680018 - rapt explorer with console and throw antiflooding bypass

Status: NEW

(Core :: Security, defect)

Description

[zkizzik]

User Agent: Mozilla/5.0 (Windows NT 6.1; rv:6.0) Gecko/20100101 Firefox/6.0
Build ID: 20110811165603

Steps to reproduce:

Firefox prevents the "throw" can be executed more than one time, but you can call as often as you want by creating new script tags.
This can be used to abduct the explirador by flooding the error console in different ways.

<script>
var i=0;
for(i=0;i<=3;i++){
	i = 1;
	document.write("\x3cscript\x3ethrow 'x';\x3c/script\x3e");
}
</script>


Actual results:

Crash all tabs.


Expected results:

nothing should preclude their use maximum number of tags or at least should not carry off all other tabs.

Comment 1

[Philip Chee]

Probably just your garden variety OOM situation.

Comment 2

[David Chan [:dchan]]

The main issue appears to be that
for(i=0;i<=3;i++){
	throw 'x';
}

will only throw once. However if you write <script> then those can also throw.

I don't think the infinite loop is a huge risk.

Comment 3

[zkizzik]

no, not at high risk, just wanted to warn that the error console Floden is possible to end all tabs because its use is shared with all other websites.

If I run this in another browser I get a warning that a script is causing the browser gets slow and I can stop it easily, but in the case of firefox freeze all tabs without the option to stop the attack.

For example cause the rise of my video on youtube 2 hours canceled.

Comment 4

[Rob Campbell [:rc] (:robcee)]

Thanks for reporting this, zkizzik.