full-disclosure - Possible DoS in TamperData Add-on v10.1.0 for FireFox 3.0.8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 1 May 2009 23:59:35 +1000
From: Xia Shing Zee <xiashing@...il.com>
To: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Possible DoS in TamperData Add-on v10.1.0 for
	FireFox 3.0.8

Not sure about this, but it seems possible to DoS TamperData and
subsequently Firefox by uploading
large files and running TamperData at the same time.

=======================================================================
Possible DoS in TamperData Add-on v10.1.0 for FireFox 3.0.8
=======================================================================
Tested on:
Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.8)
Gecko/2009032609 Firefox/3.0.8 (.NET CLR 3.5.30729)
=======================================================================
!description
The loop tries to constantly read the streaming HTTP data. Firefox will
become unresponsive and will offer the user to stop the script.
The script can be continued, but with files over 8.00mb there is a
possible DoS, as the script must constantly be 'continued'.
=======================================================================
!vulnerable
Line 482:
chrome://tamperdata/content/tamperdata.js

var postString = "";
try {
 // This is to avoid 'NS_BASE_STREAM_CLOSED' exception that may occurs
 // See bug #188328.
 for (var i = 0; i < size; i++) {
    var c = this.stream.read(1);
    c ? postString += c : postString+='\0';
 }
=======================================================================
!steps to reproduce error
Load tamper data, it does not have to be in "Start tampering mode".
Upload a binary file to a website that is between 4200kb and 4230kb.
=======================================================================
!solution
None available.
=======================================================================
!author
Xia Shing Zee
=======================================================================

Content of type "text/html" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/