Re: [Full-disclosure] Firefox 3.0.8 remote DoS: 0-day exploit

[Ron]

You're correct that time machines don't exist yet. However, this is 
proof that they'll be invented in the next five months.

Stay tuned!

Mike Bann wrote:
> I highly doubt you reported this to Mozilla in "September of 2009". I 
> don't think time machines like that exist yet, but i'd be pleased to be 
> wrong.
> 
> Berend-Jan Wever wrote:
>> ...sigh
>>
>> This is https://bugzilla.mozilla.org/show_bug.cgi?id=456727, which I 
>> reported to Mozilla in September of 2009. It is a NULL ptr DoS, there 
>> is no "exploit" in the sense of executing arbitrary code, just a 
>> "repro" that can trigger a crash. The repro provided by Carl is the 
>> exact same repro I provided to Mozilla.
>>
>> Incidentally, Carl has report this exact same bug 
>> before: http://seclists.org/fulldisclosure/2009/Jan/0219.html. This is 
>> how the repro got on milw0rm in the first place 
>> (http://milw0rm.com/exploits/8091). Aditya K Sood later submitted the 
>> repro (slightly modified) to milw0rm as his code as well 
>> (http://milw0rm.com/exploits/8219).
>>
>> Some say plagiarism is the sincerest form of flattery, so I guess I'll 
>> start obfuscating my repros into ASCII art that says "SkyLined" to 
>> prevent any more people from flattering me.
>>
>> Cheers,
>> Sky
>>
>>
>> Berend-Jan Wever > >
>> http://skypher.com/SkyLined
>>
>>
>>
>>
>> On Sat, Apr 4, 2009 at 2:39 PM, carl hardwick > > wrote:
>>
>> I found an unpatched vulnerability in the latest Firefox 3.0.8 allows
>> a remote attacker to cause a DoS.
>> A 0-day exploit is available here:
>> 
>> http://carl-hardwick.googlegroups.com/web/Firefox+3.0.8+DoS.htm?gda=i_oPfkcAAACkS-ZCh60y1HGkG90OfxntdaCvR5MIFXIiKOQt5O80jPqLKEFpBrbag3mOAa49_d8xnmtLTzx06f-L8nRUL3egeV4duv6pDMGhhhZdjQlNAw&gsc=HORKjws1umYfXMbeoe6wr8IrMRRv
>> 
>> 
>>
>> ___
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
>>
>>
>> 
>>
>> ___
>> Full-Disclosure - We believe in it.
>> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
>> Hosted and sponsored by Secunia - http://secunia.com/
> 
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Firefox 3.0.8 remote DoS: 0-day exploit

[Nick]

This has already been posted on Firefox's bugzilla (
https://bugzilla.mozilla.org/show_bug.cgi?id=456727) and there is another
bug like this one that causes firefox to hang (
https://bugzilla.mozilla.org/show_bug.cgi?id=348033). The 0day exploit/bug
is fixed and its been committed to the CVS and will be released with
3.0.9...
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Firefox 3.0.8 remote DoS: 0-day exploit

[Paul Schmehl]

--On April 4, 2009 2:39:40 PM +0200 carl hardwick 
 wrote:

> I found an unpatched vulnerability in the latest Firefox 3.0.8 allows
> a remote attacker to cause a DoS.
> A 0-day exploit is available here:
> http://carl-hardwick.googlegroups.com/web/Firefox+3.0.8+DoS.htm?gda=i_oP
> fkcAAACkS-ZCh60y1HGkG90OfxntdaCvR5MIFXIiKOQt5O80jPqLKEFpBrbag3mOAa49_d8x
> nmtLTzx06f-L8nRUL3egeV4duv6pDMGhhhZdjQlNAw&gsc=HORKjws1umYfXMbeoe6wr
> 8IrMRRv
>

Works on Mac OS 10.5.6 with Firefox 3.0.8.


Paul Schmehl, If it isn't already
obvious, my opinions are my own
and not those of my employer.
**
WARNING: Check the headers before replying

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Firefox 3.0.8 remote DoS: 0-day exploit

[Mike Bann]

I highly doubt you reported this to Mozilla in "September of 2009". I 
don't think time machines like that exist yet, but i'd be pleased to be 
wrong.

Berend-Jan Wever wrote:
> ...sigh
>
> This is https://bugzilla.mozilla.org/show_bug.cgi?id=456727, which I 
> reported to Mozilla in September of 2009. It is a NULL ptr DoS, there 
> is no "exploit" in the sense of executing arbitrary code, just a 
> "repro" that can trigger a crash. The repro provided by Carl is the 
> exact same repro I provided to Mozilla.
>
> Incidentally, Carl has report this exact same bug 
> before: http://seclists.org/fulldisclosure/2009/Jan/0219.html. This is 
> how the repro got on milw0rm in the first place 
> (http://milw0rm.com/exploits/8091). Aditya K Sood later submitted the 
> repro (slightly modified) to milw0rm as his code as well 
> (http://milw0rm.com/exploits/8219).
>
> Some say plagiarism is the sincerest form of flattery, so I guess I'll 
> start obfuscating my repros into ASCII art that says "SkyLined" to 
> prevent any more people from flattering me.
>
> Cheers,
> Sky
>
>
> Berend-Jan Wever  >
> http://skypher.com/SkyLined
>
>
>
>
> On Sat, Apr 4, 2009 at 2:39 PM, carl hardwick  > wrote:
>
> I found an unpatched vulnerability in the latest Firefox 3.0.8 allows
> a remote attacker to cause a DoS.
> A 0-day exploit is available here:
> 
> http://carl-hardwick.googlegroups.com/web/Firefox+3.0.8+DoS.htm?gda=i_oPfkcAAACkS-ZCh60y1HGkG90OfxntdaCvR5MIFXIiKOQt5O80jPqLKEFpBrbag3mOAa49_d8xnmtLTzx06f-L8nRUL3egeV4duv6pDMGhhhZdjQlNAw&gsc=HORKjws1umYfXMbeoe6wr8IrMRRv
> 
> 
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
>
> 
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Re: [Full-disclosure] Firefox 3.0.8 remote DoS: 0-day exploit

[Berend-Jan Wever]

...sigh

This is https://bugzilla.mozilla.org/show_bug.cgi?id=456727, which I
reported to Mozilla in September of 2009. It is a NULL ptr DoS, there is no
"exploit" in the sense of executing arbitrary code, just a "repro" that can
trigger a crash. The repro provided by Carl is the exact same repro I
provided to Mozilla.

Incidentally, Carl has report this exact same bug before:
http://seclists.org/fulldisclosure/2009/Jan/0219.html. This is how the repro
got on milw0rm in the first place (http://milw0rm.com/exploits/8091). Aditya
K Sood later submitted the repro (slightly modified) to milw0rm as his code
as well (http://milw0rm.com/exploits/8219).

Some say plagiarism is the sincerest form of flattery, so I guess I'll start
obfuscating my repros into ASCII art that says "SkyLined" to prevent any
more people from flattering me.

Cheers,
Sky


Berend-Jan Wever 
http://skypher.com/SkyLined




On Sat, Apr 4, 2009 at 2:39 PM, carl hardwick wrote:

> I found an unpatched vulnerability in the latest Firefox 3.0.8 allows
> a remote attacker to cause a DoS.
> A 0-day exploit is available here:
>
> http://carl-hardwick.googlegroups.com/web/Firefox+3.0.8+DoS.htm?gda=i_oPfkcAAACkS-ZCh60y1HGkG90OfxntdaCvR5MIFXIiKOQt5O80jPqLKEFpBrbag3mOAa49_d8xnmtLTzx06f-L8nRUL3egeV4duv6pDMGhhhZdjQlNAw&gsc=HORKjws1umYfXMbeoe6wr8IrMRRv
>
> ___
> Full-Disclosure - We believe in it.
> Charter: http://lists.grok.org.uk/full-disclosure-charter.html
> Hosted and sponsored by Secunia - http://secunia.com/
>
___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

[Full-disclosure] Firefox 3.0.8 remote DoS: 0-day exploit

[carl hardwick]

I found an unpatched vulnerability in the latest Firefox 3.0.8 allows
a remote attacker to cause a DoS.
A 0-day exploit is available here:
http://carl-hardwick.googlegroups.com/web/Firefox+3.0.8+DoS.htm?gda=i_oPfkcAAACkS-ZCh60y1HGkG90OfxntdaCvR5MIFXIiKOQt5O80jPqLKEFpBrbag3mOAa49_d8xnmtLTzx06f-L8nRUL3egeV4duv6pDMGhhhZdjQlNAw&gsc=HORKjws1umYfXMbeoe6wr8IrMRRv

___
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/