full-disclosure - Re: Apple Safari ... DoS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 3 Mar 2009 12:37:40 -0800
From: Chris Evans <scarybeasts@...il.com>
To: nick@...us-l.demon.co.uk
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Apple Safari ... DoS Vulnerability

On Tue, Mar 3, 2009 at 2:00 AM, Nick FitzGerald
<nick@...us-l.demon.co.uk> wrote:
> Michal Zalewski to me:
>
>> > But what if www.evil.com has run an injection attack of some kind (SQL,
>> > XSS in blog comments, etc, etc) against www.stupid.com?
>> >
>> > Visitors to stupid.com then suffer a DoS...
>>
>> In such a case, the attacker may just as well clobber body.innerHTML,
>> run a while (1) loop, or otherwise logically deny or alter service to
>> visitors without actually exploiting any specific bug ...
>
> So?
>
>> ... - so I do not
>> see any significant benefit to killing this particular tab.
>
> Where in any usable definition of "denial of service" does the word
> "useful" or concept of "benefit" appear?
>
> The question was, is it a DoS.
>
> It is.

By this definition of yours, DoS is fundamentally built in to browsers
(by way of simply following specifications) -- even those with decent
privsep models.

Web security IS fundamentally broken at the foundations, so I'm not
going to disagree with you.

It raises the question: DoS is an overloaded term, perhaps it should
be reserved for cases that actually have real-world significance? Or
is a new term required?

Cheers
Chris

>
>> Crashing / hanging the entire browser is somewhat different, as it
>> bears some risk of data loss in plausible usage scenarios.
>> Unfortunately, most implementations do very little to prevent cases
>> that were permitted by standards in the first place (things such as
>> "while (1) str += str", "while (1) alert('foo')", looped blocking
>> XMLHttpRequest calls, ridiculously nested XML and other
>> expensive-to-render content, etc) - which makes finding new instances
>> somewhat futile and pointless, and a result, somewhat frowned upon on
>> security mailing lists (ugh).
>
> I agree, but I was not addressing that.
>
> Is it useful?  Probably not.
>
> But it's still a DoS...
>
> And, will the Safari folk find something more important to fix if/when
> they look into it?
>
> Who knows but it won't hurt for them to look...
>
>
> Regards,
>
> Nick FitzGerald
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/