant anti-exploit mitigations built into the Windows operating system.
Firefox does not have a sandbox, which made it an easy target at Pwn2Own, which unearthed multiple zero-day flaws in Microsoft’s Internet Explorer and the Google Chrome browser.
In an interview after demonstrating the drive-by download attack for Pwn2Own organizers, Pinckers said he was able to convert the use-after-free bug into two separate information-leak conditions to complete the exploit.
“We triggered the same vulnerability three times. We used it once to leak some information, the used it again to leak addresses of our data. Then, we used the same vulnerability a third time get code execution.”