full-disclosure - DoS vulnerabilities in Firefox, Internet Explorer, Chrome and Opera

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <004301cb028f$47de7010$010000c0@ml>
Date: Wed, 2 Jun 2010 23:07:26 +0300
From: "MustLive" <mustlive@...security.com.ua>
To: <full-disclosure@...ts.grok.org.uk>
Subject: DoS vulnerabilities in Firefox, Internet Explorer,
	Chrome and Opera

Hello Full-Disclosure!

I want to warn you about security vulnerabilities in different browsers.
With this advisory I'm continue my series of vulnerabilities in browsers,
which belong to group of DoS via protocol handlers.

-----------------------------
Advisory: DoS vulnerabilities in Firefox, Internet Explorer, Chrome and
Opera
-----------------------------
URL: http://websecurity.com.ua/4248/
-----------------------------
Affected products: Mozilla Firefox, Internet Explorer 6, Internet Explorer
8, Google Chrome, Opera.
-----------------------------
Timeline:

26.05.2010 - found vulnerabilities.
26.05.2010 - informed developers: Mozilla, Microsoft, Google and Opera.
31.05.2010 - disclosed at my site.
-----------------------------
Details:

Now I'm informing about DoS in different browsers via protocols firefoxurl
and gopher. These Denial of Service vulnerabilities belong to type
(http://websecurity.com.ua/2550/) crashing DoS, blocking DoS and resources
consumption DoS. These attacks can be conducted as with using JS, as without
it (via creating of page with large quantity of iframes).

DoS:

http://websecurity.com.ua/uploads/2010/Firefox,%20IE,%20Chrome%20&%20Opera%20DoS%20Exploit3.html

Soon I'll also show exploit (for firefoxurl protocol) without using of JS
which crashes IE6, when I'll release special advisory about DoS attacks on
email clients.

This exploit for firefoxurl protocol works in Mozilla Firefox 3.0.19 (and
besides previous versions, it must work in 3.5.x and 3.6.x), Internet
Explorer 6 (6.0.2900.2180), Internet Explorer 8 (8.0.7600.16385), Google
Chrome 1.0.154.48 and Opera 9.52.

In browsers Firefox, Chrome and IE8 occurs blocking and overloading of the
system, and IE6 crashes. At that, if to allow automatic start of the program
handler of this protocol in Firefox, by setting checkbox, then there will be
no blocking of the browser, nor the system in it. And in Opera the attack is
going without blocking, only resources consumption (more slowly then in
other browsers).

http://websecurity.com.ua/uploads/2010/IE%20&%20Opera%20DoS%20Exploit2.html

This exploit for gopher protocol works in Internet Explorer 6
(6.0.2900.2180), Internet Explorer 8 (8.0.7600.16385) and Opera 9.52.

In all mentioned browsers occurs system resources consumption (CPU and
memory). Such behavior of IE can be due to that in 2002 the patch for
Internet Explorer 6 was released, which removed support of gopher protocol.
So from that time IE is not supporting gopher, but if other browsers just
ignore iframes with it, then IE and Opera are consuming system resources.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/