Chrome(0.2.149.27) title(not the tag) Denial of Service(Freeze) exploit

[Rotem Kerner]

a vulnerability was found which allow a remote attacker to freeze the
users browser
by convincing him to visit a malicious web page

Chrome(0.2.149.27) Denial of Service(Freeze) exploit poc:
http://www.blackhat.org.il/exploits/...e-exploit.html

Exodus.

[Wellington Wagner F. Sarmento]

I could not duplicate this with either Chrome v0.2.149.29. I think
this problem was now solved.

--
_Wellington Wagner F. Sarmento

"Where is the wisdom we have lost in knowledge?
Where is the knowledge we have lost in information?"
T.S. Eliot

2008/9/8 Rotem Kerner <rotem@bugsec.com>:
> a vulnerability was found which allow a remote attacker to freeze the users
> browser
> by convincing him to visit a malicious web page
>
> Chrome(0.2.149.27) Denial of Service(Freeze) exploit poc:
> http://www.blackhat.org.il/exploits/...e-exploit.html
>
> Exodus.
>
>
>
>
--
_Wellington Wagner F. Sarmento
"Where is the wisdom we have lost in knowledge?
Where is the knowledge we have lost in information?"
T.S. Eliot

[Razi Shaban]

This successfully crashed my Chrome 0.2.149.29 Build 1798 running on
XP SP2 upon loading the page.

--
Razi

[Rotem Kerner]

this successfully freezed my chrome on both Vista & XP platforms
dont move your mouse for a sec while its laying on the white background
and it should freeze.

Exodus.

http://www.blackhat.org.il
"imagination is more importan than knowledge"
> I could not duplicate this with either Chrome v0.2.149.29. I think
> this problem was now solved.
>
> --
> _Wellington Wagner F. Sarmento
>
> "Where is the wisdom we have lost in knowledge?
> Where is the knowledge we have lost in information?"
> T.S. Eliot
>
>
>> a vulnerability was found which allow a remote attacker to freeze the users
>> browser
>> by convincing him to visit a malicious web page
>>
>> Chrome(0.2.149.27) Denial of Service(Freeze) exploit poc:
>> http://www.blackhat.org.il/exploits/...e-exploit.html
>>
>> Exodus.
>>
>>
>>
>>
>>
> --
> _Wellington Wagner F. Sarmento
> "Where is the wisdom we have lost in knowledge?
> Where is the knowledge we have lost in information?"
> T.S. Eliot
>
>
>
>

[Mike Duncan]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Yeah, when you do that, it is generating a tool-tip to display.

Additionally, the large number of iterations this script must run
through may cause a crash due to resource exhaustion.

Have you tested further to see what values actually produce the results
or are we going on the assumption that is a very large number?

Mike Duncan
ISSO, Application Security Specialist
Government Contractor with STG, Inc.
NOAA :: National Climatic Data Center
mike.duncan@noaa.gov


Rotem Kerner wrote:
| this successfully freezed my chrome on both Vista & XP platforms
| dont move your mouse for a sec while its laying on the white background
| and it should freeze.
|
| Exodus.
|
| http://www.blackhat.org.il
| "imagination is more importan than knowledge"
|> I could not duplicate this with either Chrome v0.2.149.29. I think
|> this problem was now solved.
|>
|> --
|> _Wellington Wagner F. Sarmento
|>
|> "Where is the wisdom we have lost in knowledge?
|> Where is the knowledge we have lost in information?"
|> T.S. Eliot
|>
|>
|>> a vulnerability was found which allow a remote attacker to freeze the
|>> users
|>> browser
|>> by convincing him to visit a malicious web page
|>>
|>> Chrome(0.2.149.27) Denial of Service(Freeze) exploit poc:
|>> http://www.blackhat.org.il/exploits/...e-exploit.html
|>>
|>> Exodus.
|>>
|>>
|>>
|>>
|>>
|> --
|> _Wellington Wagner F. Sarmento
|> "Where is the wisdom we have lost in knowledge?
|> Where is the knowledge we have lost in information?"
|> T.S. Eliot
|>
|>
|>
|>
|
|
|
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFIxr19nvIkv6fg9hYRArtYAJ9XNmuZqbUXzw4/6Wa5Q1h8eR2jNwCdHKNh
ixXVtaTQr1dM/hyWwLNSWQc=
=2SJC
-----END PGP SIGNATURE-----