bugtraq - Re: Safari HTTPS Overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Thu, 28 Apr 2005 19:29:14 -0700
From: Braden Thomas <braden127@...ealbox.com>
To: Gilbert Verdian <gverdian@...research.org>
Cc: bugtraq@...urityfocus.com
Subject: Re: Safari HTTPS Overflow


Gilbert –
	This appears to be an issue where Safari is calling  
CFSocketEnableCallBacks on a null CFSocketRef.  Not an overflow.  An  
overflow would require a buffer, somewhere, to have overflowed.  This  
is not happening at all.  Just because a program crashes when you send  
it a relatively long string does not define it as an overflow.  Look at  
the crash report:

Exception:  EXC_BAD_ACCESS (0x0001)
Codes:      KERN_PROTECTION_FAILURE (0x0002) at 0x0000000c

	Also, did you notify Apple  
(https://bugreport.apple.com/cgi-bin/WebObjects/RadarWeb.woa) of this  
bug, or did you just figure they'd hear about it through the grapevine?

Braden Thomas

On Apr 28, 2005, at 2:08 PM, Gilbert Verdian wrote:

> Found a bug in the latest Safari that comes with Panther 10.3.9 -  
> Safari 1.3 (v312), previous versions of Panther are also vulnerable.
>
> The problem is with the URI input for HTTPS which causes Safari to  
> crash by inputting a large amount of A's i.e.
>
> https:// 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA 
> AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
>
> Did a debug of the crash, but it kept crashing in a spin_lock while  
> reading from the text segment. Will post more details when have more  
> info on it.
>
> Gilbert Verdian
> neoresearch.org