| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 4 Sep 2008 22:32:57 +1000 From: Fionnbharr <thouth@...il.com> To: "Juha-Matti Laurio" <juha-matti.laurio@...ti.fi> Cc: full-disclosure@...ts.grok.org.uk, evil fingers <contact.fingers@...il.com> Subject: Re: Google Chrome Browser Vulnerability dear god people, I've got null ptr derefs in firefox but I don't make full disclosure posts about them. I care about them nearly as much as vulnz in a browser no one uses for more than 5 minutes. Get the fuck off my list. 2008/9/4 Juha-Matti Laurio <juha-matti.laurio@...ti.fi>: > FYI: > This was assigned to BID30983: > http://www.securityfocus.com/bid/30983 > > Juha-Matti > > Rishi Narang [psy.echo@...il.com] wrote: >> Hi, >> >> "Time" can definitely plays a major role. There was a collision that occurred due to the fact that I took time to find the real break point in the code, search for a template and to publish at EvilFingers site before sending it to Google and other bugtraqs. >> >> Even though I had the vulnerability 4 hrs well before the real publication of the bug and had the exploit along with the some crash details like "int 3" Kernel Exception/Trap @ 0x01002FF3, different attack cases, exceptions of http/ftp and further debug logs; there was this bug published (though without the details of possible cases, exceptions and mouse hover techniques) couple of hours before I released it out at EvilFingers. >> >> So, I would like to convey due credit to Mr. JanDeMooij as well for his posting the bug on http://code.google.com/p/chromium/issues/detail?id=122, and thanks to Mr. Brennan for contacting me about the same. >> >> -- >> Thanks & Regards, >> Rishi Narang | Security Researcher >> Founder, GREYHAT Insight >> Key: 0x8D67A3A3 (www.greyhat.in/key.asc) >> www.greyhat.in >> >> .. eschew obfuscation, espouse elucidation. >> >> Wednesday, September 3, 2008, 5:43:40 AM, you wrote: >> >> > -----Original Message----- >> > From: full-disclosure-bounces@...ts.grok.org.uk >> > [mailto:full-disclosure-bounces@...ts.grok.org.uk] On Behalf Of Rishi >> > Narang >> > Sent: Tuesday, September 02, 2008 7:51 PM >> > To: full-disclosure@...ts.grok.org.uk >> > Subject: [Full-disclosure] Google Chrome Browser Vulnerability >> >> > Hi, >> >> > --------------------------------------------------- >> > Software: >> > Google Chrome Browser 0.2.149.27 >> >> > Tested: >> > Windows XP Professional SP3 >> >> > Result: >> > Google Chrome Crashes with All Tabs >> >> > Problem: >> > An issue exists in how chrome behaves with undefined-handlers in >> > chrome.dll version 0.2.149.27. A crash can result without user >> > interaction. When a user is made to visit a malicious link, which has an >> > undefined handler followed by a 'special' character, the chrome crashes >> > with a Google Chrome message window "Whoa! Google Chrome has crashed. >> > Restart now?". It fails in dealing with the POP EBP instruction when >> > pointed out by the EIP register at 0x01002FF4. >> >> > Proof of Concept: >> > http://evilfingers.com/advisory/google_chrome_poc.php >> >> > Credit: >> > Rishi Narang (psy.echo) >> > www.greyhat.in >> > www.evilfingers.com >> > --------------------------------------------------- > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.grok.org.uk/full-disclosure-charter.html > Hosted and sponsored by Secunia - http://secunia.com/ > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Powered by blists - more mailing lists