Back to list
Advisory : Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos.
Sep 24 2008 04:02AM
Aditya K Sood (0kn0ck secniche org)
*Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos.*
The Google chrome browser is vulnerable to memory exhaustion based
service which can be triggered remotely.The vulnerability triggers when
Return(\r\n\r\n) is passed as an argument to window.open() function. It
Google Chrome to generate number of windows at the same time thereby
to memory exhaustion. The behavior can be easily checked by looking at
manager as with no time the memory usage rises high. The problem lies in
triggered the pop
ups are started generating. The Google Chrome browser generate object
there by affecting memory of the resultant system. Probably it can be
crashed within no time.
User interaction is required in this.
*Proof of Concept*
SecNiche confirmed this vulnerability affects Google Chrome on Microsoft
Windows XP SP2 platform.The versions tested are:
Disclosed: 22 September 2008
Release Date. September 24 ,2008
Google acknowledges this vulnerability and "fix" will be released soon.
Aditya K Sood
The information in the advisory is believed to be accurate at the time
of publishing based on
currently available information. Use of the information constitutes
acceptance for use in an
AS IS condition. There is no representation or warranties, either
express or implied by or with
respect to anything in this document, and shall not be liable for a ny
implied warranties of
merchantability or fitness for a particular purpose or for any indirect
special or consequential
[ reply ]
Re: Advisory : Google Chrome Carriage Return Null Object Memory Exhaustion Remote Dos.
Sep 24 2008 05:37PM
LIUDIEYU dot COM (liudieyu com gmail com)
Copyright 2010, SecurityFocus