full-disclosure - Re: Apple Safari ... DoS Vulnerability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ae1c8e460903031602o6942ed08v79df65ee45a7ec66@mail.gmail.com>
Date: Wed, 4 Mar 2009 00:02:30 +0000
From: Stuart Dunkeld <burningcows@...il.com>
To: nick@...us-l.demon.co.uk
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Apple Safari ... DoS Vulnerability

> Browsers could reasonably implement various kinds of resource expenditure
> limitations, but few, if any, do OOTB (FF 2.x I think added some basic
> "this script is taking too long" controls, but there is a lot more that
> could be done).

IE, Firefox, Safari and Chrome all have basic protection against
long-running scripts -
http://www.nczonline.net/blog/2009/01/05/what-determines-that-a-script-is-long-running/
has some information on each implementation.

What else would you have browser vendors do? I expect they think their
current strategy of responding to specific bugs along with a bit of
fuzzing and insane-input-testing is cost-effective and 'good enough'
for their users.

Regards

--stuart

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/