Kmail <= 1.9.1 (table/frameset) DOS

2007-03-08 / 2007-03-09
Credit: nnp
Risk: Medium
Local: No
Remote: Yes
CWE: CWE-20


CVSS Base Score: 2.6/10
Impact Subscore: 2.9/10
Exploitability Subscore: 4.9/10
Exploit range: Remote
Attack complexity: High
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= SilentHack.co.uk Vulnerability Research =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Background: Kmail is a HTML compatible email client that comes installed by default with the KDE desktop. This DOS requires HTML parsing to be enabled. This can be done in Kmail by going to Settings -> Configure Kmail ->Security -> and tick Prefer HTML to Plain Text. Description: Kmail can be crashed due to incorrectly parsing certain HTML elements. In this case the a combination of the <table> and <frameset> tags are incorrectly parsed leading to a segmentation fault. A sample mail can be found here http://silenthack.co.uk/nnp/exploits/kmail/tableCrash . To reproduce the crash, copy the above mail into your local mail spool file (e.g /var/mail/`whoami`) or send it to yourself (without the email headers obviously). Double click the new mail and when it opens close it again. On closing it the program should crash and give the following stack trace: [KCrash handler] #6 0xb790a334 in free () from /lib/tls/i686/cmov/libc.so.6 #7 0xb7aab8b1 in operator delete () from /usr/lib/libstdc++.so.6 #8 0xb7aab8fd in operator delete[] () from /usr/lib/libstdc++.so.6 #9 0xb6cd05d8 in non-virtual thunk to DOM::HTMLObjectBaseElementImpl::~HTMLObjectBaseElementImpl() () from /usr/lib/libkhtml.so.4 #10 0x084de030 in ?? () #11 0x084d03e8 in ?? () #12 0x00000001 in ?? () #13 0xb6e43aec in ?? () from /usr/lib/libkhtml.so.4 #14 0x084d03e8 in ?? () #15 0x00000000 in ?? () Version information: Tested on KDE 3.5.2 and kmail 1.9.1. Credits: nnp -- http://silenthack.co.uk


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top