bugtraq - Re: Denial of Service using Partial GET Request in Mozilla Firefox 3.06

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 13 Feb 2009 12:02:39 -0500
From: Mike Duncan <Mike.Duncan@...a.gov>
To: XiaShing@...il.com
Cc: bugtraq@...urityfocus.com
Subject: Re: Denial of Service using Partial GET Request in Mozilla Firefox 3.06

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

XiaShing@...il.com wrote:
> It's been confirmed that this is not problem in IE. Sorry I didn't mention that. Microsoft uses Silverlight:
> 
> GET /index.php?page=Poem/Poem.php HTTP/1.1
> Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-ms-application, application/vnd.ms-xpsdocument, application/xaml+xml, application/x-ms-xbap, application/x-shockwave-flash, application/x-silverlight, */*

...and how did you confirm that? By seeing Silverlight in the accepted
mime-types header? Silverlight is a plugin which is a lot like the Flex
framework for Flash, only for .Net. So, I guess you have a Silverlight
application installed to play .WAV files, but this does not change the
fact that anything outside of IE (which has the Silverlight extension
installed) will use whatever the default media player is on your PC.

> Accept-Language: en-au
> UA-CPU: x86
> Accept-Encoding: gzip, deflate
> User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.21022; .NET CLR 3.5.30729; .NET CLR 3.0.30618)
> Host: www.footprints-inthe-sand.com
> Connection: Keep-Alive
> 
> It could either be because of what Sean said with the Range request or the Partial GET Request in Firefox. But I think you are probably correct Rolphin, as I've had a lot of Windows Media Player crashes recently. Either way, Windows Media Player should probably not be incorporated into Firefox if it's going to crash. A more stable platform should be used (such as Silverlight)

You can choose a different player within the preferences of Firefox.
What is the problem again?

- --
Mike Duncan
ISSO, Application Security Specialist
Government Contractor with STG, Inc.
NOAA :: National Climatic Data Center

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iEYEARECAAYFAkmVp6oACgkQnvIkv6fg9haRoQCfZnSsBLB7FmFKHWAM3GGaX4Da
k6YAn1rTkC+aog6Aj1pw9IxiAQfcRjfC
=FaH3
-----END PGP SIGNATURE-----