Onderwerp: Driver for display goes to a infinite loop by viewing a html!

Hello everybody,

View this page:
http://www.geocities.com/visitbipin/crazy.html

Try scrolling the picture for few seconds...[ don't kill the process] I have tested it on several machines with intel vga. it reboots Winxp with a fetal error because The driver for the display device got stuck in an infinite loop.

ps: I've tested with firefox and IE browser... The exploit isn't triggered via a opera browser. There have been reports, Matrox G400 video card, driver (version 5.82.18.0.) on windows 2000 (sp4) also crashes.

in, http://www.geocities.com/visitbipin/crazy.html
The image itself is not big but the html resizing of it is big.
<img width=9999999 height=9999999 src="crazy.jpg"


regards,
bipin gautam
http://www.geocities.com/visitbipin/

Bipin Gautam wrote:

>
> Hello everybody,
>
> View this page:
> http://www.geocities.com/visitbipin/crazy.html
>
> Try scrolling the picture for few seconds...[ don't kill the process] I have tested it on several machines with intel vga. it reboots Winxp with a fetal error because The driver for the display device got stuck in an infinite loop.
>
> ps: I've tested with firefox and IE browser... The exploit isn't triggered via a opera browser. There have been reports, Matrox G400 video card, driver (version 5.82.18.0.) on windows 2000 (sp4) also crashes.
>
> in, http://www.geocities.com/visitbipin/crazy.html
> The image itself is not big but the html resizing of it is big.
> <img width=9999999 height=9999999 src="crazy.jpg"
>
>
> regards,
> bipin gautam
> http://www.geocities.com/visitbipin/
>
>

Sony Laptop
Pentium 4-M 2.20 GHz
1 GB Ram
ATI Mobility Radeon 7500 AGP (LW)
Driver Date: 11/23/2002
Driver Version: 6.13.10.6243
Windows XP Professional with SP2 applied

IE: 6.0.2900.2180.xpsp_SP2_
BSOD a few seconds after browsing page.
Firefox: 0.9.3
BSOD a few seconds after browsing page.
Opera: 7.54 build 3865
No affect at all. Image renders fine.

Eddie

I am running Win2k with all of the latest patches, SP 4 and running
Mozilla 1.7. While it did take a while to load and scrolling was
deathly slow.. It did not crash my system or Mozilla. Since this is
my work machine, it's only a 733Mhz with an older video card. I am
perplexed as to why a newer video card would crash Windows with a
fatal error.

Regards,
Anthony Petito


On 11 Aug 2004 12:11:06 -0000, Bipin Gautam <visitbipin@hotmail.com> wrote:
>
>
> Hello everybody,
>
> View this page:
>
> http://www.geocities.com/visitbipin/crazy.html
>
> Try scrolling the picture for few seconds...[ don't kill the process] I have tested it on several machines with intel vga. it reboots Winxp with a fetal error because The driver for the display device got stuck in an infinite loop.
>
> ps: I've tested with firefox and IE browser... The exploit isn't triggered via a opera browser. There have been reports, Matrox G400 video card, driver (version 5.82.18.0.) on windows 2000 (sp4) also crashes.
>
> in, http://www.geocities.com/visitbipin/crazy.html
>
> The image itself is not big but the html resizing of it is big.
>
> <img width=9999999 height=9999999 src="crazy.jpg"
>
> regards,
>
> bipin gautam
>
> http://www.geocities.com/visitbipin/
>

On Wed, Aug 11, 2004 at 12:11:06PM -0000, Bipin Gautam wrote:
>
>
> Hello everybody,
>
> View this page:
> http://www.geocities.com/visitbipin/crazy.html
>

This is just crazy!!! :-)

> Try scrolling the picture for few seconds...[ don't kill the process] I have tested it on several machines with intel vga. it reboots Winxp with a fetal error because The driver for the display device got stuck in an infinite loop.

I tried this on a Dell Optiplex GX270 (It's got a builtin Intel 82865G Graphics
Controller). Windows XP with SP2 is installed. Accessing this page with IE
causes the system to crash as you desribe. If I use Netscape 7.1 on this
machine it just shows the page quite quickly and nothing further happens.
Mozilla 1.4.2 on Fedora Core 1 is similarly unaffected by this page.

>
> regards,
> bipin gautam
> http://www.geocities.com/visitbipin/

--
Steven Leikeim |
University of Calgary | There are lies, damned lies,
Department of Electrical Engineering | and statistics.
Internet: steven@enel.ucalgary.ca |

On a Dell GX260 with an "Intel Extreme" controller using IE 6.0.2 and =
Win2000, it loads a black image then closes and re-opens the page in a =
continuous loop. It doesn't allow access to the application until the =
graphic is done loading. The CPU is pegged, but it doesn't crash the =
system.

-----Original Message-----
From: Christopher X. Candreva [mailto:chris@westnet.com]
Sent: Wednesday, August 11, 2004 12:24 PM
To: bugtraq@securityfocus.com
Subject: Re: Driver for display goes to a infinite loop by viewing a
html!


On Wed, 11 Aug 2004, Jack C wrote:

> On Konqueror with SuSE 9, the page never displays. It simply opens a =
box as if=20
> to say something, then goes 100% CPU, and the disk is very active. I =
finally=20
> got it killed.

Mozilla 1.7.2 on RedHat 9 / XFree86 4.4 / P2-400mhz opened a big, black=20
image. Scrolled around, no noticeable effect. Still running.



=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3 D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D
Chris Candreva -- chris@westnet.com -- (914) 967-7816
WestNet Internet Services of Westchester
http://www.westnet.com/

Christopher X. Candreva wrote:

> On Wed, 11 Aug 2004, Jack C wrote:
>
>
>>On Konqueror with SuSE 9, the page never displays. It simply opens a box as if
>>to say something, then goes 100% CPU, and the disk is very active. I finally
>>got it killed.
>
>
> Mozilla 1.7.2 on RedHat 9 / XFree86 4.4 / P2-400mhz opened a big, black
> image. Scrolled around, no noticeable effect. Still running.
>
Moz 1.7.2 Windows XP SP1 + Hotfixes / ATI Radeon 7500 Mobile / 1.8GHz
P4Mobile.
Gives the following:
Really sluggish performance redrawing in Mozilla until the page exits.
Scrolling works but is slowed by the redraw performance. System still
running. Focus switches to/from Mozillar are also really slow.

ATI driver version: 6.14.10.6374. Since this has the ring of being a
display driver accelleration bug.

Mike

On Wednesday 11 August 2004 08:11, Bipin Gautam wrote:
>
> Try scrolling the picture for few seconds...[ don't kill the process] I
> have tested it on several machines with intel vga. it reboots Winxp with a
> fetal error because The driver for the display device got stuck in an
> infinite loop.

On Konqueror with SuSE 9, the page never displays. It simply opens a box as if
to say something, then goes 100% CPU, and the disk is very active. I finally
got it killed.

-Jack C ("crEp")
http://www.crepinc.com

On Wed, 11 Aug 2004, Jack C wrote:

> On Konqueror with SuSE 9, the page never displays. It simply opens a box as if
> to say something, then goes 100% CPU, and the disk is very active. I finally
> got it killed.

Mozilla 1.7.2 on RedHat 9 / XFree86 4.4 / P2-400mhz opened a big, black
image. Scrolled around, no noticeable effect. Still running.



================================================== ========
Chris Candreva -- chris@westnet.com -- (914) 967-7816
WestNet Internet Services of Westchester
http://www.westnet.com/

Dear Bipin Gautam,

This problem is known for years.

http://seclists.org/lists/vuln-dev/2001/Jun/0102.html
http://www.security.nnov.ru/advisori...reeze.asp?l=RU
http://www.security.nnov.ru/files/ie5hang-nojs.asp



--Wednesday, August 11, 2004, 4:11:06 PM, you wrote to bugtraq@securityfocus.com:



BG> Hello everybody,

BG> View this page:
BG> http://www.geocities.com/visitbipin/crazy.html

BG> Try scrolling the picture for few seconds...[ don't kill the
BG> process] I have tested it on several machines with intel vga. it
BG> reboots Winxp with a fetal error because The driver for the display
BG> device got stuck in an infinite loop.

BG> ps: I've tested with firefox and IE browser... The exploit
BG> isn't triggered via a opera browser. There have been reports, Matrox
BG> G400 video card, driver (version 5.82.18.0.) on windows 2000 (sp4)
BG> also crashes.

BG> in, http://www.geocities.com/visitbipin/crazy.html
BG> The image itself is not big but the html resizing of it is big.
BG> <img width=9999999 height=9999999 src="crazy.jpg"


BG> regards,
BG> bipin gautam
BG> http://www.geocities.com/visitbipin/


--
~/ZARAZA
Òàêèì îáðàçîì îí óìèðàåò â øåñòîé ðàç - è îïÿòü íà íîâîì ìåñòå. (Òâåí)

For the sake of completeness: Mac OS X 10.3.5 doesn't crash or
consume excess CPU cycles at your test page.

The only notable quirk was a failure to scale the test image:
Safari 1.2.3 (KHTML) displayed a blank space 999999 pixels tall
and Mozilla 1.8a displayed a 999999x999999 black box.


> On 11 Aug 2004 12:11:06 -0000, Bipin Gautam <visitbipin@hotmail.com>=20=

> wrote:
>> http://www.geocities.com/visitbipin/crazy.html
>> Try scrolling the picture for few seconds...[ don't kill the process]=20=

>> I have tested it on several machines with intel vga. it reboots Winxp=20=

>> with a fetal error because The driver for the display device got=20
>> stuck in an infinite loop.


--
=F0 http://geocities.com/francis_uy=

In the interest of yet more completeness, I tested this on a few different
machines here at my office, here are the results:

Test image was 10000000px by 10000000px - ~11kb in size

It appears as all black in Mozilla of any version/platform/arch I tried.

Mozilla Firefox 0.9.3 operates slowly (not surprising considering size of
image)

Internet Explorer 6 SP1 hangs for a bit, displays nothing other than just
the text on the HTML page, then crashes the system as the original report
states.

I tried this with an Intel 82845G/GL/GE/PE/GV (That's what the driver is
labelled at anyrate). It's integrated into my Dell Dimension 2400's
motherboard. Running WinXP Pro, updated to everything short of SP2.

The other OS, browser, and system combinations I tried merely responded the
same; very slow response. It seems the crash problem can only be recreated
in IE, no surprises there.

My guess, from my limited knowledge of the way video cards and their drivers
function, it's probably a bug in how IE is interacting with the video
driver. Although, this is merely a guess, and I certainly can't truly point
a finger at M$ or Intel with any certainty. Maybe someone with some
experience of such things can point a finger better than I.

I hope this helps track down the problem.

- Christopher Wagner
<chrisw@pacaids.com>

-----Original Message-----
From: Frank Nospam [mailto:fuy1@umbc.edu]
Sent: Thursday, August 12, 2004 1:33 PM
To: bugtraq@securityfocus.com
Subject: Re: Driver for display goes to a infinite loop by viewing a
html!


For the sake of completeness: Mac OS X 10.3.5 doesn't crash or
consume excess CPU cycles at your test page.

The only notable quirk was a failure to scale the test image:
Safari 1.2.3 (KHTML) displayed a blank space 999999 pixels tall
and Mozilla 1.8a displayed a 999999x999999 black box.


> On 11 Aug 2004 12:11:06 -0000, Bipin Gautam <visitbipin@hotmail.com>
> wrote:
>> http://www.geocities.com/visitbipin/crazy.html
>> Try scrolling the picture for few seconds...[ don't kill the process]
>> I have tested it on several machines with intel vga. it reboots Winxp
>> with a fetal error because The driver for the display device got
>> stuck in an infinite loop.


--
? http://geocities.com/francis_uy=