full-disclosure - Re: Possible DoS in TamperData Add-on v10.1.0 for FireFox 3.0.8

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <159248.1241383468@turing-police.cc.vt.edu>
Date: Sun, 03 May 2009 16:44:28 -0400
From: Valdis.Kletnieks@...edu
To: Xia Shing Zee <xiashing@...il.com>
Cc: full-disclosure <full-disclosure@...ts.grok.org.uk>
Subject: Re: Possible DoS in TamperData Add-on v10.1.0 for
	FireFox 3.0.8

On Fri, 01 May 2009 23:59:35 +1000, Xia Shing Zee said:

> The loop tries to constantly read the streaming HTTP data. Firefox will
> become unresponsive and will offer the user to stop the script.
> The script can be continued, but with files over 8.00mb there is a
> possible DoS, as the script must constantly be 'continued'.

http://tamperdata.mozdev.org/warnings.html says:

# Request/Response pairs are stored in javascript arrays. Run this extension
for a long time any firefox may run out of memory - don't do this

Sounds like it's probably a known issue - you run long enough, those javascript
arrays are gonna get big and piggy, and trigger the "stop the script" warning.
Or can you verify that you're seeing some different issue?

Content of type "application/pgp-signature" skipped

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/