FYI: This was assigned to BID30983: http://www.securityfocus.com/bid/30983
Juha-Matti Rishi Narang [EMAIL PROTECTED] wrote: > Hi, > > "Time" can definitely plays a major role. There was a collision that > occurred due to the fact that I took time to find the real break point in the > code, search for a template and to publish at EvilFingers site before sending > it to Google and other bugtraqs. > > Even though I had the vulnerability 4 hrs well before the real publication of > the bug and had the exploit along with the some crash details like "int 3" > Kernel Exception/Trap @ 0x01002FF3, different attack cases, exceptions of > http/ftp and further debug logs; there was this bug published (though without > the details of possible cases, exceptions and mouse hover techniques) couple > of hours before I released it out at EvilFingers. > > So, I would like to convey due credit to Mr. JanDeMooij as well for his > posting the bug on http://code.google.com/p/chromium/issues/detail?id=122, > and thanks to Mr. Brennan for contacting me about the same. > > -- > Thanks & Regards, > Rishi Narang | Security Researcher > Founder, GREYHAT Insight > Key: 0x8D67A3A3 (www.greyhat.in/key.asc) > www.greyhat.in > > .. eschew obfuscation, espouse elucidation. > > Wednesday, September 3, 2008, 5:43:40 AM, you wrote: > > > -----Original Message----- > > From: [EMAIL PROTECTED] > > [mailto:[EMAIL PROTECTED] On Behalf Of Rishi > > Narang > > Sent: Tuesday, September 02, 2008 7:51 PM > > To: [email protected] > > Subject: [Full-disclosure] Google Chrome Browser Vulnerability > > > Hi, > > > --------------------------------------------------- > > Software: > > Google Chrome Browser 0.2.149.27 > > > Tested: > > Windows XP Professional SP3 > > > Result: > > Google Chrome Crashes with All Tabs > > > Problem: > > An issue exists in how chrome behaves with undefined-handlers in > > chrome.dll version 0.2.149.27. A crash can result without user > > interaction. When a user is made to visit a malicious link, which has an > > undefined handler followed by a 'special' character, the chrome crashes > > with a Google Chrome message window "Whoa! Google Chrome has crashed. > > Restart now?". It fails in dealing with the POP EBP instruction when > > pointed out by the EIP register at 0x01002FF4. > > > Proof of Concept: > > http://evilfingers.com/advisory/google_chrome_poc.php > > > Credit: > > Rishi Narang (psy.echo) > > www.greyhat.in > > www.evilfingers.com > > --------------------------------------------------- _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
