Not sure about this, but it seems possible to DoS TamperData and subsequently Firefox by uploading large files and running TamperData at the same time.
======================================================================= Possible DoS in TamperData Add-on v10.1.0 for FireFox 3.0.8 ======================================================================= Tested on: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.8) Gecko/2009032609 Firefox/3.0.8 (.NET CLR 3.5.30729) ======================================================================= !description The loop tries to constantly read the streaming HTTP data. Firefox will become unresponsive and will offer the user to stop the script. The script can be continued, but with files over 8.00mb there is a possible DoS, as the script must constantly be 'continued'. ======================================================================= !vulnerable Line 482: chrome://tamperdata/content/tamperdata.js var postString = ""; try { // This is to avoid 'NS_BASE_STREAM_CLOSED' exception that may occurs // See bug #188328. for (var i = 0; i < size; i++) { var c = this.stream.read(1); c ? postString += c : postString+='\0'; } ======================================================================= !steps to reproduce error Load tamper data, it does not have to be in "Start tampering mode". Upload a binary file to a website that is between 4200kb and 4230kb. ======================================================================= !solution None available. ======================================================================= !author Xia Shing Zee =======================================================================
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/