full-disclosure - magic trick ... voila 100% cpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

From: evilninja at gmx.net (evilninja)
Subject: magic trick ... voila 100% cpu

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

kf_lists wrote:
> I really could not find a use for this... can anyone else?
>
> rename it to .html and double click it. You must have msoffice installed
> I believe. -KF

whatever the JS code in your attachement does - at least it crashes my
Mozilla Thunderbird (version 0.7.1 (20040715)) when i tries to display
the attachment inline. oh, not only TB crashes, but my Gnome display
manager crashes too and takes the whole X11 session down:

gconfd (evil-8530): Signal 15 received, shutdown
gdm[8021]: gdm_slave_xioerror_handler: heavy X-error - :0 will be restarted
(messages appear in german here, "translated" for the list)

this is debian/unstable, linux 2.6.8-rc4 (latest -BK), gdm is version
2.6.0.3, XFree86-4.3.0. i guess it's time to bugzilla something....

Thanks,
Christian.
- --
BOFH excuse #266:

All of the packets are empty.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.5 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org

iD8DBQFBG47wC/PVm5+NVoYRAonHAKD7jXrNVIIB34ysMY+4xWU9rH/YSQCfX22B
aYzfOn8GwH1K9veDIw5N7rQ=
=qNpo
-----END PGP SIGNATURE-----