bugtraq - Re: Fire fox dos exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Pine.LNX.4.64.0606011247130.10846@namshub.die.net>
Date: Thu, 1 Jun 2006 13:00:55 -0700 (PDT)
From: Aaron Hopkins <lists@....net>
To: Josh Zlatin-Amishav <josh@...s.co.il>
Cc: co296@....com, bugtraq@...urityfocus.com
Subject: Re: Fire fox dos exploit

On Wed, 31 May 2006, Josh Zlatin-Amishav wrote:

> Can you give us some more details, like versions and platforms affected? I 
> was unable to recreate this flaw using firefox 1.5.dfsg+1.5.0 on Debian 
> unstable.

The word-wrapping of his mail client broke the exploit.  If you clean that
up by only putting line-breaks between tags, it seems to work.  Try:

 	http://static.die.net/firefox-marquee-dos/

This breaks Firefox/1.5.0.3 on Ubuntu 5.0.4 and WinXP, and Firefox/1.5.0.2
on Ubuntu 5.1.0.  The browser freezes and on Linux the window stops
repainting.

                                     -- Aaron