Bugtraq mailing list archives
RE: IE, Firefox, Opera DoS
From: "GulfTech Security" <security () gulftech org>
Date: Tue, 24 Aug 2004 18:59:19 -0500
Correct me if I am wrong, but isn't this just an exhaustion of resources and not a "vulnerability" at all? You could have it write text to the page instead of iframes and you get the same results because the JavaScript goes into an infinite loop. Does having your 486 freeze up when you attempt to open a 700mb DivX file constitute as a vulnerability of the media software or operating system? I think not. Here is a "one liner" I wrote that does the same thing, but I do not in ANY way consider this a vulnerabity. <script> var i = 1; while (i) </script> James -----Original Message----- From: Dan Pixley [mailto:danpixley () cox net] Sent: Monday, August 23, 2004 8:10 AM To: exploits () su1d net; bugtraq () securityfocus com Subject: Re: IE, Firefox, Opera DoS Tested this in Mozilla 1.7.2 and Epiphany 1.2.6 in Linux (kernel 2.6.8, Gentoo, Gnome 2.6.2). Each browser comes up with a warning about running the script. The user can chose to run it or not. Either way, a dialog box reloads over and over until the main window is forced closed with xkill. Dan Pixley
Browser DoS through viewing of a malicious page that repeatedly loads
iframes of C:\Windows\System32 using 100% cpu
Tested on Mozilla Firefox 0.9.3, Opera 7.54 and IE 6.0 - Opera gives
the error "The address type is unknown or unsupported" over and over
Current thread:
- IE, Firefox, Opera DoS exploits (Aug 23)
- Re: IE, Firefox, Opera DoS Dan Pixley (Aug 24)
- RE: IE, Firefox, Opera DoS GulfTech Security (Aug 25)
- RE: IE, Firefox, Opera DoS (*not* a DoS, not even close) Steve R (Aug 27)
- RE: IE, Firefox, Opera DoS GulfTech Security (Aug 25)
- Re: IE, Firefox, Opera DoS Dan Pixley (Aug 24)