bugtraq - Google Chrome Break

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Date: Tue, 11 Nov 2008 16:34:29 +0800
From: Liu Die Yu <liudieyu.com@...il.com>
To: bugtraq@...urityfocus.com
Subject: Google Chrome Break

Address spoofing. Already patched. It's in the news last month.

Just a reminder, XCON'08 is coming in a week - check http://xcon.xfocus.org/

greetz to drewcopley, drorshalev, zwell, liuyuer, lqa21, and, of course 
all@...sec

----------

http://liudieyu.com/kissofthedragon.32168816196486005/

To be viewed with Google Chrome

Last tested
Wednesday, October 29, 2008 at 9:53:18 AM (time zone: UTC/GMT +8 hours)
Up-to-date Google Chrome (version: 0.2.149.30)

Contents
Address spoofing.
1. Address is displayed "bbb.org".
2. Contents are not from bbb.org(contents are manipulated).

http://twitter.com/liudieyu

Google Chrome is still "virgin" - Right now only had a bunch of D.o.S, 
and, a buffer overrun if user saves the attacker's webpage.