full-disclosure - Re: URL Spoofing vulnerability in different browsers

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E2A4E24.1010301@mtu.edu>
Date: Sat, 23 Jul 2011 00:29:24 -0400
From: Ryan Sears <rdsears@....edu>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: URL Spoofing vulnerability in different
	browsers

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

::sigh:: aren't there about a billion ways to render a browser
'un-usable' and thus have a 'denial of service' condition?

// First thing that popped into my head
javascript:while(1){alert(1)}

ZOMG where's MY bugtraq id? You have to kill the process to exit (there
are protections for retarded behavior like this in FF4 and Chrome, but
not IE8). How about http://20b.org? I'd call that 'abuse of
functionality' (especially on IE)

With HTML5 I'm sure there are a lot more evil things that can be
accomplished (using things like WebGL, etc) to actually crash the
process by consuming a lot of memory/processing power.

My point is there are a lot of 'abuse of functionality' vulnerabilities
out there. Documenting every single one isn't necessarily a useful thing
to do...

Just my $0.02

Ryan

On 07/22/2011 11:59 PM, Michal Zalewski wrote:
>> Just ignore Mustlive. The rest of the list does.
> 
> Well, sadly, it leads to things like this:
> 
> http://www.securityfocus.com/bid/40487
> 
> /mz
> 
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iF4EAREIAAYFAk4qTiEACgkQt/95fIeU+XbTaQD/fHVWb9KAGJyWHlUDOGG8kzYF
1RbnMrJHfb8QN857B/gBAI5hwQRjmj4DYuPAcQfzXh+Igveqk4l0HmoeMUGnYKgc
=rrec
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/