DoS vulnerabilities in Firefox, Internet Explorer and Opera

["MustLive" <mustlive () websecurity com ua>]

Hello list!

I want to warn you about Denial of Service vulnerability in Mozilla Firefox, Internet Explorer and Opera. Earlier there 
was published DoS vulnerability in browser Opera 10.10 found by Inj3ct0r 
(http://securityvulns.com/news/Opera/1002.html). And some time ago I've checked this exploit and found that many other 
browsers are vulnerable to this attack.

These are Denial of Service vulnerabilities in Mozilla Firefox, Microsoft Internet Explorer and Opera. They belong to 
type (http://websecurity.com.ua/2550/) crashing DoS, blocking DoS and resources consumption DoS.

The exploit from Inj3ct0r is similar to the exploits, which I've made for Google Chrome (for my project "Day of bugs in 
Google Chrome") and Mozilla Firefox in 2008. Attack in my exploits was conducting via large amount of nested marquee 
tags, and in his case the html, marquee and h1 tags were used. But the essence is the same - large amount of nested 
tags (particularly marquee). That time I've informed Google and Mozilla and placed Bug 454434 
(https://bugzilla.mozilla.org/show_bug.cgi?id=454434) in Bugzilla, but if Google had fixed the hole, Mozilla hadn't 
fixed this vulnerability.

-------------------------
Affected products:
-------------------------

Vulnerable are Mozilla Firefox 3.0.19, 3.5.11, 3.6.8, 4.0 beta 2, 11.0, Internet Explorer 6 (6.0.2900.2180), Internet 
Explorer 7 (7.00.5730.13), Internet Explorer 8 (8.00.6001.18702) and Opera 10.62, and previous versions of these 
browsers also must be vulnerable. Other browsers can be vulnerable as well.

----------
Details:
----------

DoS (WASC-10):

This is my version of the exploit for different browsers.

http://websecurity.com.ua/uploads/2012/Firefox,%20IE%20&%20Opera%20DoS%20Exploit.html

This exploit uses JS, but attack can be conducted and without JS - as it shown in my 2008's exploit 
(http://websecurity.com.ua/uploads/2008/Firefox%203%20DoS%20Exploit.html).

This exploit works in the following way:

* Mozilla Firefox 3.0.19 consumes resources (50% CPU and a lot of RAM) and crashes.
* Mozilla Firefox 3.5.11 consumes resources (50% CPU and a lot of RAM) and crashes.
* Mozilla Firefox 3.6.8 consumes resources (50% CPU and a lot of RAM) and crashes.
* Mozilla Firefox 4.0 beta 2 freezes and consumes resources (50% CPU and a lot of RAM).
* Mozilla Firefox 11.0 freezes and consumes resources (50% CPU and a lot of RAM).
* Internet Explorer 6 freezes and consumes resources (50% CPU and a lot of RAM).
* Internet Explorer 7 freezes and consumes resources (50% CPU and a lot of RAM).
* Internet Explorer 8 only consumes resources (50% CPU and a lot of RAM). I.e. in IE8 the problem was partly fixed by 
Microsoft.
* Opera 10.62 freezes and consumes resources (50% CPU and a lot of RAM).
* The exploit doesn't work in browser Google Chrome already since version 1.0.154.48. Google fixed vulnerability with 
marquee tag after my informing in 2008.

------------
Timeline:
------------ 

2012.04.23 - disclosed at my site (http://websecurity.com.ua/5808/).
2012.04.24 - reminded Mozilla that they still hadn't fixed 2008's hole.

Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/