[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.51.0810031538500.28497@faron.mitre.org>
Date: Fri, 3 Oct 2008 16:00:08 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: coley@...re.org
Subject: Re: regarding CVE-2008-4382 & CVE-2008-4381
On Fri, 3 Oct 2008, Nico Golde wrote:
> looking at the PoC this would work in every browser
> supporting JavaScript as this is just a trivial memory
> consumption issue by passing a very large string too the
> alert function and thus eating memory, a simple
> while(true){} would be equally effective for eating cpu
> cycles which I wouldn't consider as a vulnerability
> either...
I usually wouldn't call it a vulnerability, either. However, based on our
analysis, the String.fromCharCode(550) creates a Unicode string for
character 550, but the escape() for URL encoding can only cover 0 to 255,
so it seemed like something else was going on here, maybe the alert
function not working.
I don't know how Javascript manages large strings, but it seems like
somewhere around the "x4 += x4;" statement, you exceed multiple gigs. So
maybe the alert function isn't even being reached...
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
