Re: DoS vulnerabilities in Firefox, Internet Explorer, Chrome, Opera and other browsers

["MustLive" <mustlive () websecurity com ua>]

Hello Susan!

> Granted I can denial of service a browser just by loading up a horrible
> add in or just using a browser

DoS of the browser is already bad thing. And there are many risks for users
from DoS holes in browsers, which I wrote about in 2008 in my articles
Dangers of DoS attacks on browsers and Dangers of resources consumption DoS
attacks. But mostly browser developers ignore to fix these issues.

But in this case it's not only attack on browsers, but on the whole user's
computer - because it's blocking of whole computer and full resource
consumption. Which is working in many browsers, including their last
versions. So browser developers with their neglect to this problem make
possible attacks on the whole users' systems. It was one of leitmotifs of my
advisory.

> can I respectfully ask that you give vendors time to respond before
> posting?

This informing of vendors was an exclusion. During 2007-2009 I informed many
browser developers about many vulnerabilities (as DoS, as others) and gave
them a lot of time for fixing in many of that cases. But they almost always
ignore to fix the holes (especially DoS holes, which were only fixed few
times by Google and one time by Microsoft, and not in IE, but in Outlook,
and 99% of cases were completely ignored). Taking that into account last
year I decided from 2010 never inform browser vendors about DoS holes in
their browsers. And this time it was an exclusion (just one). In any case
due to full disclosure the Internet community will be knowing about the
vulnerabilities in browsers which I found and will be knowing the real state
of security of browsers. It was another leitmotif of my advisory.

So this time I informed browser developers and users about these issues. And
did I receive any thanks from Susan (especially taking into account that I
did inform vendors) or any other user of browsers for this info? No :-). Did
browser vendors answered me? No :-) (at first day) - which is normal for
such cases, based on my experience. Only on second day Opera and Mozilla
answered me and begun investigation of these cases (which is rare case when
they responded on DoS hole, based on my experience), but not other vendors.

> These vendors do not ignore security issues and do respond

As I already said, in 99% they do ignore and don't respond (and sometimes
were such cases as responded but not fixed, and such case as not responded
and not thanked me, but fixed). So taking into account my personal
experience with finding vulnerabilities in browsers and informing vendors,
I'm not informing them about DoS vulnerabilities in their browsers from this
year (except this one case).

> From more then 5 years of my work here is TOP of different group of people,
based on answering and fixing of vulnerabilities which I informed them about
(the higher, the better):

1. Developers of Internet related software (such as web servers, ad
blockers, etc.).
2. Developers of web applications.
3. Admins of web sites.
4. Developers of the browsers.

Which must give you a ground for thoughts.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

----- Original Message ----- 
From: "Susan Bradley" <sbradcpa () pacbell net>
To: "MustLive" <mustlive () websecurity com ua>; <bugtraq () securityfocus com>
Sent: Tuesday, May 18, 2010 8:38 PM
Subject: Re: DoS vulnerabilities in Firefox, Internet Explorer, Chrome,
Opera and other browsers


> 16.05.2010 - found vulnerability.
> 17.05.2010 - disclosed at my site.
> 18.05.2010 - informed developers: Mozilla, Microsoft, Google and Opera.
>
>
> Found on the 16th
> Blogged on the 17th
> Told vendors on the 18th
> Posted here on the 18th
>
> Granted I can denial of service a browser just by loading up a horrible
> add in or just using a browser, but as a customer of each of these
> vendors, can I respectfully ask that you give vendors time to respond
> before posting?  These vendors do not ignore security issues and do
> respond (unlike some of the web sites with the captcha issues)  So why
> haven't you given them that opportunity?
>
>
> MustLive wrote:
> > Hello Bugtraq!
> >
> > I want to warn you about security vulnerability in different browsers.
> >
> > -----------------------------
> > Advisory: DoS vulnerabilities in Firefox, Internet Explorer, Chrome,
> > Opera
> > and other browsers
> > -----------------------------
> > URL: http://websecurity.com.ua/4206/
> > -----------------------------
> > Affected products: Mozilla Firefox, Internet Explorer 6, Internet
> > Explorer
> > 8, Google Chrome, Opera and other browsers.
> > -----------------------------
> > Timeline:
> >
> > 16.05.2010 - found vulnerability.
> > 17.05.2010 - disclosed at my site.
> > 18.05.2010 - informed developers: Mozilla, Microsoft, Google and Opera.
> > -----------------------------
> > Details:
> >
> > At 30.02.2010 Mozilla fixed vulnerability (small one, which poses no
> > security risk, as they said), found by Henry Sudhof - Mozilla Foundation
> > Security Advisory 2010-23
> > (http://www.mozilla.org/security/announce/2010/mfsa2010-23.html) (Image
> > src
> > redirect to mailto: URL opens email editor). Which allow to open email
> > client at user's computer via redirector, which redirecting to mailto:
> > URL.
> > But this vulnerability was fixed only in Firefox 3.5.9, Firefox 3.6.2 and
> > SeaMonkey 2.0.4, but not in Firefox 3.0.x.
> >
> > After I recently read this advisory, I decided to check different
> > browsers.
> > And as I checked at 16.05.2010, to this vulnerability are vulnerable web
> > browsers Firefox 3.0.19 and Opera 9.52. And I created exploit for
> > conducting
> > of DoS attack on Firefox.
> >
> > Also I found possibility to open email client via iframe with mailto:
> > URL.
> > Which works in browsers Firefox 3.0.19, IE6, IE8 and Chrome. And I
> > created
> > exploit for conducting of attack on all browsers, which I called DoS via
> > email. This attack can be conducted as with using JS, as without it (via
> > creating of page with large quantity of iframes).
> >
> > If attack via images at a page (which open email client) is only
> > discomfort,
> > then attack via images or iframes with using my exploits is Denial of
> > Service vulnerability. It belongs to type
> > (http://websecurity.com.ua/2550/)
> > blocking DoS and resources consumption DoS. These exploits are very
> > dangerous - at their starting, if to not stop attack in time, they can
> > lead
> > to full consumption of computer's resources (potentially even to freezing
> > of
> > the system).
> >
> > DoS:
> >
> > http://websecurity.com.ua/uploads/2010/Firefox%20DoS%20Exploit.html
> >
> > This exploit works in Mozilla Firefox (Firefox <= 3.0.19, Firefox <
> > 3.5.9,
> > Firefox < 3.6.2) and SeaMonkey < 2.0.4.
> >
> > http://websecurity.com.ua/uploads/2010/Firefox,%20IE,%20Chrome%20&%20Opera%20DoS%20Exploit.html
> >
> > This exploit works in Mozilla Firefox (besides 3.0.x and previous
> > versions,
> > it must work in 3.5.x and 3.6.x), Internet Explorer 6 (6.0.2900.2180),
> > Internet Explorer 8 (8.0.7600.16385), Google Chrome 1.0.154.48 and Opera
> > 9.52. At that in Opera the exploit don't open email client, so DoS attack
> > is
> > going without blocking, only resources consumption (more slowly then in
> > other browsers). And also this exploit must work in SeaMonkey, Internet
> > Explorer 7 and other browsers.
> >
> > Best wishes & regards,
> > MustLive
> > Administrator of Websecurity web site
> > http://websecurity.com.ua