bugtraq - Re: Re[2]: Update: [TZO-26-2009] Firefox (all?) Denial of Service through unclamped loop (SVG)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 15 Jul 2009 16:54:01 +0100
From: Nick Boyce <nick.boyce@...il.com>
To: Bugtraq <bugtraq@...urityfocus.com>
Cc: Thierry Zoller <Thierry@...ler.lu>
Subject: Re: Re[2]: Update: [TZO-26-2009] Firefox (all?) Denial of Service 
	through unclamped loop (SVG)

On Tue, Jul 14, 2009 at 3:27 PM, Thierry Zoller<Thierry@...ler.lu> wrote:

> NB> Thierry says he thinks No, but you say /something/ nasty happened to
> NB> your FF 3.5, if I understand you correctly.
>
> It affects 3.5, there was no effective patch included in that version.

For the record (and again I hope I'm not wasting your time by
misunderstanding the problem), I can report that FF 3.5 (en-GB
version) running on Win2K SP4+ (Workstation), with the extensions
Noscript, Oldbar, JRE6, and British dictionary, is unaffected by the
PoC for TZO-26-2009 that you published here in May [1].  No CPU
slugging, no disk activity, browser stays fully responsive, along with
rest of system.

But nor do I see any red circle generated by the HTML  :)

I could guess from some statements on the web ([3]) that FF's SVG
doesn't work on Windows 2000 at all, except that I have no problem
viewing this :
http://upload.wikimedia.org/wikipedia/en/a/a9/Barack_Obama_Hope_poster.svg

At the end of Mozilla bug 393832 [2] (of which your own bug 465615 was
a duplicate) there is a comment dated 13.July.2009 stating a patch for
the SVGLength code was added, but I downloaded my FF 3.5 on 9.July, so
that can't be relevant.

Curious ... I would have thought this one would be OS-agnostic.

[1] http://seclists.org/bugtraq/2009/May/0249.html
[2] https://bugzilla.mozilla.org/show_bug.cgi?id=393832#c14
[3] http://www.mozilla.org/projects/svg/build.html  (last paragraph)

Cheers,
Nick Boyce
-- 
"A week in the lab saves an hour in the library"