Re: Nokia N95-8 browser denial of service
Hello Thierry!
About your message concerning crash in Firefox 3.0.6
(http://securityvulns.ru/Vdocument307.html). Which has similar DoS
vulnerability as Nokia N95-8 browser.
Some time ago I read your message and also checked Firefox 3.0.6 and
confirmed the crash in it. What I can tell you about this hole.
In the beginning of September 2008 I already wrote about such DoS
vulnerability in Mozilla Firefox (http://websecurity.com.ua/2421/). Which
leads to that after running of the exploit the browser begun taking 100% of
CPU resources and freezes.
The attack was based on using nested marquee tags (this hole was already
found in Firefox 1.0 and 1.5). Vulnerable were Mozilla Firefox 3.0.1 and
previous versions. This vulnerability was first publicly disclosed DoS in
Firefox 3. My exploit don't use JavaScript (as Juan's exploit), just only
use HTML. For attacking purposes it's better to use plain HTML exploit,
which allows to bypass such protections as turning off JavaScript or using
addons like NoScript.
I informed Mozilla about this hole (on email) and published it at Bugzilla
(https://bugzilla.mozilla.org/show_bug.cgi?id=454434). But Mozilla
completely ignored it (as all other vulnerabilities, which I informed them
about in 2007, 2008 and 2009 years). For example last hole in Firefox 3,
which I disclosed 13.02.2009 (and informed Mozilla) was Charset Inheritance
vulnerability in Mozilla Firefox 3 (http://websecurity.com.ua/2879/) - and
they even didn't answered me yet about it. For example, when I informed
Google about Charset Inheritance vulnerability in Google Chrome
(http://websecurity.com.ua/2844/), they quickly answered me - that they
decided to not fix it (but still not ignored letter like Mozilla).
In September 2009 DoS vulnerability in SeaMonkey was found
(http://websecurity.com.ua/2820/), which uses the same attack (on
marquee-vulnerability which was ignored by Mozilla). But unlike FF,
SeaMonkey crashes - this is already another type of DoS vulnerabilities in
browser (http://websecurity.com.ua/2550/). And in February you found that
last version of Firefox also crashes.
So Mozilla not only didn't fix the vulnerability, which I found in Firefox
3.0.1 (and which was known yet in FF1), but even strengthened it in last
versions of the browser. They altered it from resources consumption DoS to
crashing DoS. This situation similar to Charset Inheritance vulnerability in
Mozilla Firefox 3, which wasn't in Firefox 3.0.1 and previous versions
(after fix in 2007), but which Mozilla "added" in Firefox from version
3.0.2.
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua