Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos.

2008.10.02
Credit: Aditya K Sood
Risk: Low
Local: No
Remote: No
CWE: CWE-20


CVSS Base Score: 4.3/10
Impact Subscore: 2.9/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: None
Integrity impact: None
Availability impact: Partial

*Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos.* *Version Affected:* Chrome/0.2.149.30 Chrome/0.2.149.29 *Severity:* High *Description:* The Google chrome browser is vulnerable to memory exhaustion based denial of service which can be triggered remotely.The vulnerability triggers when Carriage Return(\r\n\r\n) is passed as an argument to window.open() function. It makes the Google Chrome to generate number of windows at the same time thereby leading to memory exhaustion. The behavior can be easily checked by looking at the task manager as with no time the memory usage rises high. The problem lies in the handling of object and its value returned by the javascript function. Once it is triggered the pop ups are started generating. The Google Chrome browser generate object windows continuously there by affecting memory of the resultant system. Probably it can be crashed within no time. User interaction is required in this. *Proof of Concept* http://www.secniche.org/gds *Links:* http://secniche.org/gcrds.html http://evilfingers.com/advisory/Google_Chrome_Carriage_Return_Null_Objec t_Memory_Exhaustion_Remote_Dos.php *Detection:* SecNiche confirmed this vulnerability affects Google Chrome on Microsoft Windows XP SP2 platform.The versions tested are: Chrome/0.2.149.30 Chrome/0.2.149.291 *Disclosure Timeline:* Disclosed: 22 September 2008 Release Date. September 24 ,2008 *Vendor Response:* Google acknowledges this vulnerability and "fix" will be released soon. *Credit:* Aditya K Sood *Disclaimer* The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There is no representation or warranties, either express or implied by or with respect to anything in this document, and shall not be liable for a ny implied warranties of merchantability or fitness for a particular purpose or for any indirect special or consequential damages.

References:

http://www.securityfocus.com/bid/31375
http://www.securityfocus.com/archive/1/archive/1/496688/100/0/threaded
http://www.milw0rm.com/exploits/6554
http://secniche.org/gcrds.html


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top