Re: Update: [GSEC-TZO-44-2009] One bug to rule them all - Firefox, IE, Safari, Opera, Chrome, Seamonkey, iPhone, iPod, Wii, PS3....

[Thierry Zoller <Thierry () Zoller lu>]

Hi Michal,

Yes,  we  all  know  that.  The  flaw here was not looping on itself a
thousands  of  times,  wow.  It was a DOM implementation flaw. That's
what made it interesting. A border case that was not accounted for.

That's  all,  still  interesting.  I don't see how Javascripts endless
loops are similar at all - sorry.


MZ> There are literally thousands of HTML- and JavaScript-related denial
MZ> of service vectors in modern browsers. If you want a silly, ad hoc
MZ> example I just made up on the spot (and so could any reader of the
MZ> list), try:

MZ> foo = '<marquee>';
MZ> for (i=0;i<7;i++) foo += foo;
MZ> for (i=0;i<10000;i++) document.write(foo);





-- 
http://blog.zoller.lu
Thierry Zoller


_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/