[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Google Chrome Browser Vulnerability
- To: Rishi Narang <psy.echo@xxxxxxxxx>, full-disclosure@xxxxxxxxxxxxxxxxx
- Subject: Re: [Full-disclosure] Google Chrome Browser Vulnerability
- From: Juha-Matti Laurio <juha-matti.laurio@xxxxxxxx>
- Date: Thu, 4 Sep 2008 14:46:12 +0300 (EEST)
FYI:
This was assigned to BID30983:
http://www.securityfocus.com/bid/30983
Juha-Matti
Rishi Narang [psy.echo@xxxxxxxxx] wrote:
> Hi,
>
> "Time" can definitely plays a major role. There was a collision that
> occurred due to the fact that I took time to find the real break point in the
> code, search for a template and to publish at EvilFingers site before sending
> it to Google and other bugtraqs.
>
> Even though I had the vulnerability 4 hrs well before the real publication of
> the bug and had the exploit along with the some crash details like "int 3"
> Kernel Exception/Trap @ 0x01002FF3, different attack cases, exceptions of
> http/ftp and further debug logs; there was this bug published (though without
> the details of possible cases, exceptions and mouse hover techniques) couple
> of hours before I released it out at EvilFingers.
>
> So, I would like to convey due credit to Mr. JanDeMooij as well for his
> posting the bug on http://code.google.com/p/chromium/issues/detail?id=122,
> and thanks to Mr. Brennan for contacting me about the same.
>
> --
> Thanks & Regards,
> Rishi Narang | Security Researcher
> Founder, GREYHAT Insight
> Key: 0x8D67A3A3 (www.greyhat.in/key.asc)
> www.greyhat.in
>
> .. eschew obfuscation, espouse elucidation.
>
> Wednesday, September 3, 2008, 5:43:40 AM, you wrote:
>
> > -----Original Message-----
> > From: full-disclosure-bounces@xxxxxxxxxxxxxxxxx
> > [mailto:full-disclosure-bounces@xxxxxxxxxxxxxxxxx] On Behalf Of Rishi
> > Narang
> > Sent: Tuesday, September 02, 2008 7:51 PM
> > To: full-disclosure@xxxxxxxxxxxxxxxxx
> > Subject: [Full-disclosure] Google Chrome Browser Vulnerability
>
> > Hi,
>
> > ---------------------------------------------------
> > Software:
> > Google Chrome Browser 0.2.149.27
>
> > Tested:
> > Windows XP Professional SP3
>
> > Result:
> > Google Chrome Crashes with All Tabs
>
> > Problem:
> > An issue exists in how chrome behaves with undefined-handlers in
> > chrome.dll version 0.2.149.27. A crash can result without user
> > interaction. When a user is made to visit a malicious link, which has an
> > undefined handler followed by a 'special' character, the chrome crashes
> > with a Google Chrome message window "Whoa! Google Chrome has crashed.
> > Restart now?". It fails in dealing with the POP EBP instruction when
> > pointed out by the EIP register at 0x01002FF4.
>
> > Proof of Concept:
> > http://evilfingers.com/advisory/google_chrome_poc.php
>
> > Credit:
> > Rishi Narang (psy.echo)
> > www.greyhat.in
> > www.evilfingers.com
> > ---------------------------------------------------
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/