lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sat, 14 Oct 2006 21:38:26 +0100
From: nnp <version5@...il.com>
To: bugtraq@...urityfocus.com
Subject: Kmail <= 1.9.1 (table/frameset) DOS

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                                SilentHack.co.uk Vulnerability Research
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Background:
Kmail is a HTML compatible email client that comes installed by
default with the KDE desktop. This DOS requires HTML parsing to be
enabled. This can be done in Kmail by going to  Settings -> Configure
Kmail ->Security -> and tick Prefer HTML to Plain Text.

Description:
Kmail can be crashed due to incorrectly parsing certain HTML elements.
In this case the a combination of the <table> and <frameset> tags are
incorrectly parsed leading to a segmentation fault. A sample mail can
be found here http://silenthack.co.uk/nnp/exploits/kmail/tableCrash .

To reproduce the crash, copy the above mail into your local mail spool
file (e.g /var/mail/`whoami`) or send it to yourself (without the
email headers obviously). Double click the new mail and when it opens
close it again. On closing it the program should crash and give the
following stack trace:

[KCrash handler]
#6  0xb790a334 in free () from /lib/tls/i686/cmov/libc.so.6
#7  0xb7aab8b1 in operator delete () from /usr/lib/libstdc++.so.6
#8  0xb7aab8fd in operator delete[] () from /usr/lib/libstdc++.so.6
#9  0xb6cd05d8 in non-virtual thunk to
DOM::HTMLObjectBaseElementImpl::~HTMLObjectBaseElementImpl() () from
/usr/lib/libkhtml.so.4
#10 0x084de030 in ?? ()
#11 0x084d03e8 in ?? ()
#12 0x00000001 in ?? ()
#13 0xb6e43aec in ?? () from /usr/lib/libkhtml.so.4
#14 0x084d03e8 in ?? ()
#15 0x00000000 in ?? ()


Version information:
Tested on KDE 3.5.2 and kmail 1.9.1.

Credits:
nnp

-- 
http://silenthack.co.uk

Powered by blists - more mailing lists