full-disclosure - Apple Safari 2.0.3 (417.9.3) JavaScript

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <BC3F339E-3C3D-4CA3-92E7-52C5FADCE603@yanux.ch>
Date: Fri May 19 14:06:38 2006
From: yannick.vonarx at yanux.ch (Yannick von Arx)
Subject: Apple Safari 2.0.3 (417.9.3) JavaScript - Denial
	of Service


Apple Safari 2.0.3 (417.9.3) JavaScript - Denial of Service
===========================================================

Release Date:
May 19th, 2006

Vendor:
Apple Computer Inc.

Tested with/under:
Apple Safari 2.0.3 (417.9.3) under Mac OS X 10.4.6 <= affected

Overview:
A vulnerabilitiy exists in Safari 2.0.3 (417.9.3) and perhaps in  
prior versions witch shows up the SRCOD (Spinning Rainbow Cursor Of  
Death)

Technical Details:
Create a new File with following code ...

<script>
for (;;);
</script>

... then save it as a .html file (example.html) now be shure that  
you've enabled JavaScript in the preferences!

For an example klick at the link with Safari (WARNING: Will show up  
the SRCOD [Spinning Rainbow Cursor Of Death])
http://www.yanux.ch/exploits/safari/safari_dos.html

Solution:
Disable JavaScript.

Vendor Status:
Apple has notified of this issues on 05/19/2006

Discovered by:
Yannick von Arx
yannick[dot]vonarx[at]yanux[dot]ch